BeyondTrust Remote Support Zero-Day Exploited Since August by Suspected China-Linked Group
CVE-2026-102764 lets attackers into self-hosted BeyondTrust Remote Support without a login. Mandiant ties it to ARMORY CASTLE. Patch and hunt now.
Section
Daily News page 5
CISA KEV October 2026: 36 Exploited Vulnerabilities Added So Far
Two Ivanti Connect Secure flaws went in on 30 October; GitLab, Cisco ASA, VMware ESX and the Linux kernel came in the two days before.
eMudhra CA Key Exposure: Eight Intermediate CA Private Keys Recoverable
Browsers have distrusted the eight CAs. Servers, Go, Node.js and Linux need updated certificate stores, and macOS command-line tools still trust them.
ASEAN Data Breach Costs Hit a Record US$4.12 Million: What IBM's 2026 Report Says
IBM's 2026 Cost of a Data Breach study puts the ASEAN average at US$4.12 million. Costliest sectors, AI-driven attacks and the encryption gap.
Node.js Fixes 10 Flaws, Including a Brotli Bug That Could Allow Remote Code Execution
Node.js 26.12.1, 24.22.1 and 22.23.4 fix 10 CVEs, including CVE-2026-111497 in the Brotli decoder, and remove three emSign roots from the bundled certificate store.
PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Takeover of Web Servers
PHP2Shell (CVE-2026-109618, CVE-2026-109619) lets one unauthenticated request run code on PHP servers. Fixed versions, who is exposed and what to do now.
Plex2Shell (CVE-2026-96656): Exposed Plex Media Servers Hijacked, Fixed in Build 1.43.3.10861
Attackers chain four Plex Media Server flaws against servers open to the internet and, Plex says, run crypto miners and proxy software on the ones they take over.
SIMBA Data Breach Exposes IC Numbers of 23,549 Singapore Customers
Names, IC numbers, birth dates, phone numbers and emails of 23,549 SIMBA customers were exposed. The PDPC is investigating.
Why Identity Access Management Sits at the Core of Cybersecurity
Security leaders from Bugcrowd, ForgeRock, CrowdStrike, HID, SailPoint, Palo Alto Networks and HashiCorp explain why IAM matters and how to deploy it.
Malaysia's Repeated Data Breaches, Ignorance or Weak Enforcement?
Malaysia keeps leaking citizens' personal data. The 2022 incidents, the limits of the PDPA 2010, how other countries fine offenders, and expert advice.
.webp)
Cyber Security Asia 2021 Brings Regional Experts Together Online
Cyber Security Asia 2021 ran online over two days in October, opening with CyberSecurity Malaysia's CEO on cyber resilience and a panel on the role of CISOs.
Kaspersky Urges Malaysian Organisations to Know Their Enemy Through Threat Intelligence
At a briefing for Malaysian media, Kaspersky set out three kinds of threat groups and argued that threat intelligence lets organisations go on the offence.