Malware Research Lead

Mei-Lin Chen

Mei-Lin reverse-engineers commodity and bespoke malware, and writes the technical breakdowns behind our loader and stealer coverage.

96 articlesUpdated 23 Oct 2026

Reverse engineeringInfostealersLoaders and droppersLinkedIn

Articles by Mei-Lin Chen

GuidesBanking & Fintech
Banking & NBFC API Security Advisory: Hardening FinTech Endpoints Against BOLA and Data Leaks
A comprehensive technical guide to hardening banking and NBFC APIs against BOLA, broken authentication, token replay, and co-lending data leakage.
Mei-Lin Chen23 Oct 202615 min read
ThreatsCloud & SaaSCritical
LiteLLM Pipeline Hijacked in Software Supply Chain Attack Deploying InfoStealer and RAT
Attackers hijacked LiteLLM release workflows using leaked GitHub CLI OAuth tokens, publishing backdoored packages to PyPI and Docker Hub executing LLMjacking.
Mei-Lin Chen23 Oct 202614 min read
InsightsCloud & SaaS
Singapore CSA Releases National Cybersecurity Framework for Enterprise Frontier AI and Agentic Deployments
CSA Singapore issues technical guidelines for securing frontier and autonomous agentic AI models, mandating rigorous defenses against indirect prompt injection and tool-calling escapes.
Mei-Lin Chen21 Oct 202614 min read
ThreatsCloud & SaaSCritical
Google Chrome Emergency Update Resolves Critical ANGLE Graphics Buffer Overflow Flaw CVE-2026-110152
Google issues an emergency Chrome update for desktop and Android fixing a critical buffer overflow (CVE-2026-110152) in the ANGLE graphics engine allowing remote code execution.
Mei-Lin Chen17 Oct 20268 min read
ThreatsIndustrial & OTCritical
Eclipse Milo OPC UA Flaws Let Low-Privileged Actors Bypass Method Authorization
CISA Advisory ICSA-26-288-01 warns of critical vulnerabilities in Eclipse Milo OPC UA stacks that allow low-privileged actors to bypass method authorization and crash OT gateways.
Mei-Lin Chen17 Oct 20269 min read
ThreatsCloud & SaaSHigh
Fortinet FortiOS and FortiProxy Flaw Leaks Administrator Bearer Tokens
Fortinet releases security updates for FortiOS and FortiProxy (CVE-2026-14851) resolving an information disclosure flaw that exposed administrative bearer tokens.
Mei-Lin Chen14 Oct 20268 min read
ThreatsCloud & SaaSCritical
Abandoned Cart Pro SQL Injection Exposes WooCommerce Customer Records
Tyche Softwares resolves an unauthenticated blind SQL injection flaw in Abandoned Cart Pro (CVE-2026-97668) allowing extraction of customer and order records.
Mei-Lin Chen14 Oct 20268 min read
ThreatsCloud & SaaSHigh
Strapi Headless CMS Cleartext Sensitive Token Storage Flaw CVE-2023-22894 Remediated
Strapi resolves a high-severity vulnerability (CVE-2023-22894) where password reset tokens and API secrets were stored unhashed in database audit records.
Mei-Lin Chen14 Oct 20268 min read
ThreatsCloud & SaaSCritical
Ivanti Connect Secure SAML Bypass Opens Gateways to Pre-Auth Code Execution
Ivanti discloses critical vulnerability CVE-2026-104935 in Connect Secure and Policy Secure gateways allowing pre-auth SAML remote code execution.
Mei-Lin Chen14 Oct 20269 min read
ThreatsIndustrial & OTCritical
Schneider Electric EcoStruxure Geo SCADA Expert Server Memory Corruption Enables Remote Code Execution
CISA and Schneider Electric issue critical advisory for CVE-2026-50891 in EcoStruxure Geo SCADA Expert servers permitting unauthenticated remote root code execution.
Mei-Lin Chen8 Oct 20268 min read
ThreatsIndustrial & OTHigh
Rockwell Automation ControlLogix 5580 EtherNet/IP CIP Flaw Triggers Critical Process Controller Hangs
CISA industrial advisory ICSA-26-288-03 details high-severity flaw CVE-2026-49821 in Rockwell Automation ControlLogix 5580 controllers causing unrecoverable CPU hangs.
Mei-Lin Chen8 Oct 20268 min read
ThreatsIndustrial & OTCritical
Phoenix Contact FL SWITCH Managed Industrial Ethernet Devices Vulnerable to Remote Root Execution
