Cybersecurity Monthly Report (May 2026)
Cybersecurity Monthly Report (May 2026)
1. Cybersecurity: Long Story Short
1.1 US AI Policy Demonstrates a Balanced Approach to Innovation and Security
On June 2, 2026, US President Trump signed an executive order, "Promoting Advanced Artificial Intelligence Innovation and Security," demonstrating the US AI policy's governance model of balancing innovation and security.
1.2 Core Content of the Executive Orders Disclosure:
This executive order primarily revolves around "public-private partnerships, enhanced defenses, combating crime, and rejecting excessive regulation," and proposes the following specific actions within a specified timeframe:
(1) Upgrade federal and critical infrastructure system defenses to cope with advanced AI (within 30 days): Prioritize upgrading the cyber defense capabilities of national security systems and the Department of War's information systems; and provide cybersecurity tools and services to remote hospitals, community banks, and local utility companies.
(2) Establish a National Vulnerability Clearing House (within 30 days): The U.S. Treasury Department, the Department of War, and the Department of Homeland Security, in consultation with voluntary AI industry and critical infrastructure providers, will jointly establish a "National Vulnerability Clearing House" (tentative translation) (Source Text: AI Cybersecurity Clearinghouse). This center will be responsible for coordinating software vulnerability scanning operations, disclosing and verifying such vulnerabilities, and handling subsequent vulnerability patching and patch releases.
(3) Inventory Available Budget for AI Vulnerability Detection Research (within 30 days): The Office of Management and Budget should coordinate with the national cyber security agencies to inventory available federal funds to support applicants developing advanced AI vulnerability detection technologies.
(4) Establish a Benchmarking and Evaluation Mechanism for "Covered Frontier Models" (within 60 days):
A. Develop a benchmarking process to evaluate the advanced networking capabilities of AI models and to define AI models as "covered frontier models."
B. Design a Voluntary Framework: Collaborate with AI developers to design a voluntary participation framework. Developers will work with the federal government to determine whether models under development meet the definition of "monitored frontier models." These models will be made available to the federal government 30 days before release, and trusted partners will be selected to enable early access to these models for developing innovative security technologies and strengthening the protection capabilities of critical infrastructure.
C. No government licensing, preclearance, or permitting systems will be established for any new AI models (including frontier models) being developed or released.
(5) Expand Recruitment of Cybersecurity Experts (within 60 days): The U.S. Office of Personnel Management should expand recruitment channels and personnel for cybersecurity experts within the U.S. Tech Force Information Cybersecurity.
(6) Vigorously Combat AI-Driven Cybercrime: Prioritize combating unauthorized system access, data theft, system sabotage, and cybercrime using AI, as well as the illegal access to information systems or data using AI agents.
1.3 Impact of Cutting-Edge AI Models on Taiwan's Cybersecurity and Subsequent Responses
From the latest executive orders issued by the United States, it can be seen that in the face of new AI threats, the United States has adopted an open attitude and established close relationships with the private sector to jointly discover vulnerabilities, jointly establish vulnerability information centers, and jointly define cutting-edge AI models. While accelerating development, it also continues to strengthen the protection of critical national systems. In the face of this wave of AI threats, the Cybersecurity Agency of the Ministry of Digital Development continues to take proactive measures. In addition to explaining last month that it should return to the basics of cybersecurity, strengthen cybersecurity strategy, management, and technology, and propose a "rapid recovery" cybersecurity strategy, it will plan vulnerability patching standard operating procedures and attempt to use AI to detect critical systems. At the same time, it will assemble cybersecurity elites and invite cybersecurity experts to support national-level cybersecurity missions, improving Taiwan's cybersecurity response strategy in response to cutting-edge AI from all aspects, with the aim of strengthening Taiwan's resilience.
2. Recent Policy Highlights
2.1 To assist enterprises in strengthening their vulnerability handling capabilities for ICT products, on May 15, 2026, measurement results of the Product Security Incident Response Mechanism (PSIRT) for 35 companies were provided, and ongoing guidance is being offered to manufacturers to establish relevant mechanisms.
2.2 The Cyber Offensive and Defense Exercise (CODE) planned for 2027 will transition to a competition format primarily based on blue teams. In 2026, an independent exercise platform will be built, and support will be provided to domestic cybersecurity companies. The exercise will focus on aligning with the critical defense capability framework of MITRE D3FEND (the US cybersecurity knowledge base), designing incident-based scenarios and environments, using AI to generate automated attack scripts, and simulating real-world hacking attacks from external to internal levels.
3. Recent Cybersecurity Incident Sharing
Exposed Backend Management Interface and Lack of Access Control
During a recent network attack and defense exercise, it was discovered that some government agencies' websites could bypass login verification and access their backend management interface by adjusting URL paths. This allowed attackers to modify the content of publicly accessible pages. This demonstrates that even if a website's backend is not publicly displayed or announced, as long as the relevant pages exist and are accessible externally, they can be discovered and further exploited by scanning tools or attackers. Furthermore, attackers often first use path scanning to gather usable information, identifying potential management pages, testing functions, or hidden entry points within the system, which they then use for subsequent vulnerability probing, login testing, or function abuse.
