For IT and security teams in Taiwan
We track security incidents in Taiwan and worldwide, tell you the first thing to do, and alert you when an incident affects your systems. Every sentence is sourced.
Last 90 days
Last 90 days: 42 active incidents, 30 countries involved, 7 attributed routes. Featured incident: Attackers exploit Xen Orchestra empty-object login token flaw VSA-2026-062 to gain admin rights without credentials and take over XCP-ng hosts as root. First steps: Upgrade Xen Orchestra to 6.9.1 (stable, xo-server 5.211.2) or 6.10.0 (latest, xo-server 5.213.1) immediately., If you cannot upgrade yet, keep Xen Orchestra off the internet on a dedicated management network, block traffic to and from 91.211.251.112 and Tor, and block authenticationToken=j:{} and authenticationToken=j:%7B%7D in a WAF or reverse proxy., On XCP-ng hosts, look for VMs with hvmserial: file, a VM named pivot2, and the files /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5 and /.ustar6; if compromised, rotate every password and secret used by Vates VMS..
High-risk or exploited incidents from the last 14 days, by severity. The first step comes from each advisory's guidance.
First stepUpgrade Xen Orchestra to 6.9.1 (stable, xo-server 5.211.2) or 6.10.0 (latest, xo-server 5.213.1) immediately.
First stepMSPs and IT teams running on-premises N-central should follow N-able guidance to temporarily take servers offline until further notice and watch for its updates about every four hours
First stepOrganizations running Aspera Faspex 5 should upgrade to 5.0.19 PL1 now and confirm the faspex-core image is 5.0.19 (1ce4b13, Fix Pack: 1); IBM lists no workarounds
First stepSAP customers should apply SAP Notes 3778530, 3778556, 3798345 and 3849308 from the support portal as a priority
First stepFortiOS users should upgrade to 7.2.14, 7.4.13, 7.6.8 or 8.0.2 and above via the recommended upgrade path, and those exposed to CVE-2026-126259 who cannot upgrade yet can apply the virtual patch in FMWP 26.082
First stepUpdate Zoom Workplace for Windows to the latest version from https://zoom.us/download.
Incidents recorded here in the last 90 days, by affected industry.
Subscribe by severity, industry or vendor: instant, daily or weekly email, or RSS.
Set up alertsTaiwan disclosure report
Listed-company cybersecurity filings and Taiwan incidents on this site: monthly counts, industries, days from the event to the announcement, and common attack vectors.
Security Academy
Read advisories with confidence, prioritise patches, and know what to do when something goes wrong.
All articlesCVE is an ID, CVSS rates technical severity, EPSS estimates near-term exploitation odds, KEV lists confirmed exploitation. How to use all four together.
8 min read
How a ransomware attack unfolds, from initial access and lateral movement to backup deletion, data theft, encryption and extortion, and where to stop it.
8 min read
Backups are the last line of defence against ransomware only if they survive and restore. Covers 3-2-1, offline and immutable copies, RPO/RTO and drills.
8 min read
Using advisory IPs, domains and hashes: IOC types and limits, defanged notation, which logs to search, ruling out false positives, and what to do on a hit.
8 min read
What we offer
Every incident gets a 30-second summary, a timeline, affected versions and step-by-step fixes.
Browse advisoriesWhich countries the incidents on this site involve, source-attributed attack routes, and the scale of individual incidents.
See the threat mapList the vendors, products and versions you run. When a new advisory affects them, we email you.
Build my listInstant, daily or weekly email, plus RSS, Atom, JSON Feed and an MCP interface for AI agents.
Set up alertsProfessional services
Advisories tell you what happened. Services help you confirm exposure and fix it.
All servicesIdentify whether vulnerabilities reported on this site exist in your environment and prioritize remediation.
Contact usEmergency containment, digital forensics, and recovery when facing an intrusion or ransomware attack.
Contact usPeriodic review of your overall security architecture, configurations, and operational processes.
Contact usPhishing simulations and security awareness training tailored for employees.
Contact usExpert help
Advisories tell you what happened. Our engineers confirm whether you're affected, fix it, and keep watching.
How we work
Each sentence in summaries, timelines and fixes carries a footnote that links to the original.
Official notices, researchers and media are labelled separately; media-only incidents say "reportedly".
We name an attacker only when a source does. Otherwise it is marked unattributed.
Anyone can request a correction. The record is public, permanent and sent to subscribers.