[每日信息流] 2026-10-28 #1408
Description
每日安全资讯（2026-10-28）
- Private Feed for M09Ic
- kpcyrd contributed to kpcyrd/rebuilderd
- zeroclaw-labs released v0.8.7 at zeroclaw-labs/zeroclaw
- kpcyrd starred th0mk/nfsu2-web
- anthropics released v2.1.312 at anthropics/claude-code
- jar-analyzer released 6.3 at jar-analyzer/jar-analyzer
- mgeeky starred S12cybersecurity/CredGuardRuntimeShutdown
- OpenAEV-Platform released 3.261027.0 at OpenAEV-Platform/openaev
- modelcontextprotocol released v1.8.6 at modelcontextprotocol/registry
- 0xbug forked seeksec/litellm from BerriAI/litellm
- LoRexxar starred morluto/rea
- niudaii starred Gathin23/cleanyourtv
- Moriarty2016 forked Moriarty2016/deepseek-harness from deepseek-ai/deepseek-harness
- esrrhs contributed to esrrhs/pingtunnel-client
- agentscope-ai released v2.0.11 at agentscope-ai/agentscope
- esrrhs contributed to esrrhs/spp
- pydantic released v2.62.0 at pydantic/pydantic-ai
- esrrhs starred Panniantong/Agent-Reach
- timwhitez starred lkimuk/ReArk
- safedv starred KillaBoi/StealMyBitcoin-PoC
- esrrhs contributed to esrrhs/fakecc
- esrrhs contributed to esrrhs/pingtunnel
- Doonsec's feed
- 一个Docker把800+频道管理起来，全家电视公用一份订阅
- CVE-2026-112611/112610：CoreGraphics PDF 越界写入漏洞 POC
- 漏洞复现 | 泛微E-cology9 doc 存在SQL注入漏洞
- 2385万元！35个安全项目集中挂网
- AI时代，还要学传统网安吗？
- 《从“科研”里的安全，到“实践”里的安全——玄枢体系化建设的阶段性成果与思考》
- 那些独自熬过的夜，终将照亮你前行的路 | 华为杯人工智能创新大赛思考
- chrome安全研究-让SI帮你calc
- 烟台致用智能科技有限公司招聘无人机任务规划算法设计师
- 船舶和港口也有漏洞库了！海事网络安全，不能再靠“事后补洞”
- 宾夕法尼亚大学 | IRIS 基于大语言模型辅助的安全漏洞静态分析
- 数据泄露情报2026.10.27 - 美国顶级老牌富人俱乐部会员和财务50G数据
- 告别“交差式”合规：新规之下，企业如何做实数据安全风险评估？
- G.O.S.S.I.P 阅读推荐 2026-10-27 端到端加密的协作文档系统
- CVE-2026-49176 BOF
- IEEE TIFS论文点评|从信号加扰到生成式防护，UnVC破解语音克隆主动防御的鲁棒性困局
- 电子科技大学 | 计算机学院鲁力教授团队成果获MICRO 2026录用
- 《数字化安全工程导论》在京发布
- 微隔离建设实战思考：从虚拟机到容器
- 自媒体人徽剑被买凶杀害，作为网络安全号主的我，我也曾被威胁过
- 内核逐客令：wesp.sys 透露的 Windows Endpoint Security Platform
- AiPy 再获 Apple 官方致谢，macOS Tahoe 26.7.2 单次贡献十一个 CVE
- 赏金猎人捡漏：没人要的桶名，抢回来【存储桶接管】
- Anthropic安全高管警告：“漏洞海啸”数月内来袭，关基设施漏洞或来不及修复
