Section
Cyber news for Southeast Asia and India, published daily: breaches and ransomware claims, scam-centre prosecutions, regulators and courts, plus the worldwide flaws that need patching now.
Philippines data breaches in Q3 2026: Viettel Cyber Security counted 83 incidents exposing 85.9 million records, and more than 9 million Philippine credentials compromised.
Apache HTTP Server CVE-2026-119618 is a critical race in mod_http2 that can lead to remote code execution on httpd 2.4.55 to 2.4.70. Version 2.4.71 fixes it.
Unocoin hacked: the Indian crypto exchange says outgoing transactions left one of its ETH addresses at custodian BitGo. Services have been suspended since 9 November.
Singapore's MOH says six healthcare bodies were hit by unauthorised access, with no patient health records reached. The newest, AIC's care planning system, exposed up to 4,064 staff NRICs.
Malaysian police took down 112 scam call centre syndicates in Ops Magpie, arresting 932 people, 826 of them foreigners, in 153 raids from 19 to 31 October.
Sarawak police shut seven online scam call centres in Ops Magpie and arrested 42 people. The syndicates targeted victims in Japan, China, Indonesia and Austria; 33 have been charged.
Jhalawar police arrested six people in Bihar over an old coin buying scam that used AI-made videos and fake police notices to extort a 56-year-old woman who later took her own life.
Singapore's Anti-Scam Centre and DBS, UOB, OCBC and GXS disrupted over 900 scam attempts in September and October, averting over S$35 million in potential losses.
Quang Ninh police in Vietnam found 10 South Koreans and 2 Chinese nationals running online scams from a rented apartment, posing as Korean police and prosecutors. Four face international warrants.
Thai Airways data breach: Thailand's data protection office has ordered a forensic report and proof passengers were told, and aviation regulator CAAT wants each one notified.
Dementia Singapore CARA app data breach: names, email addresses, phone numbers and membership IDs of some members may have been exposed on 1 November. NRIC numbers weren't.
Barracuda ESG CVE-2026-116606 lets an unauthenticated attacker import a crafted config; chained with CVE-2026-111560 it gives root. Both are exploited and in CISA's KEV catalogue.
