Cyber Risks Brief - July 23, 2026
Regional cyber espionage, new data classification policies, artificial intelligence threats, and severe software vulnerabilities require immediate risk mitigation and security compliance
Cyber Risks Briefs | Philippines
Login required for search functionality | Get a free-level account with Google/Microsoft single-sign-on.
Latest Cyber Risks Briefs
Cyber Risks Brief - July 9, 2026
Asia-Pacific enterprises face escalating risks from financially motivated cybercrime, state-sponsored espionage targeting critical infrastructure, and advanced software supply chain attacks, alongside emerging threats like automated artificial intelligence ransomware operations.
Cyber Risks Brief - June 25, 2026
Cyber crime surges across the Asia Pacific region as the Philippines becomes a focal point for fraudulent operations. Enterprises face severe threats from complex supply chain attacks, massive credential leaks, and critical software vulnerabilities requiring immediate remediation.
Cyber Risks Brief - June 11, 2026
Global cyber threats are escalating as state-sponsored espionage, ransomware campaigns, and website defacement target critical infrastructure and government entities worldwide. To mitigate these digital risks, organizations are advised to patch critical software flaws immediately.
Write-ups
151 reports
Linux Kernel Vulnerability “Copy Fail” Enables Full Root Access
A critical Linux kernel vulnerability allows unprivileged users to gain full root access by exploiting a logic flaw in the cryptographic subsystem. This memory-only exploit enables stealthy backdoor injection and container escapes without leaving a digital footprint.
Alleged PDEA Data Breach and Ransom Threat
An alleged data breach involving the Philippine Drug Enforcement Agency was reported on April 18, 2026, with threat actor "FEMBOYSEC" claiming to hold 400GB of sensitive data. The leak reportedly includes 100,000 PII records and pharmaceutical certificates, though official verification is pending.
State-Sponsored Spear-Phishing Targeting Aerospace and Defense Software
A NASA investigation revealed a multi-year Chinese spear-phishing campaign targeting export-controlled aerospace software. The threat actor used social engineering to infiltrate defense networks. This highlights persistent regional risks for the Philippines' critical infrastructure.
Emerging Cyber Threats Aimed at Harvesting User Data Underscores the Importance of Segregating Online Activity
ShinyHunters is targeting global brands like Udemy and 7-Eleven by exploiting Salesforce misconfigurations, while over 80 Chrome extensions were found harvesting data from 6.5 million users. Enterprises must audit cloud permissions and mandate separate browser profiles for work and personal use.
Cloud Platform Vercel Confirmed Data Breach via Supply Chain Attack
Cloud platform Vercel confirmed a data breach after a supply chain attack on a third-party AI tool, Context.ai. Threat actors used stolen OAuth tokens to access internal systems. Enterprises are advised to revoke the Context.ai OAuth app and restrict broad third-party permission grants.
Security Agencies Warn of China-Linked Threat Actors Using Compromised Devices for Botnet Operations
International agencies warn of China-linked threat actors using compromised devices to build botnets for covert espionage. These networks disguise malicious traffic as legitimate consumer activity. Enterprises are advised to update end-of-life devices, implement MFA, and adopt zero-trust.
NIST Updates CVE Reporting Due to Volume of Vulnerability Submissions
NIST is scaling back National Vulnerability Database enrichment due to a 263 percent increase in submissions. Only high-priority CVEs will receive severity scores and details. Organizations are advised to adopt proactive management strategies, as they can no longer rely on NIST as a sole source.
SGLang Vulnerability Enables Remote Code Execution via Malicious GGUF Model Files (CVSS 9.8)
SGLang has a critical vulnerability that enables remote code execution via malicious GGUF model files. The flaw lacks process isolation, allowing attackers to control host systems, steal data, or copy intellectual property.
Hackers exploit file upload bug in Breeze Cache WordPress plugin (CVSS 9.8)
A critical vulnerability in the Breeze Cache WordPress plugin allows unauthenticated file uploads and remote code execution. The flaw enables full site takeover. Enterprises are advised to update to version 2.4.5 or disable local Gravatar hosting immediately.
Microsoft releases emergency patches for critical ASP.NET flaw (CVSS 9.1)
Microsoft has issued emergency patches for CVE-2026-40372, a critical ASP.NET flaw. The vulnerability allows unauthenticated attackers to forge credentials and gain system-level privileges. Enterprises are advised to update to version 10.0.7 and rotate data protection key rings.