- OSCP打靶视频系列之DC-9
- 手上拿到一张 300+ 项的 《数据安全检查清单》？ 先看清它查的是这四类
- 甲方运维注意： 公安检查不查制度了， 专查你这三件事
- 程序员注意：思源笔记连曝高危漏洞 发布模式默认就能拖库
- 对apt说不|情报就一定等于高价吗？
- 组织流程丨第十届“强网杯”全国网络安全挑战赛线上赛即将打响
- 新品！宏思电子在CCICS 2026披露两款全新芯片
- 再添标杆客户！中新赛克落地技研新阳集团数据治理项目
- 【平航PTU出品】微信小程序程序包获取与抓包工具免费用！
- 从 0 到"神机"：5 万条数据 + 模块化架构打造网络安全领域专属 LLM
- 首次！PHP2Shell漏洞已被成功利用，实现远程命令执行
- 自甘风险规则在智能体安全责任中的适用
- 【转载】给NTP加把“密码锁”：网络受限场景下的高安全时间同步方案
- 大蚂蚁即时通信系统 loginByToken 身份认证绕过漏洞
- 研究人员利用“上下文炸弹”误导 AI 智能体，将攻击成功率降低最高91%
- PHP重大漏洞引发全球关注：AI时代，网络安全防线如何升级？
- 从csrf到文件上传从命令执行到powershell反弹shell，htb靶机练习之secnotes
- 案例分享｜一支平板，点亮一整座展厅——某药企展厅多媒体软硬件集成方案正式落地
- GB_T 37002-2026 网络安全技术 电子邮件系统安全技术规范 将于2026年07月02日实施
- 鸿蒙 111 SP13 补丁推送：修了个没写进日志的相机坑
- 五大赛道，等你来战｜第十届“强网杯”全国网络安全挑战赛报名进行中
- 关于2026年“行稳杯”网络运行安全能力提升大赛初赛结果的通知
- 2026年福建省大学生数据安全大赛火热报名中！
- 赛查查喊你来投票！ | 投出你最喜欢的安全赛事
- 公司在2026“电信杯”省网络安全技能大赛斩获佳绩
- 西电简报丨喜报！他们在省级比赛中又获奖啦
- 2026 年“羊城杯”网络安全大赛初赛-WEB-MISC
- 2026 年“羊城杯”网络安全大赛初赛-简单pwn-RE
- 别什么都是“最后一届”：人类黑客远没到退休时间
- 【已复现】Linux Kernel POSIX CPU timer 释放后重用漏洞(CVE-2026-98260)安全风险通告
- 418页web安全学习笔记
- 云天 · 安全通告（2026年10月27日）
- 工具推荐|解放双手系列，一个管模型，一个研究安全边界，重点是开源的(Magpie+dsh-purge)
- 汇业活动 | 法律工作，重新设计：驯服AI的实践与探索
- 道格安全实验室举办“筑梦网安，聚力道格”招新宣讲
- 警惕！AI生成视频已能逃过人脸识别系统
- 商务部《保护中国商业秘密特别规定（征求意见稿）》公开征求意见
- 松下员工违规上传同事及家属信息至GenAI 服务 影响33.4万人
- 非技术专业团伙利用生成式AI入侵90家企业系统 窃取820万条个人信息
- 360漏洞云亮相看雪峰会｜人机共智·重构安全
- 声援GEEKCON -- 没有网络安全就没有国家安全
- 征集啦！第六届网络空间内生安全学术大会，创新成果展展品征集
- 发布 | 中央网信委印发《国家信息化“十五五”规划》（附全文）
- 攻防结合：美以-伊冲突中的美太空军电子战能力
- 宇树 Go2机器狗 未授权命令注入漏洞
- 从全量研判到自主狩猎，探索AI时代SOC的最佳实践
- 【勒索预警】用友 BIP 高级版疑似0day已被rox勒索病毒利用（附IOC）
- 学习100篇xa0Web3xa0安全文章 多签安全 ① | Bybit 黑客事件深度技术分析
- 声 xa0明
- 国内某国防人工智能企业疑遭数据泄露：2.85GB压缩文件被公开，发帖者声称涉及源代码及政府专项项目
- PHP2Shell专项分析场景上线 安恒信息助力协同防护
- 买了AI-BOM,锅还是你背:影子AI的治理,该从"堵疏结合"说起
- 从代码生成到变更治理：AI 编码时代，代码审查如何成为新的工程基础设施
- 苦Excel久矣，不用激活，任意打开编辑xlsx格式的免费开源软件分享
- 2026 年下半年 · 信息安全工程师真题回忆版与考情分析
- Anthropic_IPO财务数字深度解读
- AI Agent 安全边界
- 多 Agent Harness 如何把漏洞告警变成可复核证据
- 2分钟看懂摆渡攻击 — 物理隔离的电脑也能被窃密！【保密词典】
- Lazarus 用后量子加密隐藏恶意载荷，安全检测也在被 “绕路”
- 其实，当月底Token不够用的时候，微信支付也不是不能.....
