This is your US-China CyberPulse: Defense Updates podcast.

Hey listeners, Ting here, your friendly neighborhood China-and-cyber nerd, and this week’s US‑China CyberPulse has been… loud.

Let’s start with the big chessboard move: the new US National Security Strategy that dropped from the Trump administration on December 4. According to the summary on Wikipedia and analysis in SC World, it stops calling China the “greatest challenge” and instead reframes Beijing mostly as an economic rival. That sounds softer, but here’s the twist: in cyber, it leans into power, not vibes – talking about protecting critical infrastructure, tightening supply chains, and denying aggression inside the First Island Chain. Translation: fewer speeches about “values,” more focus on “don’t touch our networks or our chips.”

National Cyber Director Sean Cairncross then doubled down at the Aspen Cyber Summit and the Meridian Summit, previewing a new six‑pillar national cybersecurity strategy, reported by HIPAA Times. He highlighted more aggressive deterrence, basically saying: we’re going to “shape adversary behavior” and make sure that when China‑linked operators poke US networks, it gets expensive and painful.

And those operators have been busy. Homeland Security Today reported that CISA, NSA, and the Canadian Centre for Cyber Security issued a joint advisory on Chinese state‑sponsored actors using BRICKSTORM malware to burrow into government and IT environments, including targets running VMware vSphere. Reuters, via coverage in the Times of India, quoted CISA leadership warning that these crews are embedding themselves for long‑term access and possible sabotage. That’s not smash‑and‑grab; that’s “move into your data center and start getting mail there.”

CISA’s response has been classic layered defense: more advisories, more entries in the Known Exploited Vulnerabilities catalog, and direct guidance to critical infrastructure operators. This week’s poster child? The React2Shell vulnerability, CVE‑2025‑55182. Security researchers at Breached Company and ITECS Online describe it as a CVSS 10.0 remote code execution flaw in React Server Components. Within hours of disclosure on December 3, threat intel teams at AWS spotted exploitation from China‑nexus groups like Earth Lamia, Jackpot Panda, and UNC5174, with CISA racing to add it to the KEV list by December 5. Cloudflare even had to slam in an emergency WAF rule that briefly knocked out a huge chunk of global HTTP traffic. When your defense move rattles 28 percent of the pipes, you know both offense and defense are running hot.

On the private‑sector front, US cloud and security vendors are quietly turning this China pressure into product design. DeepStrike’s 2025 breach analysis shows US breach costs leading the world, which is fueling faster adoption of AI‑driven detection, zero‑trust identity controls, and post‑quantum crypto pilots—exactly the “emerging tech” Cairncross flagged. Meanwhile, Homeland Security Today hig

This content was created in partnership and with the help of Artificial Intelligence AI.