Compromised Bitwarden Developer Package Threatens Developer Credentials
On April 22, 2026, a supply chain attack targeted the Bitwarden CLI npm package, injecting malware to steal cloud tokens and SSH keys. Enterprises are advised to rotate developer credentials and audit third-party vendor risks to mitigate vulnerabilities in automated software build environments.
Microsoft’s Monthly Patch - April 2026: 167 Vulnerabilities, 2 Zero-days
Microsoft's April 2026 update addresses 167 vulnerabilities, including two active zero-days: CVE-2026-32201 in SharePoint and CVE-2026-33825 in Microsoft Defender. With eight critical flaws identified, including remote code execution, administrators must prioritize these patches immediately.
Vulnerability in wolfSSL Library Enables Forged Certificate Use (CVSS 9.3)
wolfSSL disclosed a critical signature verification vulnerability. This flaw allows attackers to bypass cryptographic trust mechanisms and forge digital identities. Organizations should update to version 5.9.1 to prevent unauthorized access.
Marimo Pre-authentication Remote Code Execution Flaw Now Under Active Exploitation (CVSS 9.3)
Marimo disclosed a critical remote code execution vulnerability. This flaw allows unauthenticated attackers to gain root access via the terminal WebSocket endpoint. Enterprises must immediately update to version 0.23.0 to protect sensitive AI workloads.
Fortinet Patches Actively Exploited Vulnerability in FortiClient Endpoint Management System (CVSS 9.8)
Fortinet disclosed a critical zero-day vulnerability in FortiClient EMS. This flaw allows unauthenticated attackers to bypass authentication and execute commands. Enterprises are advised to update to version 7.4.7 immediately to prevent full system compromise.
Threat Actor Exploit Critical Flaw in Ninja Forms WordPress plugin (CVSS 9.8)
Ninja Forms disclosed a critical file upload vulnerability. This flaw allows unauthenticated attackers to upload malicious scripts and achieve remote code execution. Enterprises are advised to immediately update the plugin to version 3.3.27 or later.
Developments in the Axios Breach: Understanding the Social Engineering Used
North Korean threat group UNC1069 hijacked the Axios library through a sophisticated social engineering campaign. By impersonating tech executives in fake Slack workspaces, attackers pressured maintainers into installing malware disguised as system updates. This highlights the risk to developers.
US Government Agencies Warn of Iran Backed Cyber Attacks on US Critical Infrastructure
Iran-linked threat actors are pivoting from espionage to disruptive cyber warfare against critical infrastructure. Using malware like IOCONTROL, groups target internet-facing industrial controllers in the water and energy sectors. This escalation includes destructive wiper attacks on US firms.
Max Severity Flowise Remote Code Execution Vulnerability Exploited in Attacks (CVSS 10.0)
Flowise disclosed a maximum severity remote code execution vulnerability. This flaw allows unauthenticated attackers to inject malicious scripts, leading to full system takeover. Enterprises are advised to immediately update to version 3.1.1 to mitigate risk.
Advertising Intelligence: Understanding the Risks of Ad-Based Surveillance Systems
Researchers at the University of Toronto’s Citizen Lab released a report on how global law enforcement and government agencies utilize Webloc, a “global geolocation surveillance” tool by software developer company, Penlink. Webloc leverages advertising intelligence (ADINT) to track devices and monitor the movement of individuals. ADINT is the practice
LucidRook Malware Campaign Targets Taiwan NGOs and Universities
The LucidRook campaign targets Taiwan-based organizations using sophisticated spear-phishing and geofencing. Attackers bypass security controls with password-protected archives to deploy malware via malicious shortcuts. This cluster focuses on stealing sensitive data through social engineering.
Human-Centric Cyber Threats on the Rise
Cybercrime in Southeast Asia is shifting toward organized, cross-border networks. In the Philippines, syndicates exploit government trust through social engineering and banking trojans. This human-centric approach combines manipulation with malware to facilitate unauthorized fund transfers.
CISA Urges Immediate Patching of Actively Exploited NetScaler Vulnerability (CVSS 9.3)
The Cybersecurity and Infrastructure Security Agency (CISA) is urging federal agencies to patch a critical vulnerability in Citrix NetScaler appliances. This flaw allows unauthorized actors to steal sensitive data. Security experts warn that thousands of systems remain exposed to this threat.