- 自媒体曝光电诈被悬赏百万追杀
- PingCAP泄露10.6T数据
- 哪里能输入，哪里就可能出事;每一个参数，都是一扇没关严的窗
- 【已复现】漏洞通告 | Node.js Brotli 解码器远程代码执行漏洞(CVE-2026-111497)
- 从备案合规到全链路防护，企业如何筑牢AI安全底座？
- 考研报名结束，准研究生们来看备考建议
- 内网巡检实用工具合集，上手实操要点
- redis未授权
- 360图龙锋攻破“逻辑漏洞”难题！研究成果再斩国际顶会
- 银狐情报｜CTG段位单日5→8段，仿冒远程工具安装包首见
- 每日漏洞推送 zip-rs ≤ 9.0.4 双头部脱同步（Zip Cloaking）→ 扫描器放行、解压器落盘任意文件
- 授权培训机构2026年11月CISP培训开班计划公告
- 【教程】情报分析 -分析师的心智与偏差
- 【会议】议程新鲜出炉-第六届全国开源情报技术大会-11.14-11.15贵阳
- 谐音、拆字、隐喻难识别？嘉韦思意识形态识别模型转向“语义理解”
- 网络安全为人民，网络安全靠人民
- 一款打开浏览器就能让智能体做渗透的插件
- 倒计时 3 天！｜数商共创・安全护航・链接全球 高规格数商企业峰会火热报名中
- 开发一年多的小程序，集证件照制作、文件签名、名片制作为一体的，只有一千多人点开过，是否还需要继续存在？
- AI编程：代码能自我修复的那天还有多远
- 先防护、后打补丁｜Radware 开放一周免费 PHP2Shell 防护，补丁窗口期不再裸奔
- 资产侦察与漏洞管理平台 -- 4zreark（10月26日更新）
- 研究员凭PHP2Shell漏洞赢得比特币挑战赛，获两千美元奖金并发布PoC
- 26年10月26日全球网空威胁态势
- 日本企业网络攻击损失赔偿压力上升，AI加剧网络安全与经济运行风险
- NodeGoat 靶场实战：Node.js 原型链污染与 NoSQL 注入
- 高危预警｜海莲花组织发起多行业定向攻击！科研、航运、交通均被盯上
- 招聘贤才｜思而听期待你的加入！
- 一张照片找到你
- 【每日漏洞预警】10月27日 · TOTOLINK 10.0 未授权栈溢出，Avocent 9.8 提权
- GEEKCON 2026 上海站闭幕丨荣誉榜单·年度GEEK榜公布
- 详解网络杀伤链
- Tailscale SSH 漏洞可导致提权至 root
- 只需干预两个神经元，就能给 Qwen 打上“思想钢印”？——爆火的 Evil Qwen 背后
- 抱歉，团队准备解散了...
- 很严重了，大家别轻易离职。。
- 安恒信息牵头制定，《通信行业信息安全托管运营服务实施指南》获批发布
- SecWiki News
- Cybernews News
- Cornell 7 reckoning: Research finds AI deepfakes overwhelmingly target girls in schools
- “We’re still on the trail” – congressman hunts for alleged Nordic alien footage
- Flock is hated because of Russian bots, says CEO
- CleanYourTV project explodes on GitHub as thousands hack their TVs back
- “I'll probably take it.” Is Microsoft’s voluntary buyout not a bad thing after all?
- We spoke to 100 researchers. This is the biggest threat from AI
- Here’s how Starlink disruptions harmed Ukraine’s defenses
- “High risk, no reward:” hackers’ attempt to extort 38 organizations in South Korea nets just $226
- Proton staff grilled on AI as company puts jobs at risk
- Why the Swedish government blocked ChatGPT but chose to keep Microsoft Copilot
- Severe GoAhead flaws expose security risks for devices from Palo Alto, HP, Lockheed Martin and Boeing
- Ukraine warns hackers are exploiting China-made Dahua cameras
- Denmark quietly drops open-source Microsoft Office alternative after users complain
- Google’s sneaky privacy policy update pushes users to consider alternatives
- Boston Dynamics workers revolt over $1.3 million ICE robot dog deal
- PHP exploitation in full force: 32.5 million services remain vulnerable
- Claude randomly accessed voter data in US state Georgia
- AI companies could gain wider access to Europeans’ personal data under EU plan
- Test account using “Password1” caused data leak affecting thousands of people
- US blocks Huawei-linked surveillance chips over national security fears
- Apple says it will replace iPhone Duo units showing screen problems
- Microsoft offers buyouts to around 60,000 employees to contain costs
- Richmond schools forced to use paper copies after week-long ransomware attack
- Hackers breach school tech giant serving 50 million students nationwide
- Tenable Blog
- Kitploit — Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!
