Repository navigation
[每日信息流] 2026-10-30 #1410
Description
每日安全资讯（2026-10-30）
- Private Feed for M09Ic
- 0xbug forked seeksec/ui from overtrue/ui
- 0xbug starred overtrue/ui
- strands-agents released harness-cli/v0.2.3 at strands-agents/harness-sdk
- wuhan005 made this repository public
- airbus-seclab released v4.9.0 at airbus-seclab/soxy
- OpenAEV-Platform released 3.261029.0 at OpenAEV-Platform/openaev
- 0xbug starred mongodb/kingfisher
- timwhitez starred semgrep/semgrep
- Ridter starred yetone/magpie
- mgeeky starred browser-use/jev-ultrafast
- wuhan005 starred zeabur-oss/zeabur
- ManassehZhou starred morluto/rea
- su18 forked su18/DropYourGunKid from yaklang/DropYourGunKid
- su18 starred yaklang/DropYourGunKid
- esrrhs starred ruvnet/RuView
- chainreactors released v1.0.0-rc9 at chainreactors/cyber-harness
- Armin Ronacher's Thoughts and Writings
- Verne in GitHub
- Cybernews News
- Hidden Chrome extensions racked up 13M+ installs, hijacking user searches for profit
- ChatGPT told laid-off Amazon engineer to stop taking life-saving drugs and lie to doctors
- Trump Phone teardown: $750 for a gold-painted Chinese phone with missing flag stripes
- Telegram warning: Hackers could run code through Android calls
- Deutsche Geheimdienste planen den Austausch geheimer Daten über die Google Cloud
- Underwater AI data center sparks fury over endangered whales
- We spoke to 100 researchers. This is the biggest threat from AI
- German spy agencies plan to exchange secret information via the Google Cloud
- 42 million docs left unsecured: local complaints exposed personal data for years
- International crackdown takes bulletproof hosting provider offline, exposing data on more than 3,000 customers
- Claude finds Android phone allegedly took thousands of secret photos
- Touchscreen MacBook Pro is here, and users hate it
- “We ain’t done” – crypto scammer steals $13 million in Bitcoin, brags on Signal
- First OpenAI, now Anthropic: Unreleased AI models uncover hundreds of security flaws
- X has started tracking what you share. But you can do something about it
- Sam Altman is “chronically disappointed” with Gen Z, says it doesn’t want to try new things
- Massive breach hits DHS: 41,000 employees, including undercover agents, exposed
- Nefilim and Hive ransomware affiliate sentenced to 70 months in prison
- UK privacy watchdog reprimands police over victim’s exposed address
- obaby 𝐢𝐧⃝ void
- 嘶吼 RoarTalk – 网络安全行业综合服务平台,4hou.com
- Microsoft Security Blog
- Shell is Only the Beginning
- Kitploit — Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!
- Cobalt-Strike-CheatSheet
- rustdesk v1.5.1
- mcp-reverse
- All-In-One-CyberSecurity-Resources
- OffensiveReverseShellCheatSheet
- gods-eye-view — Updated!
- realm
- AI-Red-Teaming-Guide
- Mobile-Security-Framework-MobSF v4.6.2
- blacksandbeacon
- smsofdeath
- Osintgram — Updated!
- JNISleuth-MCP
- kitsune
- Check-Risk-WAF
- ArpCut
- ReflectiveDLLRefresher
- SkillSpector v2.13.2
- IDAChef
- hashcat-utils
- Awesome-Asset-Discovery
- TryHackMe-Roadmap
- UA3F
- esp8266-injection-example
- esp32-sniffer
- Bug Bounty in InfoSec Write-ups on Medium
- Horizon3
- Securelist
- Reverse Engineering
- Reverse engineering the JBL PartyBox Bluetooth protocol: GATT over classic Bluetooth and a speaker that drops links it didn’t create
- Reverse engineering Peugeot SMEG+: VxWorks 6.7 and native UI in a custom QEMU MPC5121E model (AI-assisted)
- NWH Stealer Payload Extraction, Fileless Bun Runtime & Cloud C2 (AWS/R2)
- Amd uProof EoP kernel driver vuln
- GitHub - 1llu50ry/mcp-reverse: MCP (Model Context Protocol) server for game hacking & reverse engineering. A structured knowledge base of 4,100+ skills with full source code archives, specialized agents, and workflow tools -- designed to be plugged into Claude, Cursor, or any MCP-compatible client.
