Jekyll2026-05-20T10:06:56-04:00https://c-zhong.github.io/feed.xmlChen Zhong / Personal WebsiteAssociate Professor of CybersecurityChen Zhongczhong at ut dot eduFuture Blog Post2199-01-01T00:00:00-05:002199-01-01T00:00:00-05:00https://c-zhong.github.io/posts/2012/08/future-postThis post will show up by default. To disable scheduling of future posts, edit config.yml and set future: false.]]>Chen Zhongczhong at ut dot eduDaily Cybersecurity Updates - May 19, 20262026-05-19T00:00:00-04:002026-05-19T00:00:00-04:00https://c-zhong.github.io/daily-cybersecurity-updates/daily-cybersecurity-updatesTop 3-5 Updates
Dark Reading: Microsoft Exchange OWA zero-day CVE-2026-42897 remained under active exploitation on May 18 with no patch yet, which matters because mailbox compromise still creates a clean path to BEC, token theft, and downstream ransomware.
Dark Reading: Four patched OpenClaw flaws (CVE-2026-44112, CVE-2026-44115, CVE-2026-44118, CVE-2026-44113) show how AI agent platforms can turn normal tool use into stealthy persistence and credential theft.
Google Threat Intelligence Group: GTIG’s latest AI threat tracker remains the highest-signal AI-cyber item in scope, documenting AI-assisted zero-day discovery, malware obfuscation, and autonomous Android backdoor behavior relevant to defender planning.
CISA KEV Catalog: CVE-2026-42897 is now in KEV, so Exchange OWA exposure should be treated as a live-priority remediation and mitigation problem.
Unit 42 Threat Bulletin - May 2026: Unit 42’s current bulletin argues that identity abuse, trusted software paths, and AI-assisted discovery are converging into a lower-noise attack model that bypasses many exploit-centric detections.
Practitioner Discussions
No technically meaningful new r/cybersecurity or r/netsec discussion in the past 24 hours added enough verified signal to include.
Relevance to My Research
OpenClaw’s bug chain is a concrete example of human-AI trust failure: benign-seeming tool calls can mask privilege escalation and persistence.
The Exchange case reinforces that AI-assisted defense still needs strong prioritization around identity, mail, and session-token abuse, not just endpoint malware.
GTIG’s report is directly relevant to adversarial AI and human-AI collaboration because it shows both attacker automation gains and the need for defender-side AI monitoring, repair, and validation.
]]>Chen Zhongczhong at ut dot eduBlog Post number 42015-08-14T00:00:00-04:002015-08-14T00:00:00-04:00https://c-zhong.github.io/posts/2012/08/blog-post-4This is a sample blog post. Lorem ipsum I can’t remember the rest of lorem ipsum and don’t have an internet connection right now. Testing testing testing this blog post. Blog posts are cool.
Headings are cool
You can have many headings
Aren’t headings cool?
]]>Chen Zhongczhong at ut dot eduBlog Post number 32014-08-14T00:00:00-04:002014-08-14T00:00:00-04:00https://c-zhong.github.io/posts/2014/08/blog-post-3This is a sample blog post. Lorem ipsum I can’t remember the rest of lorem ipsum and don’t have an internet connection right now. Testing testing testing this blog post. Blog posts are cool.
Headings are cool
You can have many headings
Aren’t headings cool?
]]>Chen Zhongczhong at ut dot eduBlog Post number 22013-08-14T00:00:00-04:002013-08-14T00:00:00-04:00https://c-zhong.github.io/posts/2013/08/blog-post-2This is a sample blog post. Lorem ipsum I can’t remember the rest of lorem ipsum and don’t have an internet connection right now. Testing testing testing this blog post. Blog posts are cool.
Headings are cool
You can have many headings
Aren’t headings cool?
]]>Chen Zhongczhong at ut dot eduBlog Post number 12012-08-14T00:00:00-04:002012-08-14T00:00:00-04:00https://c-zhong.github.io/posts/2012/08/blog-post-1This is a sample blog post. Lorem ipsum I can’t remember the rest of lorem ipsum and don’t have an internet connection right now. Testing testing testing this blog post. Blog posts are cool.