Lessons Learned
Even if a website's backend or function entry points are not publicly displayed or announced, if the relevant pages exist and are accessible externally, they can still be discovered by path scanning tools and used as a starting point for subsequent probing or exploitation. Especially when login verification, authorization checks, or URL access restrictions are not properly implemented, attackers can easily progress from "finding an entry point" to "successfully accessing and manipulating" the site, leading to website content tampering or the abuse of non-public functions. It is recommended that organizations continuously strengthen their protection measures in the following aspects:
(1) Regularly clean up unnecessary pages and functions in the production environment, including test pages, old backend versions, backup files, or unused functions, to avoid leaving detectable entry points after system redesigns or maintenance.
(2) Implement verification and access controls for backends and sensitive functions. Protection should not rely solely on "non-public URLs." Login verification, permission checks, and necessary source restrictions should be strictly enforced to prevent direct exploitation even after an entry point has been discovered.
(3) Conduct self-inspections through website patrols, path scanning, or vulnerability scanning to confirm whether there are still pages, directories, or function entry points that should not be exposed, and to identify and correct risks as early as possible.
(4) Review the website program and settings to see if they leak path information, including front-end source code, JavaScript, error messages, robots.txt, sitemap, or other configuration files, to avoid indirectly exposing management paths or function locations.
4. Cybersecurity Trends
4.1 National Government Cybersecurity Threat Trends
Ex ante joint defense and monitoring
This month, a total of 87,511 cybersecurity joint defense intelligence items were collected from government agencies (a decrease of 1,735 items compared to the previous month). Among identifiable threat categories, information collection ranked first (48%), primarily involving the acquisition of information through techniques such as scanning, probing, and social engineering. This was followed by intrusion attempts (29%), mainly involving attempts to access unauthorized hosts, and intrusion attacks (10%), most of which involved unauthorized system access or the acquisition of system or user privileges. The distribution of intelligence volume over the past year is shown in Figure 1.
Figure 1: Statistics of cybersecurity monitoring intelligence in joint defense
Hackers are abusing free image sharing space as a platform for distributing malicious files.
Further analysis of joint defense intelligence revealed that hackers recently launched social engineering attacks against specific government agencies under the pretext of "abnormal political donation declarations requiring supplementary documents." The hackers emphasized in the email subject line that "failure to comply will result in referral to the Control Yuan for punishment," creating a false sense of legal force and urgency to increase recipients' willingness to click on malicious download links. In this attack, the hackers first compromised a regular website and implanted a backdoor script for redirection, then placed a malicious compressed file on Dropbox cloud storage, and finally embedded the complete redirect URL in the social engineering email. This reduced the probability of cybersecurity devices detecting and blocking malicious connections and file downloads, thereby increasing the success rate of the attack. This intelligence has been provided to relevant agencies with joint defense monitoring and protection recommendations.
In-process reporting and responding
This month, a total of 106 reported cybersecurity incidents (including 40 cases of exercises) were recorded, representing 0.74 times of the volume from the same period last year. The majority of reported incidents were categorized as illegal intrusions, accounting for 55.66% of the total. Observations this month revealed that the compromised devices in multiple incidents were facilities such as surveillance cameras and access card readers, most of which lacked firewalls or access control mechanisms, and were not regularly subjected to security checks or firmware updates. Statistics for cybersecurity incident reports over the past year. Statistics for cybersecurity incident reports over the past year are illustrated in Figure 2.
Figure 2: Statistics of cybersecurity incident reports
4.2 Important Vulnerability Alerts: Please refer to Appendix for more details
5. International Cybersecurity News
CISA and Partners Publish New Advice on AI Agent Safety
Source: Cyber News
CISA, alongside cybersecurity agencies in the UK, Canada, Australia and New Zealand published a joint guidance on agentic AI on April 1. The guidance highlighted key risks associated with the technology and warned that its growing use across critical infrastructure and defense sectors requires stronger security controls. Agentic AI, which can plan, reason and execute multi-step tasks with limited human intervention, carries risks that could lead to productivity losses, service disruption, privacy breaches or cybersecurity incidents, according to CISA. The agency identified five categories of risks: privilege, design and configuration, behavior, structural and accountability. Agencies warned that existing security frameworks do not yet fully address these risks and stressed the need for more research and collaboration.
Global Cyber Agencies Issue new SBOMs for AI Guidance to Tackle AI Supply Chain Risks
Source: Info Security
Multiple government cyber agencies, as a part of the G7 Cybersecurity Working Group, have published a new guidance for defining minimum elements for Software Bill of Materials (SBOM) for AI to strengthen the AI-supply chain. The approach outlined in the report includes seven clusters of potential elements, i.e., Metadata, System-Level Properties (SLP), Models, Dataset Properties (DP), Key Performance Indicators (KPI), Infrastructure and Security Properties (SP). However, the document further adds that SBOMs for AI alone are not sufficient to ensure cybersecurity and must be integrated with tools such as vulnerability management systems, security advisories, etc. The framework is intended to remain flexible and evolve over time. It builds on the shared vision of SBOMs for AI published by the G7 Cybersecurity Working Group in June 2025.
