Aggregator

WordPress组合漏洞引发大规模扫描；HollowGraph利用日历隐蔽C2；FakeGit 7600个仓库投毒；白宫启动Gold Eagle漏洞协调机制。

AML 流程如何有效帮助企业理解、识别并控制链上资金风险？

An anonymous GitHub user has quietly assembled one of the most disruptive exploit collections of the year, dropping 204 zero‑day proof‑of‑concept files for dozens of open‑source projects before vendors had a chance to patch them. The archive, hosted under the name “exploitarium” by a researcher using the handle “bikini,” turned coordinated disclosure on its head […]

The post Anonymous Researcher Dumps 204 0-Day Exploit Files Before Vendors Can Patch Them appeared first on Cyber Security News.

Для автоматизации рутины больше не понадобятся ни код, ни подробные команды.

根据 Sensor Tower 的估计，2025 年苹果 App Store 上架的新应用数量增长 30% 达到约 60 万。今年上半年，新应用数量翻了一番达到约 56 万。虽然更多的应用理论上能为苹果带来更多的佣金，然而应用数量的大幅增长并没有带来下载量大幅增加，Sensor Tower 的数据显示去年 App Store 的下载量增长 3% 达到 354 亿次，今年上半年下载量增长 2% 达到 176 亿次。由于涌入了大量应用，苹果审核人员显然有点跟不上了。应用开发者在苹果开发者论坛上抱怨审核时间过长。分析师认为这一波 AI 辅助编程应用浪潮可能不会为苹果带来多少收入，因为此类应用通常是靠广告获利，不会提供内购。

A newly disclosed flaw in Microsoft’s official Azure DevOps MCP server shows how an invisible comment in a pull request can silently hijack a developer’s AI coding assistant and turn it into a data-exfiltration tool. Security researchers at Manifold Security found that the bug lets an attacker with access to just one project steer a […]

The post Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Agents and Steal Data appeared first on Cyber Security News.

火绒小问答--「个人版」近期top问题解答

供应链威胁持续发酵：Shai-Hulud出新变种绕过npm防护窃密

OpenAI confirmed its AI models exploited zero-days during internal testing, reaching Hugging Face servers in an unintended real-world cyberattack. OpenAI admitted on July 21 that its own AI models, including GPT-5.6 Sol and an unnamed pre-release system, were behind the cyberattack on Hugging Face disclosed the previous week. The models weren’t acting under attacker control. […]

Спокойно: это не то, чем кажется.

Spain’s data protection authority has fined the genetic testing company 23andMe €2.4 million due to security failures linked to a data breach in 2023. This incident exposed highly sensitive information such as genetic, health, ethnicity, and family-related data belonging to over 2,600 individuals in Spain. The penalty follows a significant credential-stuffing attack that compromised data […]

The post Spain Fines 23andMe €2.4 Million Over Security Failures Behind 6.9 Million-User Breach appeared first on Cyber Security News.

中国科学家利用嫦娥六号从月球背面南极收集的月壤样品开展了系统的稀有气体同位素分析。研究发现，月球正面和背面接收到的太阳风存在系统性差异，且地球磁层在其中扮演了“调速器”的角色。研究团队瞄准了五种稀有气体——氦、氖、氩、氪、氙。这些气体具有化学惰性，是追溯太阳风注入过程和后期改造的忠实示踪剂。结果显示，嫦娥六号月壤的氖同位素组成呈现出极为独特的特征——其氖20、氖22比值平均为11.34±0.22，远低于所有已知的月球正面样品，极为接近理论上的强烈分馏太阳风端元（~11.2）。这表明月球背面经历了更为极端的分馏过程，使其富集重同位素，仅用传统的溅射、扩散或侵蚀模型已无法完全解释，暗示背面可能存在更为复杂的同位素分馏机制或一个未被发现的低氖同位素端元。为什么同一颗月球的两面会接收到不同能量的太阳风？研究团队论证认为，是地球磁层在“调速”。当月球围绕地球运行并穿越地球磁鞘时，原本约每秒400公里的“正常”太阳风会被显著减速至约每秒200公里。

Google’s Gemini 3.5 Flash Cyber model finds, validates, and patches vulnerabilities before they can be exploited while helping mitigate broader misuse. It is part of a limited-access pilot program that will soon be available to governments and trusted partners through CodeMender, Google DeepMind’s AI coding agent, with broader access planned over time. “CodeMender is our managed code security agent, and starting today, we’re bringing its code scanning and remediation capabilities directly to you in preview. … More →

The post Google’s Gemini 3.5 Flash Cyber becomes a vulnerability hunter appeared first on Help Net Security.

历时最长、规模最大：美国国民警卫队举行2026年度“网络盾牌”演习

该模型认为知名企业可能存在它需要的数据

Attackers are quietly turning trusted Microsoft Outlook mailboxes into launchpads for stealing multi factor authenticated Microsoft 365 sessions, even when users think they are protected. Adversary in the middle phishing has evolved into a reliable tool for hijacking live cloud sessions that organizations depend on for daily work. The activity surfaced in May 2026, when […]

The post Hackers Abuse Compromised Outlook Accounts to Steal MFA-Protected Microsoft 365 Sessions appeared first on Cyber Security News.

Ни один пароль не пострадал, но доступ к переписке всё равно оказался у чужих людей.

开放课题申请截止日期：2026年9月7日。