- Reconstructing an MF904Q LK Unlock Path: Actual Gate Inputs, Corrected Return Instrumentation, and Persistence Under Factory LK
- I am testing the power of this obfuscator is there anyone who can deofuscate this code because I am testing the power of this obfuscator
- Malwarebytes
- Toooold
- Dancho Danchev's Blog - Mind Streams of Information Security Knowledge
- Checkmarx
- 绿盟科技技术博客
- 奇客Solidot–传递最新科技情报
- HackerNews
- 黑海洋 - AI工具与技术教程｜免费资源与开发实战
- rtl-sdr.com
- SPECTER: Leaking Data from Air-Gapped Computers by Toggling USB Power States
- SimTX: A Multiplayer Shortwave Radio Simulator with Realistic Propagation and rtl_tcp Support
- Thermal Noise Communication: Sending Data Without a Carrier Signal, with an RTL-SDR as the Receiver
- An Unofficial Bilingual English and Chinese User Guide for SDRplay’s SDRconnect Software
- FalconSDR: An Open-Source RTL-SDR Scanner and Recorder with Automatic Whisper Transcription
- OrcSDR Update: SSTV, ACARS and Offline Maps Come to the Standalone ESP32-P4 RTL-SDR App
- Dhole Moments
- Shostack & Friends Blog
- 威努特安全网络
- 奶牛安全
- 天御攻防实验室
- 青衣十三楼飞花堂
- 腾讯玄武实验室
- 微步在线研究响应中心
- 看雪学苑
- 赵武的自留地
- 数世咨询
- 信息安全国家工程研究中心
- 安全研究GoSSIP
- 安全学术圈
- 奇安信威胁情报中心
- 安全圈
- 安全牛
- 字节跳动技术团队
- 黑鸟
- 复旦白泽战队
- 慢雾科技
- KCon 黑客大会
- 极客公园
- 火绒安全
- 吴鲁加
- 美团技术团队
- XCTF联赛
- 嘶吼专业版
- 360数字安全
- 微步在线
- 国家互联网应急中心CNCERT
- Yak Project
- 青藤智库
- 安全419
- bellingcat
- Over Security
- OpenAI doubles ChatGPT Pro usage limits after backlash over planned 50% cut
- Binance probes potential $5.8 billion crypto-theft hack
- Japan Airlines suffers third-party data breach exposing passenger info
- Hugging Face malware campaign returns to hijack GPUs for crypto mining
- Polymarket halts trading after crypto-draining script breach, $2.5M traced
- DefenderKiller: How Vulnerable Drivers Are Being Abused to Disable Endpoint Security
- Limited reports of PHP bug exploitation emerge
- GM settles with 36 states for selling driver data, agrees to $220 million fine and reforms
- Fake crypto app on Apple App Store linked to $23K wallet theft
- Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
- A quiet week in infosec .
- Protezione della proprietà intellettuale: bloccare i dati
- Federal bankruptcy courts contractor says no data stolen during cyber intrusion
- Chrome extensions with 13.4 million installs caught hijacking searches
- They Sent 3,100 Sideways Pages. The Data Was Still In There.
