Malware Research Lead

Mei-Lin Chen, page 2

Mei-Lin reverse-engineers commodity and bespoke malware, and writes the technical breakdowns behind our loader and stealer coverage.

61 articlesUpdated 28 Sep 2026Page 2 of 3

Reverse engineeringInfostealersLoaders and droppersLinkedIn

Articles by Mei-Lin Chen

ThreatsCloud & SaaSCritical
Microsoft Azure Active Directory B2C Authentication Bypass Flaw Enables Remote Privilege Escalation
Microsoft fixes critical CVSS 9.1 flaw CVE-2026-33843 in Azure AD B2C and Microsoft Entra ID allowing unauthenticated network attackers to elevate privileges.
Mei-Lin Chen20 Sep 202614 min read
ThreatsCloud & SaaSCritical
Check Point Security Management Buffer Overflow Flaw Enables Unauthenticated Remote Root Code Execution
Check Point and CERT-In issue emergency alerts for critical CVSS 9.8 flaw CVE-2026-91843 in Security Management and Log Servers allowing remote unauthenticated root compromise.
Mei-Lin Chen20 Sep 202614 min read
ThreatsIndustrial & OTCritical
Critical Flaws in Digital Watchdog VMAX Recorders Enable Unauthenticated Remote Root Takeover
CISA releases advisory ICSA-26-258-01 warning of critical vulnerabilities in Digital Watchdog VMAX DVR and NVR recorders allowing unauthenticated remote root code execution.
Mei-Lin Chen20 Sep 202612 min read
ThreatsIndustrial & OTCritical
Threat Actors Weaponize AI Tooling and S7comm to Target Siemens S7 Industrial Controllers
CISA, NSA, and the FBI issue joint advisory AA26-231A warning of active campaigns targeting Siemens S7 series PLCs using automated S7comm protocol exploitation.
Mei-Lin Chen19 Sep 202613 min read
ThreatsIndustrial & OTCritical
Johnson Controls C-CURE 9000 Vulnerabilities Allow Attackers to Hijack Physical Facility Access Gateways
Johnson Controls and CISA release emergency advisory ICSA-26-204-01 for C-CURE 9000 and victor application servers resolving critical code execution flaw CVE-2026-21655.
Mei-Lin Chen19 Sep 202613 min read
ThreatsIndustrial & OTCritical
Mitsubishi Electric GX Works3 Authentication Bypass Exposes Industrial PLCs to Memory Manipulation Attacks
Mitsubishi Electric and CISA issue critical advisory ICSA-26-260-02 for GX Works3 and Motion Control Settings software enabling in-memory block password bypass and PLC logic tampering.
Mei-Lin Chen19 Sep 202612 min read
ThreatsIndustrial & OTHigh
ABB Ability Edgenius Industrial Edge Controllers Exposed to Container Root Escalation Flaw
ABB and CISA issue security advisory for CVE-2026-31431 in Ability Edgenius edge controllers enabling container breakout and local root takeover.
Mei-Lin Chen19 Sep 20269 min read
ThreatsCloud & SaaSHigh
Linux Kernel ebtables SNAT Out-of-Bounds Write Flaw Exploited in Active Attacks
CISA adds Linux kernel ebtables SNAT memory corruption flaw CVE-2026-53266 (CVSS 8.8) to KEV catalog following active hypervisor privilege escalation.
Mei-Lin Chen18 Sep 202610 min read
InsightsCloud & SaaS
Google Cloud Security Advisory: GCP Guest OS Login Privilege Escalation Flaw Dissected
Technical analysis of Google Cloud Platform guest-oslogin flaw CVE-2020-8903 enabling non-administrative users to escalate privileges to root.
Mei-Lin Chen18 Sep 202610 min read
InsightsCloud & SaaS
Azure Security Advisory: Cloud Foundry BOSH CPI Stemcell Code Injection Flaw Dissected
Technical analysis of Azure Cloud Provider Interface vulnerability CVE-2017-4964 enabling arbitrary code injection into virtual machines during deployment.
Mei-Lin Chen18 Sep 202610 min read
ThreatsCloud & SaaSCritical
Adobe ColdFusion Critical Path Traversal Flaw CVE-2026-48282 Exploited in Active Attacks
CISA incorporates Adobe ColdFusion path traversal vulnerability CVE-2026-48282 (CVSS 9.8) into KEV catalog following active exploitation against enterprise application servers.
Mei-Lin Chen17 Sep 202614 min read
ThreatsCloud & SaaSCritical
N-able N-central Critical Authentication Bypass CVE-2026-18577 Exploited in MSP Supply Chain Attacks