6. Cybersecurity Announcements
6.1 Adjusting Recognition Standards and Restrictions for ISO-Related Cybersecurity Professional Certifications
Regarding the provisions in the “Regulations Governing the Classification of Cyber Security Responsibility Levels” concerning the holding of cybersecurity professional certifications by dedicated cyber security personnel, in order to balance practical needs and simplify regulations, the Administration for Cyber Security (ACS) has adjusted the recognition requirements for ISO-related certifications. As long as they meet market mechanisms and international recognition standards, all qualified certifications obtained through a "Full Course" "Transition Course" or "Conversion Course" will be recognized. Therefore, the restrictions on the validity of ISO-related certifications in the ACS's “List of Cybersecurity Professional Certifications” have been simultaneously revised.
6.2 Striving for the Highest Cybersecurity Honors! Reminder Regarding the Performance Evaluation of Cybersecurity Operations in Government Agencies
To reward government agencies and personnel with excellent cybersecurity performance, the Administration for Cyber Security (ACS) notified all agencies of the evaluation process on April 29, 2026, and posted the notice on the ACS homepage/Operations/Performance Evaluation of Cybersecurity Operations in Government Agencies. Further details are as follows:
(1) Award Content:
A. Agency Group: Outstanding Group Award and a bonus of NT$120,000; Excellent Group Award and a bonus of NT$85,000; Good Group Award.
B. Individual Group: Outstanding Personnel Award and a bonus of NT$20,000.
(2) The evaluation item "Other Cybersecurity Management Business Promotion Activities or Special Innovative Actions" accounts for 15 points of the total score and has a crucial impact on the agency's performance. Agencies must submit a written report for review by July 31. Late submissions within 7 days of the deadline will result in point deductions, while late submissions exceeding 7 days will result in a score of 0.
All organizations and cybersecurity professionals are welcome to participate actively, demonstrate their cybersecurity capabilities, and compete for the highest honor!
Appendix: Major Vulnerability Alerts
| Alert Type | Category | Description |
|---|---|---|
| Vulnerability Alert |
Sandbox Analysis Equipment Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS Severity: (CVE-2026-26083: CVSS 9.8) |
• Researchers have discovered a lack of authorization vulnerability (CVE-2026-26083) in the web interfaces of Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. • An unauthenticated remote attacker could execute unauthorized code or commands via HTTP requests. |
|
Workload Protection System Cisco Secure Workload Severity: (CVE-2026-20223: CVSS 10.0) |
• Researchers have discovered a vulnerability in Cisco Secure Workload called CVE-2026-20223, which involves unauthenticated API access. • An unauthenticated remote attacker could use a specially crafted API request to access resources with Site Admin privileges and read sensitive information or modify settings. |
|
|
Network security device Palo Alto Networks PAN-OS Severity: (CVE-2026-0300: CVSS 9.8) |
• Researchers have discovered a buffer overflow vulnerability (CVE-2026-0300) in the User-ID authentication portal service of Palo Alto Networks PAN-OS. • An unauthenticated remote attacker could execute arbitrary code with root privileges on PA and VM series firewalls using a specially crafted packet. • Please check the affected versions and update to the patched version as soon as possible. |
|
|
Databases and REST Data Services for Oracle Database Server and Oracle REST Data Services Severity: (CVE-2026-46833: CVSS 9.0) (CVE-2026-46840: CVSS 10.0) |
• Oracle's Database Server and REST Data Services products contain several critical security vulnerabilities. CVE-2026-46833 affects the Net Service component, and CVE-2026-46840 affects the Backend-as-a-Service component. • Unauthenticated remote attackers can access affected components via TLS or HTTPS networks, respectively. |
|
| Known vulnerabilities exploited by hackers |
Mobile Device Management System Ivanti Endpoint Manager Mobile (EPMM) Severity： (CVE-2026-6973：CVSS 7.2) |
• CISA has added CVE-2026-6973 to its KEV list, and Ivanti notes that this vulnerability has been exploited in a very small number of attacks. • This vulnerability is related to improper input validation. A remote attacker with administrative privileges can use Ivanti EPMM to achieve remote code execution. |
|
Communication Equipment Cisco Catalyst SD-WAN Controller and Manager Severity: (CVE-2026-20182: CVSS 10.0) |
• CISA has added CVE-2026-20182 to its KEV list, and Cisco has also stated that this vulnerability has been actively exploited. • This vulnerability bypasses authentication; an unauthenticated remote attacker can gain administrative privileges, further accessing NETCONF and modifying SD-WAN architecture settings. |
Warning Explanation:
- "Vulnerability Warning": This is a verified vulnerability that has not yet been wideexploited by attackers. It is recommended to patch the vulnerability as soon as possible.
- "Known Vulnerabilities Exploited by Hackers": Successful attacks using this vulnerabare known. It is recommended to immediately evaluate and patch it.