Aggregator

验证很难时，"先信任再验证"就行不通了

古法漏洞分析fastjson 1.2.83RCE

A vulnerability was found in jsforce up to 3.10.16. It has been classified as critical. This issue affects the function _execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. This vulnerability is referenced as CVE-2026-16489. The attack can only be performed from a local environment. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in itsourcecode Hospital Management System 1.0. It has been declared as critical. Impacted is an unknown function of the file /prescription.php. The manipulation of the argument editid results in sql injection. This vulnerability is identified as CVE-2026-16490. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability was found in umijs umi up to 4.6.63. It has been rated as critical. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. This vulnerability is tracked as CVE-2026-16492. The attack is only possible within the local network. Moreover, an exploit is present. Upgrading the affected component is advised.

A vulnerability was found in Red Hat libarchive. It has been rated as critical. This impacts the function archive_write_zip_header of the file archive_write_set_format_zip.c of the component Zip Writer. This manipulation causes integer overflow. The identification of this vulnerability is CVE-2026-16517. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability classified as very critical has been found in Veeam Software Appliance up to 13.0.1. Impacted is an unknown function of the component Updater. This manipulation causes Local Privilege Escalation. This vulnerability is registered as CVE-2026-56844. The attack needs to be launched locally. No exploit is available.

A vulnerability classified as problematic was found in Chimpstudio Foodbakery Plugin up to 4.9 on WordPress. The affected element is the function delete_locations_backup_file_callback. Such manipulation leads to path traversal. This vulnerability is documented as CVE-2026-15802. The attack can be executed remotely. There is not any exploit available.

A Russian-speaking threat actor known as “Trim” has reportedly transformed jailbroken frontier AI models into an automated penetration testing platform called AI Pentest Checker. This activity highlights how criminals can misuse legitimate AI services and common security tools to accelerate reconnaissance, validate vulnerabilities, and create reports. According to Cato reports, Trim first appeared on a […]

The post Russian Hacker Jailbreaks Claude to Turn into an AI-Powered Penetration Testing Platform appeared first on Cyber Security News.

Международная операция оборвала схему, которой пользовались тысячи киберпреступников.

根据斯坦福经济学家 Jacob Light 的研究，2025-2026 学年美国计算机科学专业入学人数近二十年来首次下降，但这种下滑是否是一种长期趋势还有待观察。数据显示，过去十年美国计算机和信息科学专业的学士学位授予数量增长了一倍多，从 2014 年的约 5.6 万增至 2024 年的约 12.2 万。2025 年秋季入学数据显示，四年制大学计算机与信息科学及支持服务专业的本科生入学人数同比下降 8.1%，从 2024 年的约 659,700人 降至 2025 年的 606,100 人，但仍然高于 2022 年的 574,333人，表明人数下降是在经历了多年快速增长之后出现的。Light 认为人数下滑的原因可能有多种，基于大模型的辅助编程工具的流行，IT 就业市场疲软等等。

Name: BDSec CTF 2026 (an BDSec CTF event.)
Date: July 20, 2026, 3 p.m. — 21 July 2026, 15:00 UTC  [add to calendar]
Format: Jeopardy
On-line
Offical URL: https://2026.bdsec-ctf.com/
Rating weight: 15.62
Event organizers: Knight Squad

根据国家信息安全漏洞库（CNNVD）统计，本周（2026年7月13日至2026年7月19日）安全漏洞情况如下

Пока другие роботы учатся годами, XR-1 освоил бытовые задачи за несколько часов.

安妮·弗兰克去世前在荷兰躲避纳粹期间写的日记于 1947 年在荷兰出版，她的日记在欧洲大部分国家都已经进入了公有领域，但在荷兰她的部分日记的版权保护期要到 2037 年才结束。为了尊重这一版权保护的地区差异，托管安妮日记的出版商屏蔽了荷兰 IP 访问网站。然而拥有安妮日记荷兰版权的安妮·弗兰克基金会提起了诉讼，声称 VPN 可以绕过地理位置限制，因此受版权保护的安妮日记被传播给了荷兰居民。欧盟法院驳回了这一论点，裁决 VPN 是合法技术工具，读者通过 VPN 绕过地理位置限制，出版商不应因此承担侵权责任。

American fast food restaurant chain Chick-fil-A is notifying customers of a data breach after their accounts were hacked in a wave of recent credential stuffing attacks. [...]

German and US law enforcement have taken down the core infrastructure of Kratos, described by German investigators as one of the world's most widely used criminal phishing kits, and Indonesian authorities arrested the man they say developed and ran it. In a joint announcement on Monday, the Frankfurt public prosecutor's cybercrime unit (ZIT) and Germany's Federal Criminal Police Office (BKA)

由于 AI 生成安全报告大量涌入，GNOME 项目宣布改变安全报告处理方式。首先是 GNOME 项目将安全漏洞披露时间从行业标准的 90 天缩短至 30 天，原因是大部分 GNOME 安全问题会在一到三周内修复，或者干脆不修。其二禁止 AI 生成的安全报告，由于今天的大部分安全报告包含了 AI 生成的内容，这些安全报告将会直接关闭。