Original: 說明本公司發生網路資安事件
U.R. (5321)ASEC Highlights The Gentlemen Ransomware Attack on South Korean IT Distributor Amid Broader Dark Web Threats
ASEC Blog’s Week 5, July 2026 report details a ransomware attack by The Gentlemen group on a South Korean IT software distributor and infrastructure service provider, alongside a Termite ransomware incident targeting a U.S. nonprofit healthcare provider and a ShinyHunters data leak claim involving a global accounting and consulting firm, underscoring persistent ransomware risks to technology service providers and their potential role in supply chain exposure.
CISA Adds Two Actively Exploited Vulnerabilities to KEV Catalog
CISA has added CVE-2025-68686 (Fortinet FortiOS information exposure) and CVE-2026-16812 (Arista VeloCloud Orchestrator command injection) to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, reinforcing BOD 26-04 requirements for federal agencies and urging all organizations to prioritize patching.
Arista VeloCloud Orchestrator Command Injection Flaw Under Active Exploitation
Attackers are actively exploiting CVE-2026-16812, a critical command injection vulnerability in on-premises Arista VeloCloud Orchestrator (VCO) versions, enabling arbitrary code execution and potential compromise of managed SD-WAN infrastructure. CISA has added the flaw to its KEV catalog with a July 30, 2026 patch deadline for federal agencies.
OpenAI Open-Sources Codex Security Toolchain for AI-Powered Code Scanning in CI/CD
OpenAI has released the command-line interface and TypeScript SDK for Codex Security as open-source software, enabling developers to scan local code and Git changes for vulnerabilities and integrate checks into pre-commit and CI workflows, though actual analysis relies on OpenAI cloud services and requires authentication via ChatGPT login or API key.
ABB KNX Update Tool Vulnerability Exposes Legacy KNX Devices to Physical Tampering
A vulnerability in ABB’s KNX Update Tool allows attackers with physical bus access to compromise legacy KNX devices lacking integrity checks, rendering them unusable or altering behavior, with no software fix possible due to outdated protocol design.
Critical Mendix Runtime Vulnerability Exposes User Data via Insecure Inherited Permissions
A critical vulnerability (CVE-2026-7891) in Siemens Mendix Runtime allows privilege escalation and unauthorized access to sensitive user data due to inadequate documentation of System.User entity behavior, enabling misconfigured access rules that expose all records to anonymous users.
Research Digest: Multi-Path Retrieval Enhances L MLLM Improves MLPS Compliance Analysis in China
A new large language model framework integrates hierarchical, tree-based, and tokenization-based retrieval to improve accuracy and traceability in China’s Multi-Level Protection Scheme (MLPS) compliance analysis, addressing limitations of general-purpose LLMs in standards-intensive cybersecurity governance.
AtlasRAT Loader Chain Reveals Builder-Based Malware Framework Targeting WeChat in East Asia
AhnLab ASEC details a four-stage in-memory loader chain for AtlasRAT, a Windows RAT using Delphi-based Flash Player lures, TLS-ChaCha20 C2, offline keylogging, and WeChat.exe DLL injection, with evidence pointing to a builder-based framework rather than a single operator, highlighting implications for regional threat monitoring.
China’s National AI Agent Identity System Uses Split-Knowledge Binding for Accountability Without Business-Layer Exposure
A Chinese national AI agent identity system launching in Q3 2026 uses split-knowledge binding to link agents to verified legal principals without revealing identities to business participants, requiring dual-agency compulsion for re-identification by legal authorities.
AWS DevOps Agent Accelerates Network Firewall Troubleshooting by Automating Root Cause Analysis
AWS DevOps Agent reduces AWS Network Firewall troubleshooting time from hours to minutes by automatically correlating CloudWatch alarms, firewall logs, route tables, and CloudTrail API calls to identify rule changes causing connectivity drops, demonstrated through three failure scenarios including domain deny lists, stateless rule misconfigurations, and asymmetric AZ routing.