Phishing scams are impersonating government agencies and popular AI tools. The use of AI as a tool for cyber attacks has increased. Vulnerability of cold storage facilities threaten food and medical supply chains. And essential updates to enterprise tools.
North Korean hackers stole USD 388M from Bitget. ShinyHunters compromised the cybercrime leak site, risking secondary extortion. Ad-blocker browser extension exposed as spyware. Apple patched 260+ flaws, while a critical Cisco SD-WAN zero-day faces active exploitation.
In Central Asia hundreds of fake government websites are uncovered. Over 220 million travel records exposed from Vietnam's travel database. VPN flaw compromises government personnel records of Japan. And critical security updates for Microsoft and Apple users
This brief covers cyber espionage operations targeting Philippines and Myanmar government data. Compromised WiFi routers with pre-programed backdoors. Developments in AI generated disinformation campaigns. And, analysis on recent cyberattacks targeting healthcare companies.
192 reports
A sophisticated cyber threat group sponsored by North Korea has launched an aggressive supply chain attack, compromising over one hundred open-source packages and browser extensions. The operation shows how state-actors fund state operations and bypass international sanctions.
A former European Parliament member investigating the Pegasus spyware tool had his personal device compromised twice. The highly sophisticated zero-click exploit targeted unpatched software vulnerabilities, emphasizing the absolute necessity of maintaining updated systems.
Cybersecurity researchers have identified the first ransomware operation driven entirely by an artificial intelligence agent. The autonomous actor executed the entire attack chain by exploiting vulnerabilities to encrypt databases, marking a new era of automated cyber threat
An aggressive password spraying campaign recently targeted Microsoft 365 environments, exploiting multi factor authentication gaps compromising numerous organizations.
A Chinese cyberespionage group has expanded its operations into Southeast Asia, targeting government entities and critical energy infrastructure.
Microsoft has disclosed a critical security vulnerability in its SharePoint Server platform that allows authenticated threat actors to execute remote code. The United States Cybersecurity and Infrastructure Security Agency has added this active hazard to its known exploited vulnerabilities list.
Adobe has disclosed a critical vulnerability in its ColdFusion web application development platform that allows threat actors to execute remote code without authentication. The United States government has confirmed active exploitation, urging immediate system updates to prevent compromise.
A global data leak known as FortiBleed has exposed the firewall and virtual private network credentials of over seventy-four thousand Fortinet devices. A Russian-speaking threat group utilized recycled credentials and a custom harvesting tool to compromise prominent multinational enterprises
Recent supply chain attacks have compromised multiple organizations, including LastPass and the Mastra Artificial Intelligence framework. By exploiting vendor vulnerabilities and developer accounts, threat actors leverage initial breaches to target downstream networks, amplifying third-party risks.
Researchers from Paradigm Shift disclosed a permanent hardware vulnerability in older Apple devices. By bypassing the secure boot chain via a physical connection, the exploit grants control before the OS loads.
Cisco Systems disclosed critical vulnerabilities in its Identity Services Engine that allow remote code execution and data access. By exploiting authorization bypasses and input validation flaws, attackers can escalate privileges to root. Users must apply the official software patches immediately.
Software provider Splunk disclosed a critical vulnerability allowing unauthenticated remote code execution. Exploiting an authentication flaw in the web interface, attackers can route malicious traffic to an internal database sidecar. Organizations must patch systems immediately.
Chinese authorities have dismantled the Silver Fox cybercrime group under an amended Cybersecurity Law. This enforcement highlights a shift toward an aggressive cybersecurity posture with expanded extraterritorial reach, whichy maycomplicating the global regulatory environment for businesses.
The International Criminal Police Organization reports a sharp rise in cybercrime across the Asia-Pacific region. Driven by artificial intelligence and social engineering, these industrialized threats exploit human lapses, linking financial fraud directly to state espionage.
