This is your China Hack Report: Daily US Tech Defense podcast. Hey listeners, this is Ting, and if you’re like me, you’ve had your coffee and your firewall logs open since 6 a.m. because the past 24 hours in US-China cyber have been—well, let’s just say “spicy.” I’ll walk you through the key plays, the people, the patches, and what you need to do right now to keep your systems from becoming the next trending hashtag in Beijing’s cyber playbook. First up, let’s talk malware. The big news from Huntress is that Chinese-linked actors have weaponized the open-source Nezha monitoring tool—yep, that’s Nezha, not Nezuko—to deliver Gh0st RAT via PHPMyAdmin flaws. According to Huntress, this isn’t just a one-off: they’re using a slick log poisoning technique to plant web shells, and they’ve hit over 100 servers globally. If you’re running PHPMyAdmin, assume you’re on the menu, and patch yesterday. This is a classic case of turn-key open-source tools getting a malicious facelift, and it’s as subtle as a dumpling in a soup bowl. Sector-wise, law firms got the spotlight this week. Williams & Connolly, the DC heavyweight that’s defended presidents and politicians, confirmed a breach via a zero-day attack, with a “small number” of attorney emails compromised, per the New York Times. The FBI’s Washington field office is leading the investigation, and CrowdStrike’s initial assessment points to a nation-state actor—no prizes for guessing which one. The good news: Williams & Connolly says client databases remain untouched, and they’ve brought in Norton Rose Fulbright and CrowdStrike for cleanup. But here’s the kicker: Mandiant’s September report confirms this isn’t a one-off. Since March, Chinese groups have been targeting US legal services and software firms, with a clear focus on scooping up intel on national security and trade. If you’re in legal, tech, or anything with IP worth stealing, consider this your wake-up call. On the infrastructure front, the picture is grim. CISA—that’s the Cybersecurity and Infrastructure Security Agency—is running on fumes thanks to the government shutdown. Only a third of their staff are on duty, and the Cybersecurity Information Sharing Act just expired, so threat intel sharing between feds and private sector is down by as much as 80%. This is exactly the kind of chaos that makes hackers rub their hands together. CISA is still pushing out alerts, though, like the one about CVE-2025-4008 in Smartbedded Meteobridge—a command injection flaw that’s actively being exploited. If you use Meteobridge, patch now. Let’s talk patches and warnings. Oracle just dropped an emergency update for CVE-2025-61882 in E-Business Suite—that’s a CVSS 9.8 critical, so don’t sit on this one. CrowdStrike is tracking the actor behind this as Graceful Spider, better known as Cl0p, but don’t get distracted—Chinese groups are still the main event. Meanwhile, Microsoft confirmed exploitation of CVE-2025-10035 in Fortra GoAnywhere, leading to Medusa ransomware deployment. If you haven’t updated to GoAnywhere 7.8.4, now’s the time. So, what do you do? First, assume you’re targeted. Second, patch everything—PHPMyAdmin, Meteobridge, Oracle EBS, GoAnywhere. Third, lock down your email and web interfaces. Fourth, review your incident response plan, because if CISA’s hobbled, you’re your own first responder. And finally, share threat data with your peers—even if the feds are offline, the private sector’s threat intel feeds are still your best friend. In short, this is no time for business as usual. The Chinese cyber playbook is evolving fast, and they’re hitting when the US is least prepared. But hey, that’s why you’re listening to me, right? Thanks for tuning in to Ting’s daily cyber dispatch. If you want more of this straight to your inbox, subscribe, follow, and stay sharp. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta This content was created in partnership and with the help of Artificial Intelligence AI