A Unisoc Modem Flaw Turns an Answered Video Call Into Android Kernel Access
Researchers published the second stage of an exploit chain that crosses from modem firmware into the Android kernel. The...
Wire
ASEAN edition · Tue, 18 Aug 2026 · Signal over noise
Cybersecurity News
AI-curated tech news, ASEAN business intelligence, and cybersecurity updates — written for the region.
529 articles
83 this week
14 desks
Health & Wellness
18
Privacy & Data
16
Cloud & Infra
16
Cyber Threat Intel
13
Consumer Tech
10
Sustainability
5
Statistics
4
Science
3
Advertisement
Weaker Models Can Read a Frontier Model's Encrypted Reasoning
OpenAI, Anthropic and Google return reasoning to clients as encrypted blocks. Researchers replayed those blocks into che...
One Malformed Request Crashes the Firewall. CISA Gave Three Days.
CVE-2026-20349 lets an unauthenticated attacker reload a Cisco ASA or FTD firewall through the remote-access SSL VPN. Th...
Advertisement
GLM-5.3 Finds Bugs Like the Frontier. It Is 23 Points Behind at Using Them.
Z.ai's model edges Mythos 5 by 0.7 points on vulnerability detection and trails it by 23.6 on exploit development. The s...
OpenAI Shipped an Exploit-Writing Model. The Base Model Could Already Do It.
GPT-5.6-Cyber completes 95 per cent of exploit-chain prompts against 1.5 per cent for the general model it is built on....
One Unrevoked Token, Three Tools Deep: Inside the LiteLLM Breach
Two poisoned LiteLLM releases were live on PyPI for forty minutes in March. CloudSEK has now mapped roughly 434,000 capt...
Microsoft Fixed 421 Flaws. Or 400. Only One Is Being Exploited.
Three different totals are circulating for the same Patch Tuesday, and all are defensible. The one number that matters i...
A SIM Card Can Order Your Phone Onto 2G. That Is in the Specification.
Birmingham researchers surveyed 26 devices and found nine expose an interface that lets the SIM issue modem commands. Th...
Three Days to Patch. CISA's Deadline Used to Be Three Weeks.
Every vulnerability CISA catalogued in the first week of August carried a three-day federal deadline. We measured the ca...
A Poisoned JSON Feed Made Hidden Admins on WordPress Sites
No plugin update was published. Attackers reached BdThemes storage, poisoned a feed the plugins pull into the admin dash...
A Signup Form Sent Passwords to Facebook and Google for Nearly Two Years
Klaviyo's signup form was misconfigured so third-party marketing trackers captured what users typed, including passwords...
You Patched SonicWall in Three Days. That May Not Have Been Enough.
Ransomware crews are now chaining two SonicWall SMA1000 flaws that CISA gave federal agencies three days to fix. If your...
Poland's Power Plants Were Reached Through the Mobile Network Nobody Watches
CERT Polska has documented the first real-world use of a private APN as a route into operational technology. Thirty wind...
A Zero-Day in a Dashboard Tool Took Framework's Entire Customer List
Framework and Tally were both breached on 3 August through a zero-day in Metabase, the business-intelligence tool they u...
Water Systems in Twelve States Were Broken Into. The Fix Is a Budget Line, Not Advice.
Water systems in at least twelve US states have been broken into, with attackers changing controller passwords and IP ad...
China Opened a Formal Review of Palo Alto. It Had Already Banned the Products.
China's Cybersecurity Review Office opened a formal review into Palo Alto Networks products on 6 August — seven months a...
MIT Broke Spectre v2 Defences. AMD Will Patch, Intel Will Not.
MIT researchers showed that Spectre v2 mitigations can be stepped around on current Intel and AMD processors, breaking K...
N-able's Patch Did Not Hold. The Second Hotfix Came Four Days Later.
N-able patched a critical authentication bypass in N-central, attackers found a path the patch did not block, and a seco...
Four VMware Flaws, and the One That Scores Lowest Is the One Hosting Providers Should Fix First
Two flaws score 9.8. The 9.3 lets an attacker with admin rights inside a virtual machine execute code on the host beneat...
A Researcher Found a Way to Switch Off a Singapore-Built Security Product
Three flaws in CatchPulse, the worst letting an unprivileged local user bypass policy enforcement. Reported 26 June, pat...
The Tomcat Flaw Being Exploited Today Was Created by a Security Fix
CVE-2026-34486 exists because of the fix for CVE-2026-29146. CSA reports active exploitation, and the catalogue lists th...
The Langflow Patch Deadline Is Today. Singapore Reported Active Exploitation Yesterday
CVE-2026-9198 gives unauthenticated remote code execution on default Langflow deployments. CISA allowed three days; CSA...
The Test Data Was Supposed to Be Fake. It Held 70,000 Real NRIC Numbers
A Singapore Land Authority test dataset created in 1998 was meant to hold only mock records. It held real names, NRIC nu...
Three Days to Patch N-able. A Year Ago 92% of KEV Entries Got Three Weeks
CISA gave three days to fix an actively exploited N-able bypass. Across the catalogue, the three-week remediation window...
Advertisement