Threat actors use compromised WhatsApp accounts to distribute malicious files disguised as business documents. These scripts install management tools, granting remote access to devices. Organizations are advised to avoid unmanaged communication platforms.
The official website of the Philippine Senate was defaced by a local hacktivist group known as Nullsec Philippines. Officials confirmed that no sensitive information was compromised during the incident. The webpage remains under maintenance while government agencies investigate the breach.
Check Point disclosed a critical VPN flaw (CVE-2026-50751) allowing unauthenticated access. Exploited by the Qilin ransomware group for data theft, users are urged to apply patches immediately.
Google has issued an emergency update for the Chrome browser to patch hundreds of security flaws. This includes an actively exploited vulnerability within the JavaScript engine that allows remote threat actors to execute malicious code when a user visits a compromised website.
Threat actors compromised around twenty thousand Instagram accounts by exploiting a security flaw in an artificial intelligence support tool managed by Meta. The system failed to verify identity, allowing attackers to hijack accounts lacking multi-factor authentication.
United States government agencies have issued a critical warning regarding threat actors actively targeting internet-exposed automatic tank gauge systems. These vulnerable devices monitor essential fuel levels across vital infrastructure sectors like energy and transportation.
Microsoft has released its June security update fixing two hundred vulnerabilities, including six zero-day flaws. With one critical vulnerability already actively exploited in the wild, organizations must prioritize these patches immediately to protect their networks.
International intelligence alliance, Five Eyes, has warned that a Chinese espionage campaign is actively using professional networking websites to target government and military personnel. By posing as corporate recruiters, threat actors lure officials into sharing sensitive information.
Security researchers discovered a sophisticated cyber espionage campaign directed at the Ministry of Finance in Afghanistan. Suspected Pakistani state actors used targeted emails in local languages to distribute malicious software and access government networks.
Recent cascading supply chain attacks are targeting software ecosystems. By exploiting developer credentials, automated workflows, and open source repositories, threat actors achieve a massive downstream impact, compromising major artificial intelligence firms.
LiteSpeed Technologies released security updates addressing a maximum severity vulnerability in its control panel plugin. The actively exploited flaw allows low privilege users to gain root access, risking complete server compromise in shared hosting environments.
Cisco released critical security updates addressing a vulnerability in its Secure Workload platform. The flaw allows unauthenticated remote actors to bypass authentication and gain full administrator control, risking complete network compromise.
Ubiquiti released critical security updates addressing three vulnerabilities in UniFi Operating System with maximum severity scores. The flaws allow remote actors to make unauthorized changes, access files, or execute commands without user interaction, risking full network control.
The cybercrime group ShinyHunters leaked stolen cloud documents after 7-Eleven refused extortion demands following a recent data breach. The incident exposed the personal information of thousands of individuals, highlighting global security risks.
Chinese espionage groups are escalating cyber operations by deploying sophisticated new malware against telecommunications companies. By utilizing custom tools for persistent network access, these actors hide their tracks while gathering high value intelligence across regions.
Microsoft has patched critical buffer overflow vulnerabilities, CVE-2026-41089 and CVE-2026-41096, which enable unauthenticated remote code execution on Windows servers and domain controllers.
Half of real-world passwords are easily cracked due to predictability and high computational power. Using methods like brute forcing and smart cracking, actors exploit human patterns. Enterprises must adopt randomized passwords, dedicated managers, passkeys, and multi-factor authentication.
A critical vulnerability in the Vm2 sandboxing library allows threat actors to escape isolated environments and execute arbitrary code on host systems. Enterprises must upgrade to version 3.11.2 or higher immediately to mitigate severe risks of supply chain attacks and data exfiltration.
The Cybersecurity and Infrastructure Security Agency warns the Copy-Fail Linux vulnerability is actively exploited. It allows unprivileged users to overwrite memory for root access. Enterprises must apply updates immediately to prevent stealthy backdoors and container escapes.