- TorBot
- netbox v4.7.4
- xmir-patcher
- samsung_tizen_tv_root
- iCloudKitExtractor
- pentest
- probe-desktop
- secprbench
- p2pwn
- C2IntelFeeds
- Awesome-Hacking — Updated!
- PrologWinDbg
- unthemidator
- shannon v3.5.0
- godot-security-pocs
- CVEngine
- Evil_Twin_Attack
- Mobile-Intrusion-Detection-System
- zeek v9.0.1
- advisory-database
- MeshCentral
- oak
- codex-security npm-v0.7.0
- malware-iocs
- guardrebind
- dshield
- Horizon3
- Securelist
- Sucuri Blog
- PortSwigger Research
- Reverse Engineering
- Rooting a 2024 Samsung Tizen 9 TV from its own browser
- iCloudKit Extractor: seven months from an ADP dead end to a public toolkit
- I reverse engineered the Attack Shark X6 protocol to get a Linux app for it, and I'd like the community to test it and tell me what to build next
- Encrypted firmware and software RE: a 31-method survey with validation criteria (AI-assisted)
- Malwarebytes
- GuidePoint Security
- rtl-sdr.com
- D325f-SDR: Turning the Cellular Modem in an Old LG Phone into an SDR
- Elektro-L3 Arrives at 14.5°W and Begins Testing L-Band LRIT and HRIT
- rxx_lora: A Lightweight rtl_fm-Style LoRa Receiver for RTL-SDR and SDRplay, No GNU Radio Required
- DAB SDR GUI: An Open-Source DAB+ Receiver for the RTL-SDR and SDRplay
- DecSAT: A DVB-S/S2/S2X Satellite Receiver with Blind Scanning for the HackRF One
- Offensive Security Blog: Latest Trends in Hacking | Praetorian
- 绿盟科技技术博客
- 黑海洋 - AI工具与技术教程｜免费资源与开发实战
- HackerNews
- 奇客Solidot–传递最新科技情报
- 黑鸟
- 网安志异
- 虎符智库
- 代码卫士
- 奶牛安全
- 安全客
- 青衣十三楼飞花堂
- 我的安全视界观
- 安全内参
- 360漏洞云
- 安全圈
- 数世咨询
- 中国信息安全
- 奇安信 CERT
- 看雪学苑
- 安全研究GoSSIP
- 安全牛
- 青藤云安全
- 微步在线
- 极客公园
- 默安科技
- 深信服千里目安全技术中心
- 字节跳动技术团队
- 360数字安全
- Over Security
- Japan's GMO urges customers to shut down PCs amid ransomware threat
- Is that link phishing? Meet the StalkPhish URL scanner (closed beta)
- Ce lien est-il du phishing ? Découvrez le scanner d’URL StalkPhish (bêta fermée)
- OpenAI's GPT-6.1 Terra is safer overall, but shows more destructive-action flags in tests
- UNM Health ransomware attack disrupts patient care, surgeries
- FortiBleed 2.0: 975 New Domains & 40,573 Exposed Secrets - Claim Your Ethical Disclosure
- Nefilim, Hive ransomware operator given five-year-plus sentence after guilty plea
- Hackers hijack Convertr analytics script to steal payment card data
- US indicts Malaysian national after Madagascar scam operation uncovered
- Microsoft releases Windows OOB updates to distrust eMudhra certificates
- SLA e Downtime: calcolare i costi dell’inattività IT
- Phishing, superare i test non significa essere pronti agli attacchi reali
- Warp discloses breach exposing AI agent logs, user telemetry data
- Two RCEs, one Wednesday: responsible disclosure has run out of time
- NIS2, dal 2027 registrazione semplificata sul Portale ACN: cosa cambia per le aziende
- Attacco alla Camera, perché minimizzare è un errore: i rischi per la sicurezza nazionale
- University of New Mexico hospital diverts ambulances after cyberattack
- Hackers repeatedly breached suppliers holding UK police data, watchdog finds
- SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises
- PHP2Shell minaccia anche le app Android e iOS: il rischio nascosto nei server
- The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest
- Tailscale warns of SSH flaws allowing root privilege escalation
- Malicious apps prey on Russians’ anxiety about fuel prices, drone strikes
- Ransomware in the Age of AI: How Defenders Can Break the Attack Chain
- Australia’s spies are sharing intelligence with hacking targets — and want them to share back
- CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch
- Moscow faces internet disruptions as foreign leaders gather for summits
- Tailscale Investigates Serious SSH Privilege Escalation Issues After Tailworm Report
- ACN, eventi cyber a +57%: il ransomware pesa sulla continuità dei servizi
- ElectroNG is now open source!
