Welcome to the first Asia-Pacific Watch, our Thursday round-up of the week’s most significant cyber security developments from Japan, China, South Korea, Taiwan and the wider region. We link the official sources, and where we’ve already covered a story in full, we point you to that article rather than repeat it.
Regulation and policy
Singapore: the Cybersecurity (Amendment) Act turns one on 31 October
The Act’s key provisions came into force on 31 October 2025 (opens in a new tab), according to the Cyber Security Agency of Singapore (CSA). They brought new obligations for owners of critical information infrastructure (CII) and of Systems of Temporary Cybersecurity Concern (STCCs). We set out what changed, including the two-hour reporting clock, in Singapore’s Amendment Act at one.
Why it matters: a year in, CII owners should be able to show that their incident runbooks meet the Act’s deadlines in practice, not just on paper.
China: CAC publishes the 15th Five-Year Plan informatisation plan
On 23 October the Cyberspace Administration of China (CAC) announced that the Central Cyberspace Affairs Commission had issued the national informatisation plan for the 15th Five-Year Plan period (opens in a new tab), with targets to 2030. The full text (opens in a new tab) sets ten task areas. Two of them strengthen security assurance and the laws and standards that support it. It also lists seven flagship programmes, one of them an action to make cross-border data flows easier.
Why it matters: foreign firms that move data out of China should watch for the implementing measures behind the cross-border data action. Those, not the plan itself, will change their compliance work.
India: next DPDP milestone on 13 November
India’s Digital Personal Data Protection Rules 2025 were notified on 13 November 2025 with a staggered start (MeitY (opens in a new tab)). The one-year stage, which includes the consent manager provisions, falls on 13 November 2026. The main duties, including security safeguards and breach notification, follow on 13 May 2027.
Why it matters: the breach clock is 18 months away, but contracts with processors and consent flows are being renegotiated now.
Threats
Japan: JPCERT/CC says AI penetration-testing platforms are being turned on Japanese organisations
JPCERT/CC’s alert on the string of unauthorised-access incidents at Japanese organisations (opens in a new tab) (JPCERT-AT-2026-0030) was first issued on 8 October, after a run of personal-data leaks around September. On 23 October it added “Case E”: attack attempts using AI-based penetration-testing platforms, naming Cairn, CyberStrikeAI and ARTEX. According to JPCERT/CC, the tools are mainly aimed at internet-facing web applications. They probe for known vulnerabilities, try to steal configuration and backup files, and in some cases target internet-exposed WSUS servers. The alert lists nine source IP addresses seen between late September and 20 October.
The same alert describes API abuse (Case B): attackers reverse-engineer public smartphone apps to find API endpoints and keys, then use internal APIs to change user privileges, create accounts and run blind NoSQL injection. JPCERT/CC stresses that not every incident used the same method. It also says business intelligence tools and staff-only systems have leaked data too.
Why it matters: automated, AI-driven tooling makes broad scanning cheap. Check your logs for the listed IPs, rate-limit and authorise every API endpoint, including undocumented ones, and take management services such as WSUS off the internet.
Two other Japanese incidents have their own pieces: So-net’s 2.58M-record breach and the APPI clock, and the claimed GMO Onamae Cloud data dump. For the state-linked angle, see Silent Train, the relay framework attributed to Volt Typhoon.
Vulnerabilities and advisories
PHP2Shell: Japan and South Korea issue guidance
Three national bodies have responded to the PHP flaws CVE-2026-109618 and CVE-2026-109619. Japan’s IPA published advice on 22 October (opens in a new tab) (updated 27 October), and JPCERT/CC updated its alert (opens in a new tab) on 29 October. In South Korea, KISA’s KrCERT/CC issued security guidance for companies (opens in a new tab) on 22 October. For the technical detail, see PHP2Shell + Fragnesia.
Why it matters: when several national CERTs warn about the same bug in the same week, it usually means shared hosting across the region is exposed. Patch PHP before the next scan sweep.
Taiwan: remote code execution in the WebITR attendance system, and five flaws in NT OneAPP
TWCERT/CC disclosed CVE-2026-113404 (opens in a new tab) on 20 October. It is an insecure deserialisation flaw (CVSS 4.0 score 8.7) in WebITR, the attendance and leave system from 凱發科技. Because the product uses a hard-coded encryption key, an authenticated remote attacker can craft serialised data and run code on the server. Versions up to 2_1_0_34 are affected, and the fix is in 2_1_0_36. TWCERT/CC credits Xin Yu Lin of DEVCORE. On 22 October TWCERT/CC also published five CVEs (CVE-2026-114219 to -114223) (opens in a new tab) in NT OneAPP, the enterprise cloud management system from 新人類資訊科技 (NewType Infotech Co., Ltd.), up to V1.5.22. Two of them score 9.1 and 9.3 (CVSS 4.0).
Why it matters: HR and attendance systems hold staff personal data and are often reachable from outside so that people can clock in remotely. That makes them the kind of target JPCERT/CC is warning about.
Also this week
JPCERT/CC issued an alert on 26 October (opens in a new tab) for the Brotli out-of-bounds write. We covered it in Node2Shell (CVE-2026-111497). In Australia, ASD’s ACSC published a critical alert on 23 October (opens in a new tab) covering security updates across FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. Fortinet expects to release more detail on 10 November; ACSC said it was not aware of exploitation in Australia at the time of the alert. Japan’s active cyber defence law has applied since 1 October. Operators’ asset notifications are due by March 2027, as set out in our explainer.
Asia-Pacific Watch is published every Thursday. Tips and corrections are welcome through our contact page.
Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)