CISA Warns of Actively Exploited Vulnerability in Langflow AI Workflows (CVSS 9.3)
The Cybersecurity and Infrastructure Security Agency (CISA) warns that threat actors are actively exploiting a critical vulnerability within the Langflow framework. This flaw allows unauthorized individuals to execute remote code and harvest sensitive credentials from AI workflows.
Oracle Releases Patch for Vulnerability in Identity Manager and Web Services Manager (CVSS 9.8)
Oracle released an urgent security update to address a critical remote code execution vulnerability affecting its identity and web services platforms. This flaw allows unauthorized actors to seize control of enterprise systems. Organizations are advised to apply the provided patch immediately.
Patch Now: Account Takeover Vulnerability in Ubiquiti Unifi (CVSS 10.0)
Ubiquiti has disclosed a maximum severity security flaw in its network management software. This directory navigation vulnerability allows unauthorized actors to bypass restrictions and seize full control of systems. Administrators are advised to update all platforms immediately.
Iranian-Linked Cyber Operations Threaten Civilian and Private Networks Exposure
The Federal Bureau of Investigation (FBI) warns that the threat actor group known as Handala uses specialized malware to target civilians and journalists. Linked to the Iranian Ministry of Intelligence and Security, these operations exploit messaging bots to exfiltrate sensitive data.
CISA Urges Immediate Patching of Actively Exploited NetScaler Vulnerability (CVSS 9.3)
The Cybersecurity and Infrastructure Security Agency (CISA) is urging federal agencies to patch a critical vulnerability in Citrix NetScaler appliances. This flaw allows remote actors to steal sensitive data from memory. Organizations must update systems immediately to prevent active exploitation.
Supply Chain Attack Targeting Popular Javascript Tool Axios, and Open Source Security Scanner Trivy, Affecting Enterprise Environments
Recent supply chain attacks targeting Axios and Trivy have exposed critical vulnerabilities in enterprise software dependencies. These incidents allowed threat actors to steal credentials and install malicious software. Organizations are advised to rotate keys and audit systems.
FCC Moves to Ban Foreign-Made Routers
The Federal Communications Commission (FCC) has expanded its list of restricted equipment to include foreign manufactured routers. This decision follows major cyber attacks on critical infrastructure. While existing devices remain functional, businesses are advised to audit procurement.
NVIDIA Releases Patches for Vulnerability that Enables RCE and DoS Attacks (CVSS 9.0)
NVIDIA has issued critical security updates to address a severe vulnerability within its enterprise artificial intelligence software infrastructure. This flaw enables remote command execution and system disruption. Organizations are advised to apply these patches immediately.
Victim Reportedly Lost Money in Bank Account via Vishing Scam
Sophisticated voice phishing scams are rising as criminals use stolen personal data and recorded messages to deceive bank clients. By mimicking legitimate automated systems and creating a false sense of urgency, threat actors successfully bypass security to execute unauthorized transfers.
Iranian-Linked Hacktivist Group Claim Attack on US Medtech Giant Stryker
Handala, an Iranian-linked threat group, sabotaged medical giant Stryker by weaponizing Microsoft Intune. By compromising a Global Admin account, they issued a mass remote wipe command, factory-resetting 80,000 devices. This signals a shift from cyber espionage to destructive sabotage.
Threat Actors Using Search Engine Poisoning to Distribute Fake Enterprise VPNs
Threat actors are using search engine optimization poisoning to distribute fake VPN clients impersonating Fortinet and Cisco. These malicious sites trick users into downloading credential-stealing malware, granting attackers direct, authenticated access to corporate networks.
Apple Patches Critical “Coruna” Exploits on Older Devices
Apple released critical patches for older iOS and iPadOS devices to address vulnerabilities exploited by the Coruna kit. These flaws allow threat actors to bypass security and gain total device control. Active exploitation has been confirmed, targeting sensitive data and crypto wallets.
Multiple Remove Code Execution Vulnerabilities Expose Veeam Backup Servers to Takeover (CVSS 9.9)
Veeam disclosed four critical remote code execution vulnerabilities in its Backup and Replication platform, carrying a high severity score of 9.9. These flaws allow low-privileged users to gain total control of backup servers, posing a significant risk of ransomware attacks and data loss.
Update Now: Google Patches Two Zero-Day Flaw Exploited in the Wild (CVSS 8.8)
Google disclosed two zero-day vulnerabilities in the Chrome Skia and V8 engines. These flaws allow remote code execution via malicious webpages. With active exploitation confirmed, organizations must immediately update Chromium-based browsers to prevent unauthorized system access.
