#chinese-apt

Analysis · Jun 16, 2026 · Colten Anderson

Sophos has seven CISA KEV entries. Five hit the same management interface.

The User Portal and Webadmin surface runs through SQL injection, buffer overflow, authentication bypass, and code injection across five years. Chinese state actors exploited several of them as zero-days, and the exploitation often started before Sophos knew about the bugs.