China

Security incidents tagged China. Newest first.

0 China incidents in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

Show 5 older incidents

CriticalPatched
F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen
F5 disclosed that a sophisticated nation-state actor had long-term access to its BIG-IP development and engineering systems and stole parts of the BIG-IP source code, information on undisclosed vulnerabilities and some customer configuration data. CISA issued Emergency Directive 26-01 ordering agencies to inventory and patch F5 gear. Researchers linked it to China-nexus UNC5221 and BRICKSTORM.
F5 BIG-IP (vendor breach)Closed Oct 15, 2025updated Oct 15, 2025

Nov 13CriticalSalt Typhoon: Chinese state hackers inside US telecom networksNo fix needed
US telecommunications carriers No fix needed
PRC-affiliated actors (publicly called Salt Typhoon) compromised networks at multiple US telecommunications companies. The FBI and CISA said they stole customer call records, got into the private communications of a limited number of people mainly involved in government or political activity, and copied information subject to US law enforcement wiretap requests. Allied agencies then published hardening guidance for communications infrastructure.
Open incident →

Oct 4CriticalConfluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)Patched
Atlassian Confluence Data Center and Server Patched
A broken access control bug in publicly reachable Confluence Data Center and Server let outside attackers create Confluence administrator accounts. It was exploited as a zero-day, and Microsoft attributed it to the China-nexus Storm-0062. Atlassian Cloud was not affected.
Open incident →CVE-2023-22515

CriticalPatched
Barracuda Email Security Gateway zero-day (CVE-2023-2868)
A command injection in how Barracuda ESG appliances scan .tar attachments was exploited since October 2022 by China-nexus UNC4841 to backdoor appliances. Barracuda later told customers to replace compromised appliances outright, even after patching.
Barracuda Email Security Gateway (appliance)Closed Jun 15, 2023updated Jun 15, 2023
CriticalPatched
Storm-0558: stolen Microsoft signing key used to read government email
China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.
Microsoft Exchange Online / Outlook.com (Azure AD and MSA token signing)Closed Sep 6, 2023updated Sep 6, 2023