Threat actor
China-nexus actor
Also tracked as chinanexusactor
Tracked by CyberSIXT since 29 Oct · RSS
1Articles, all time
1Articles, last 30 days
3CVEs exploited, attributed · all time
0Research reports, all time
Activity
Developinglatest 2 hours ago1 article1 outlet
One article so far, 29 Oct. A pattern appears once more outlets cover China-nexus actor.
- Thu 29 Oct. The Hacker News. Attackers exploit PHP flaws on exposed Palo Alto interfaces. Cites a CVE in CISA KEV.
- Known exploited CVE
- Article naming China-nexus actor
- Articles a day, all coverage
Drawn: the only article.
Show as tableHide table
| Date | Type | Source | Title |
|---|---|---|---|
| 29 Oct | Article | The Hacker News | Attackers exploit PHP flaws on exposed Palo Alto interfaces |
Connections
3 exploited CVEs. What the record links this actor to; hover or use the arrow keys.
In CISA KEV
Show as a listHide the list
- Exploited CVEs
- CVE-2026-46300, CVE-2026-109619, CVE-2026-109618
CVEs exploited3
CVEs an article attributes to China-nexus actor, most covered first
- 9.2Critical99.9% EPSS · 52 articles
- CVE-2026-109619Exploited
RCE via stale global state
9.2Critical99.9% EPSS · 51 articles - CVE-2026-46300Exploited
net: skbuff: preserve shared-frag marker during coalescing
7.8High10% EPSS · 10 articles
MITRE ATT&CK techniques
No MITRE ATT&CK® techniques are recorded for China-nexus actor.
Articles1
Drawn: the only article.
- Attackers exploit PHP flaws on exposed Palo Alto interfacesThe Hacker NewsExploitedCVE-2026-109618