Google released Chrome version 148 addressing 127 vulnerabilities, including three critical flaws allowing remote code execution. Enterprises must immediately update all browsers to mitigate severe risks of drive-by exploitation and broader attack surface compromises.
Threat group ShinyHunters exploited a Cross-Site Scripting vulnerability to breach educational technology firm Instructure, extracting over three terabytes of data and defacing portals. A settlement halted leaks, underscoring critical enterprise risks regarding data compartmentalization.
Palo Alto Networks has disclosed a critical buffer overflow vulnerability, CVE-2026-0300, allowing unauthenticated remote code execution with root privileges. Enterprises should immediately restrict access to the authentication portal and apply security updates to mitigate high-level risks.
Recent supply chain attacks demonstrate a cascading effect, where threat actors like TeamPCP exploit compromised credentials and CI/CD vulnerabilities to infect downstream targets. Organizations must assume a breach if affected software was used and prioritize securing developer access.
A China-aligned cyber espionage campaign targets Asian governments and infrastructure using phishing and server vulnerabilities. This threatens Philippine enterprises through supply chain risks, data theft, and foreign exposure within the telecommunications and power sectors.
Threat actors use search engine advertisements to launch adversary-in-the-middle phishing attacks. By impersonating trusted platforms, attackers steal credentials and bypass two-factor authentication, posing a critical risk to enterprise networks.
Following the ban on offshore gaming operators, cheap bulk text messaging devices are flooding Philippine black markets. Criminals use these portable tools to mimic cell towers and launch localized phishing attacks, creating persistent fraud risks for regional enterprises.
Threat actors use Artificial Intelligence to impersonate trusted Philippine news outlets and business leaders in investment scams. Promoted via social media advertisements, these campaigns steal credentials and funds, posing a severe reputational and fraud risk to regional enterprises.
A critical Linux kernel vulnerability allows unprivileged users to gain full root access by exploiting a logic flaw in the cryptographic subsystem. This memory-only exploit enables stealthy backdoor injection and container escapes without leaving a digital footprint.
An alleged data breach involving the Philippine Drug Enforcement Agency was reported on April 18, 2026, with threat actor "FEMBOYSEC" claiming to hold 400GB of sensitive data. The leak reportedly includes 100,000 PII records and pharmaceutical certificates, though official verification is pending.
A NASA investigation revealed a multi-year Chinese spear-phishing campaign targeting export-controlled aerospace software. The threat actor used social engineering to infiltrate defense networks. This highlights persistent regional risks for the Philippines' critical infrastructure.
ShinyHunters is targeting global brands like Udemy and 7-Eleven by exploiting Salesforce misconfigurations, while over 80 Chrome extensions were found harvesting data from 6.5 million users. Enterprises must audit cloud permissions and mandate separate browser profiles for work and personal use.
Cloud platform Vercel confirmed a data breach after a supply chain attack on a third-party AI tool, Context.ai. Threat actors used stolen OAuth tokens to access internal systems. Enterprises are advised to revoke the Context.ai OAuth app and restrict broad third-party permission grants.
International agencies warn of China-linked threat actors using compromised devices to build botnets for covert espionage. These networks disguise malicious traffic as legitimate consumer activity. Enterprises are advised to update end-of-life devices, implement MFA, and adopt zero-trust.
NIST is scaling back National Vulnerability Database enrichment due to a 263 percent increase in submissions. Only high-priority CVEs will receive severity scores and details. Organizations are advised to adopt proactive management strategies, as they can no longer rely on NIST as a sole source.
SGLang has a critical vulnerability that enables remote code execution via malicious GGUF model files. The flaw lacks process isolation, allowing attackers to control host systems, steal data, or copy intellectual property.
A critical vulnerability in the Breeze Cache WordPress plugin allows unauthenticated file uploads and remote code execution. The flaw enables full site takeover. Enterprises are advised to update to version 2.4.5 or disable local Gravatar hosting immediately.