- An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure
- Apple backports CoreGraphics zero-day patches to older iPhones
- Governare la sicurezza integrata: DPO, CISO e Safety Manager alla prova dell’AI in cantiere
- Columbia University Settles $16.1M Data Breach Lawsuit After 2025 Cyberattack
- From federal SOCs to Talos: Ryan Fetterman on practical security research
- Piattaforma Aruba SuperSite: creazione di siti ed e-commerce con intelligenza artificiale generativa
- Energy giant ENGIE discloses data breach affecting customers
- Self-Hosted SOC Platforms Can Keep Pace With Modern Threats
- My First Real Malware Sample Turned Out To Be LokiBot
- Phishing PagoPA: nuove campagne a tema multe diffuse tramite PEC compromesse
- CISA confirms PHP2Shell vulnerabilities now exploited in attacks
- AfD - 345,439 breached accounts
- 慢雾科技
- TrustedSec
- 奇安信威胁情报中心
- 安全419
- Have I Been Pwned latest breaches
- Troy Hunt's Blog
- SANS Internet Storm Center, InfoCON: green
- Full Disclosure
- APPLE-SA-10-26-2026-5 macOS Tahoe 26.7.2
- APPLE-SA-10-26-2026-10 Safari 27.2
- APPLE-SA-10-26-2026-9 visionOS 27.2
- APPLE-SA-10-26-2026-8 watchOS 27.2
- APPLE-SA-10-26-2026-7 tvOS 27.2
- APPLE-SA-10-26-2026-6 macOS Sequoia 15.8.2
- APPLE-SA-10-26-2026-4 macOS Golden Gate 27.2
- APPLE-SA-10-26-2026-3 iOS 18.7.11 and iPadOS 18.7.11
- APPLE-SA-10-26-2026-2 iOS 26.7.2 and iPadOS 26.7.2
- APPLE-SA-10-26-2026-1 iOS 27.2 and iPadOS 27.2
- CVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2)
- SEC Consult SA-20261023-0 :: Multiple Cross-Site Scripting Vulnerabilities in VertiGIS WebOrderSystem
- SCHUTZWERK-SA-2025-002: Privilege escalation in Lobster_pro through request replaying
- 360威胁情报中心
- The Hacker News
- CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets
- GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption
- Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
- Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
- Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key
- AI-Generated Fake Login Pages Are Making Account Takeovers Easier
- Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption
- Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
- OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections
- Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses
- CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
- KitPloit - PenTest Tools!
- TorBot
- netbox v4.7.4
- xmir-patcher
- samsung_tizen_tv_root
- iCloudKitExtractor
- pentest
- probe-desktop
- secprbench
- p2pwn
- C2IntelFeeds
- Awesome-Hacking — Updated!
- PrologWinDbg
- unthemidator
- shannon v3.5.0
- godot-security-pocs
- CVEngine
- Evil_Twin_Attack
- Mobile-Intrusion-Detection-System
- zeek v9.0.1
- advisory-database
- MeshCentral
- oak
- codex-security npm-v0.7.0
- malware-iocs
- guardrebind
- dshield
- www.theregister.com - Articles
- AI 'hacker' finds 4 severe bugs in popular industrial control software in under 4 hours
- Day 2 of canceled classes at University of New Mexico after Health Sciences Center cyberattack
- CISA confirms PHP2Shell under attack as researchers clock successful exploits
- Microsoft releases out-of-band Windows fixes with certificate updates
- Attack on email hosting provider for German far right party AfD exposed 345k accounts
- Japanese virtual desktop cloud hacked so hard it asks to be banned
- Blackhat Library: Hacking techniques and research
- Deeplinks
- Instapaper: Unread
- TorrentFreak
- Security Affairs
- Italy ’s Parliament Under Cyber Pressure: Why the Attack on the Chamber Matters
- Australia’s Cyber Spy Chief: Expect More Disruption as AI Accelerates Hacking
- U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog
- Attackers Take Control of Dahua Cameras and Video Recorders Via Easy4IP
- Cohere Finds Qwen AI Model Contacting a Server in China
- Schneier on Security
- Computer Forensics
- 网安寻路人
- Project Zero
Activity