Previous Columns

SFC Circular 26EC35 reads as a phishing fix, but its two-tier compliance clock will do more to reshape Hong Kong's 13 licensed platforms than any breach this year.

Progress Software's unattributed ShareFile shutdown order reproduces the exact disclosure shape that preceded the 2023 MOVEit mass-breach, and the exposed attack surface was already public three months before the vendor said a word.

North Korea laundered its two largest crypto thefts through the same operator-less protocol, in full public view, both times. Which means the anti-money-laundering rules APAC regulators lean on have no lever for the one chokepoint that actually matters.

When malware is built to fool the AI model doing the detecting, the industry's pitch that AI strengthens defense collides with evidence that it just moved the vulnerability one layer up.

Oracle's E-Business Suite flaw is being exploited faster than companies can confirm whether their own systems are exposed. That gap, not the severity score, is the real risk.

The FBI's warning that Russian intelligence is harvesting Signal backup keys confirms what the artifacts have shown for two years: the protocol was never the attack surface.

The same AI coding tools that FSI security teams are quietly adopting have become the cleanest supply-chain vector this year, and the tradecraft targeting them does not look like what your controls were built to catch.

TinyRCT's self-destruct mechanism and the HKMA's new resilience framework are addressing the same class of adversary without using each other's language to say so.

CISA's hygiene frame for FortiBleed explains how 86,644 FortiGate devices were compromised; the 45-GPU cracking cluster behind the campaign explains why credential resets alone will not close the exposure.

Sygnia's Operation Highland documents nine backdoored Linux authentication modules undetected for ten years, making MAS TRM's one-hour notification obligation structurally unanswerable for this class of intrusion.

China-linked Dragon Weave targeted Taiwan this week using techniques older than the AI threat the Shangri-La Dialogue put at the top of its threat register.

Lazarus Group's memory-resident implants against APAC banks expose the gap between what MAS TRM and HKMA endpoint guidance require on paper and what most regional EDR deployments actually log.

Two of this week's most instructive breaches trace to credentials in version control, not zero-days; one contractor works for the agency that mandates US federal remediation timelines.

Two CVSS 10 Cisco SD-WAN bugs exploited in five months, plus a JavaScript supply chain burning two OpenAI developer devices, argues that the exploitation window has structurally closed.

Google's confirmation of an AI-built zero-day in criminal deployment is a measurement, not a milestone: the exploitation window is now shorter than any current TRM timeline assumes.

Anthropic's Mythos appearing on institutional threat registries forces a question that procurement frameworks and cyber insurance policies were not built to answer.

Treasury's 'nuclear weapon' framing for AI in finance is institutional acknowledgment that the attack surface has changed faster than the governance structures meant to contain it.

Frontier AI is compressing the exploit window while supply chain attacks compromise the very tools defenders use to close it.