CISA issues industrial advisory ICSA-26-285-01 for Phoenix Contact FL SWITCH managed industrial network switches resolving critical firmware RCE CVE-2026-48192.
Mei-Lin Chen7 Oct 20268 min read
ThreatsIndustrial & OTCritical
Emerson DeltaV Distributed Control System Workstation Vulnerability Permits Unauthenticated Command Execution
CISA and Emerson release urgent industrial advisory ICSA-26-283-02 for CVE-2026-46801, a critical authentication bypass in DeltaV DCS operator workstations.
Mei-Lin Chen7 Oct 20268 min read
ThreatsIndustrial & OTCritical
Yokogawa CENTUM VP Human-Machine Interface Stack Overflow Allows Industrial Network Takeover
CISA industrial advisory ICSA-26-278-02 discloses a critical stack-based buffer overflow (CVE-2026-43890) in Yokogawa CENTUM VP Human Interface Stations.
Mei-Lin Chen7 Oct 20268 min read
ThreatsIndustrial & OTCritical
ABB Ability System 800xA Flaw Enables Remote Code Execution Across Industrial Substation Controllers
CISA and ABB have issued an emergency industrial advisory for CVE-2026-42918, a critical remote code execution vulnerability in ABB Ability System 800xA controllers.
Mei-Lin Chen7 Oct 20268 min read
ThreatsIndustrial & OTCritical
Honeywell Experion PKS Distributed Control System Memory Corruption Flaw Disclosed by CISA Advisory ICSA-26-281-01
CISA Advisory ICSA-26-281-01 details a critical heap corruption vulnerability in Honeywell Experion PKS distributed control systems.
Mei-Lin Chen7 Oct 20268 min read
ThreatsIndustrial & OTCritical
Rockwell Automation FactoryTalk VantagePoint Critical Authentication Bypass Flaw Disclosed by CISA Advisory ICSA-26-280-01
CISA Advisory ICSA-26-280-01 details a critical authentication bypass in Rockwell Automation FactoryTalk VantagePoint manufacturing analytics servers.
Mei-Lin Chen7 Oct 20268 min read
ThreatsIndustrial & OTHigh
Siemens SIMATIC S7-1500 and ET 200SP CPUs Exposed to Denial-of-Service Flaw
CISA Advisory ICSA-26-279-01 details a critical denial of service flaw in Siemens SIMATIC S7-1500 and ET 200SP programmable logic controllers.
Mei-Lin Chen6 Oct 20268 min read
ThreatsIndustrial & OTCritical
Schneider Electric Modicon M580 PAC Memory Corruption Flaw Disclosed by CISA Advisory ICSA-26-278-02
CISA Advisory ICSA-26-278-02 details a critical memory corruption vulnerability in Schneider Electric Modicon M580 and M340 industrial controllers.
Mei-Lin Chen6 Oct 20268 min read
InsightsCloud & SaaS
The Edge Appliance Vulnerability Treadmill: Why Network Gateways Remain Stuck in the C/C++ Memory Crisis
Continuous zero-days in Citrix, Fortinet, and enterprise gateways demonstrate that reactive patching is failing. Only hardware MTE and Rust re-architectures offer an exit.
Mei-Lin Chen6 Oct 20268 min read
ThreatsIndustrial & OTCritical
Johnson Controls EasyIO Neo Controllers Authentication Bypass Flaw CVE-2026-40112 Disclosed by CISA
CISA Advisory ICSA-26-274-05 details a critical authentication bypass flaw in Johnson Controls EasyIO Neo EC and CW series building automation controllers.
Mei-Lin Chen6 Oct 20268 min read
ThreatsCloud & SaaSHigh
Android October 2026 Security Bulletin Addresses Zero-Interaction System Privilege Escalation Flaws (CVE-2026-28640)
Google published the Android October 2026 bulletin fixing high-severity System elevation of privilege flaws (CVE-2026-28640) requiring zero user interaction.
Mei-Lin Chen5 Oct 20268 min read
Cyber AttackEnergy & Utilities
China-Nexus Warlock Ransomware Crew Breaches Water Utility and Telecom Operator Through Unpatched SharePoint
Longlegs (Storm-2603) used on-prem SharePoint access, a BYOVD EDR killer and SYSVOL replication to push Warlock ransomware to 33+ hosts. IOCs inside.
Mei-Lin Chen4 Oct 20269 min read
ThreatsCloud & SaaSCritical
MetaMCP Flaws, Still Unpatched, Allow Command Execution and Cross-Tenant Session Hijacking
MetaMCP CVE-2026-79538 (9.8) and CVE-2026-79537 (9.1) enable container code execution and cross-tenant MCP tool hijacking. No patch exists; mitigations inside.
Mei-Lin Chen4 Oct 20266 min read