Microsoft’s Monthly Patch – March 2026: 79 Vulnerabilities, Two Zero-days
Microsoft released its March 2026 update, patching 79 vulnerabilities including two zero-days. A critical remote code execution flaw in the Microsoft Devices Pricing Program, carrying a severity score of 9.8, highlights the release. Adobe, Cisco, and Fortinet also issued security patches.
APT41-Linked Group Targets Government Sector Across Southeast Asia
The Chinese-linked threat actor Silver Dragon, part of the APT41 umbrella, is conducting a sophisticated espionage campaign across Southeast Asia. By utilizing techniques like DLL side-loading, the group targets government entities and critical infrastructure to harvest long-term intelligence.
Philippine Government Intensifies Efforts to Disrupt Illegal Gambling Sites and Regional Scam Networks
The Philippine CICC is intensifying its crackdown on illegal gambling, though an automated system glitch recently disrupted legitimate platforms. Concurrently, Meta removed 150,000 scam-linked accounts in Southeast Asia, signaling a rigorous regional effort to combat cyber fraud.
Professional Regulation Commission Allegedly Suffers from 9GB Data Leak
The Professional Regulation Commission reportedly suffered a massive data leak involving 9 gigabytes of sensitive licensing documents and personal information. Allegedly executed by the threat actor FEMBOYSEC, the breach underscores critical cybersecurity gaps in the government’s digital shift.
U.S. and Australian Agencies Issue Warnings on Possible Cyberattacks in Connection with Ongoing Conflict in the Middle East
U.S. and Australian agencies have issued joint warnings of potential cyberattacks against financial institutions tied to Middle East tensions. CISA and ACSC urge proactive defense against DDoS and hacktivist threats to mitigate operational, reputational, and regulatory risks.
U.S. and Australian Agencies Issue Warnings on Possible Cyberattacks in Connection with Ongoing Conflict in the Middle East
U.S. and international agencies warn of heightened cyber threats from Iran targeting financial institutions. Organizations face risks of operational disruption via DDoS attacks and reputational damage. Security leaders must prioritize proactive defense and cyber hygiene to mitigate impacts.
Dormant RESURGE Malware Actively Targeting Ivanti Devices
A critical zero-day vulnerability in Ivanti VPN appliances allows remote attackers to gain full system control. State-sponsored actors are using RESURGE malware to maintain hidden, persistent access.
Malicious Chrome Extensions Exploit Gemini AI Browser Panel to Access Cameras and Files
A high-severity vulnerability in Google Chrome allows malicious browser extensions to hijack the Gemini panel. This flaw grants attackers access to cameras, microphones, and local files. Enterprises must ensure all endpoints are updated to Chrome version 143.0.7499.192 or later to mitigate risks.
ClawJacked: Critical Zero-Click Vulnerability in OpenClaw AI Agents
The "ClawJacked" vulnerability in OpenClaw allows remote attackers to hijack local AI agents via malicious websites. This zero-click exploit grants full control over developer environments, including file exfiltration and system commands. Organizations must update to version 2026.2.25.
Exploited Zero-Day Flaw in Windows MSHTML Framework
A zero-day vulnerability in Microsoft HTML allows attackers like APT28 to bypass security warnings and execute code via malicious files. Exploited in the wild, this flaw targets Windows systems. Organizations are advised to apply the February 2026 security updates immediately to mitigate risk.
Dormant RESURGE Malware Actively Targeting Ivanti Devices
A critical zero-day in Ivanti VPNs allows remote attackers to gain full system control via RESURGE malware. State-sponsored actors use this to maintain hidden persistence. Standard patches are insufficient; organizations are advised to use specialized tools to detect the threat.
Angular SSR Vulnerability Enables Unauthorized Server Requests
A critical SSRF vulnerability in the Angular SSR framework allows attackers to redirect internal traffic and exfiltrate sensitive data. With a CVSS of 9.2, this flaw enables private network probing. Organizations are advised to immediately update to Angular version 19.2.21 or higher.
CISA Mandates Patch for Actively Exploited FileZen Vulnerability
A command injection vulnerability in Soliton Systems FileZen allows authenticated users to execute malicious commands. CISA confirmed active exploitation, adding it to the KEV catalog. Organizations are advised to update to version 5.0.11 or later to prevent full system compromise.