China's Cyber War on Taiwan Intensifies; Critical Flaws in IoT and Enterprise Software Actively Exploited
Summary
A cybersecurity report for January 4, 2026, reveals a significant escalation in state-sponsored cyberattacks, with a Taiwanese government report detailing over 2.6 million daily attacks from China in 2025. Concurrently, critical vulnerabilities are under active exploitation, including a memory disclosure flaw in MongoDB ('Mongobleed') added to CISA's KEV list, and a zero-day in Oracle E-Business Suite leveraged by the Clop group. The IoT landscape is also under fire, with critical remote hijacking flaws discovered in WHILL electric wheelchairs and Petlibro smart feeders, highlighting severe physical and privacy risks. Major data breaches continue to have fallout, with 700Credit exposing 5.6 million consumer records via API abuse and Cognizant facing lawsuits over its TriZetto healthcare data breach.
Today New Articles
Taiwan Reports 2.6 Million Daily Cyberattacks from China in 2025
Taiwan's National Security Bureau (NSB) released a report on January 4, 2026, detailing a massive and sustained cyber offensive by Chinese state-backed actors throughout 2025. The island faced an average of 2.63 million cyberattacks daily, a 6% increase from 2...
Cognizant Sued in Class-Action Lawsuits After TriZetto Data Breach
IT services giant Cognizant Technology Solutions is facing multiple class-action lawsuits in the U.S. following a significant data breach at its healthcare subsidiary, TriZetto Provider Solutions (TPS). The lawsuits, filed in New Jersey and Missouri, allege th...
Petlibro Smart Feeder API Flaw Lets Anyone Control Devices, Access Cameras
A serious improper access control vulnerability, CVE-2025-3653, has been found in the backend API for Petlibro's smart pet feeders. The flaw allows a remote attacker to take full control of any Petlibro device simply by sending its serial number to the API, wi...
Critical Flaw in GNU Wget2 Allows Arbitrary File Overwrites
A critical vulnerability, CVE-2025-69194, has been discovered in GNU Wget2, the modern replacement for the ubiquitous Wget file download utility. The flaw is an improper path validation issue (path traversal) that can be triggered by a malicious remote server....
A Look Inside the CVE Process: The Story of a Rejected ID
On January 3, 2026, the National Vulnerability Database (NVD) officially updated the status of CVE-2025-34775 to 'REJECTED'. This status indicates that while the identifier was reserved by a CVE Numbering Authority (CNA), it was ultimately not used for a publi...
Article Updates
Clop Ransomware Hits Korean Air in Supply Chain Attack, Exploiting Oracle Zero-Day
Update:New information confirms that the Clop extortion group has not only claimed responsibility but also leaked the stolen employee data from Korean Air. Crucially, the Oracle E-Business Suite zero-day vulnerability, central to this attack, was actively exploited b...
Critical RCE in Xspeeder SXZOS Allows Unauthenticated Root Access
Update:New information reveals that Xspeeder, the vendor of SXZOS firmware, has been unresponsive for over seven months to disclosure attempts for CVE-2025-54322. The vulnerability now has a confirmed CVSS score of 10.0, making it a critical, unpatched RCE flaw. This...