CISA adds N-able N-central vulnerability CVE-2026-18577 (CVSS 9.8) to KEV catalog following active in-the-wild exploitation against MSP management infrastructure.
Mei-Lin Chen17 Sep 202614 min read
ThreatsCloud & SaaSHigh
Linux Kernel Watch Queue Privilege Escalation Flaw CVE-2022-0995 Weaponized in Cloud Attacks
CISA adds Linux kernel watch queue vulnerability CVE-2022-0995 to its KEV catalog following widespread weaponization in cloud container breakout attacks.
Mei-Lin Chen17 Sep 202610 min read
ThreatsCloud & SaaSCritical
Anthropic Threat Report: State-Sponsored Actors Exploit Claude for Automated Malware Evasion
Anthropic threat intelligence reveals nation-state groups, including Midnight Blizzard, attempted to weaponize Claude to automate malware obfuscation and EDR evasion.
Mei-Lin Chen17 Sep 202611 min read
InsightsCloud & SaaS
Cloud Workload Security: BOSH Azure & AWS Microservice Stemcell Privilege Escalation Analysis
Technical breakdown of cloud workload stemcell isolation defects, container escape vectors, and hypervisor boundary hardening across AWS and Microsoft Azure.
Mei-Lin Chen16 Sep 202612 min read
InsightsCloud & SaaS
Cloud IAM Role Pivoting & Cross-Account Data Exfiltration: Multi-Cloud DFIR Forensics
Digital forensics analysis dissects how threat actors leverage leaked cloud credentials and cross-account IAM role assumptions to exfiltrate enterprise storage.
Mei-Lin Chen16 Sep 202612 min read
InsightsCloud & SaaS
Google Cloud GKE Workload Identity Privilege Escalation: Cloud Threat Forensics & Hardening
Technical analysis of Google Cloud Platform (GCP) Kubernetes Workload Identity metadata impersonation vectors, token theft forensics, and enterprise IAM hardening.
Mei-Lin Chen16 Sep 202612 min read
GuidesIndustrial & OT
Implementing IEC 62443-3-2 in Critical Infrastructure: Operational Guide to Security Zones, Conduits, and Purdue Model Boundaries
Engineering blueprint for implementing IEC 62443-3-2 zones, conduits, and Purdue Model boundaries across industrial automation and SCADA systems.
Mei-Lin Chen15 Sep 202610 min read
ThreatsCloud & SaaSCritical
Apple macOS Screen Sharing Authentication Bypass Flaw Weaponized in Active Attacks
CISA confirms active exploitation of CVE-2026-65400, an unauthenticated network authentication bypass in Apple macOS Screen Sharing enabling remote desktop seizure.
Mei-Lin Chen15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Microsoft Windows IKE Protocol Double-Free RCE Flaw Exploited in Active Network Attacks
CISA confirms active in-the-wild exploitation of CVE-2026-33824, an unauthenticated double-free memory corruption flaw in Windows IKE enabling remote root code execution over UDP 500.
Mei-Lin Chen15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Cisco Secure Email Gateway Critical SQL Injection Flaw Weaponized in Active Attacks
CISA mandates urgent federal remediation after confirming active exploitation of CVE-2026-76461, an unauthenticated SQL injection flaw granting root shell access on Cisco SEG appliances.
Mei-Lin Chen15 Sep 20268 min read
ThreatsIndustrial & OTCritical
Rockwell Automation Logix Controllers Exposed to Critical Remote Firmware Tampering Flaws
CISA alerted industrial manufacturing operators to severe vulnerabilities in Rockwell Automation Logix controllers and 1756 communication modules allowing PLC tampering.
Mei-Lin Chen14 Sep 20267 min read
NewsBanking & Fintech
CERT-In Warns of Massive Android Smishing Campaign Masquerading as Traffic E-Challans
CERT-In issued advisory CIAD-2026-0038 warning against an aggressive smishing blitz delivering trojanized APKs disguised as official Parivahan traffic e-challan notices.
Mei-Lin Chen14 Sep 20267 min read
NewsCloud & SaaS
Google September 2026 Android Bulletin Patches Critical System Zero-Click RCE Flaws
Google’s September 2026 Android security update resolves 34 vulnerabilities, led by critical zero-click remote code execution defects in the Android System framework.
Mei-Lin Chen14 Sep 20267 min read