- Microsoft fixes Remote Desktop failures caused by recent Windows updates
- Justice for AI workers: Complaints about Outlier filed in four EU countries
- Crittografia post-quantistica, il NIST fissa le scadenze per la migrazione
- 3 Ways AI Agents Already Operate in Your Browser
- IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
- FTC to probe airlines, gig worker firms over personalized pricing and pay
- CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
- University of New Mexico restores hospital systems, urges no contact with hackers
- Cyberattack disrupts Belgian tax services before filing deadline
- False multe via PEC, CERT-AGID scopre il sistema dei truffatori
- Windows 11 KB5127936 update released with 41 changes and fixes
- PHP2Shell e Fragnesia, CISA avverte: server Linux a rischio root
- Rapporto Clusit 2026: il cybercrime mette sotto pressione le imprese
- New Cisco firewall zero-day exploited to crash SSL VPN devices
- Modelli AI per la cybersecurity: quali sono, quali scegliere
- Piattaforma IONOS Plus per siti web: suite d’intelligenza artificiale generativa, 50 GB di cloud storage e primo anno a canone azzerato
- NIK C2: The new AI-enabled command-and-control framework
- Ransomware Attacks on Hospitals and Businesses Lead to 70-Month Sentence
- Three Cyberattack Campaigns Target Japan, Exposing AI’s Growing Role
- Gemini 4 Carbon, Google porta gli agenti AI nella caccia alle falle
- Un Boeing 737 violato con 100 dollari: la sicurezza fisica che l’OT ha dimenticato
- Cyber risk, Italia nel mirino: perché la scelta del partner è una decisione di governance
- The Future Of The SOC Is Deployment Freedom
- FBI Seizes Bulletproof Hosting Domain Linked to Cybercrime
- Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia
- MadApe: The Code That Opens the Door
- 悬镜安全
- 中国信息安全
- SANS Internet Storm Center, InfoCON: green
- Tor Project blog
- KitPloit - PenTest Tools!
- Cobalt-Strike-CheatSheet
- rustdesk v1.5.1
- mcp-reverse
- All-In-One-CyberSecurity-Resources
- OffensiveReverseShellCheatSheet
- gods-eye-view — Updated!
- realm
- AI-Red-Teaming-Guide
- Mobile-Security-Framework-MobSF v4.6.2
- blacksandbeacon
- smsofdeath
- Osintgram — Updated!
- JNISleuth-MCP
- kitsune
- Check-Risk-WAF
- ArpCut
- ReflectiveDLLRefresher
- SkillSpector v2.13.2
- IDAChef
- hashcat-utils
- Awesome-Asset-Discovery
- TryHackMe-Roadmap
- UA3F
- esp8266-injection-example
- esp32-sniffer
- Deeplinks
- Instapaper: Unread
- The Hacker News
- ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories
- Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
- Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners
- Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities
- Webinar: How to Build AI Threat Readiness Into Your Security Operations
- Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls
- The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers
- 26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories
- Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
- GitHub Launches npm Firewall to Block Malicious Packages Before Installation
- Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open
- Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys
- China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
- Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
- IndexSec
- TorrentFreak
- Daniel Miessler
- www.theregister.com - Articles
- Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched
- Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers
- Belgium's tax agency confirms cyberattack, pulls services offline
- Shortlist of age checks for the UK's under-16 social media ban is out, 'some' adults will need verifying
- Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour
- Admin dropped the F-bomb in a password to show hackers who was really 1337
- ICT Security Magazine
- Full Disclosure
- [0day-rubbish] NETGEAR RAX120 V1.2.5.18 authenticated SOAP InstallApp OS command injection to root-configured web-stack execution (6.8 Medium; conditionally 7.2 High with management exposure)
- [0day-rubbish] Raritan PX3 PDU G4 firmware 4.3.14 command injection in the ping and traceroute diagnostics through an inverted hostname-validation return check (8.8)
- [0day-rubbish] NUUO Crystal Server 3.19.0.85 unauthenticated upload.php PHP web-root write with fastcgi execution into server-side code execution as the web service account (9.8 Critical)
- [0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 scenario ping condition command injection through the auto-executing ping thread (7.2)
- [0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 IPsec tunnel address command injection through the route-management shell commands (7.2)
- [0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 command injection in the Executer program activation path (7.2)
- Re: CVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2)
- Maximised JSON Array Attacks -- "Let the Commas Hit the Floor" Proof of Concept
- Continued Apache Struts2 JSON Plugin Insecure Deserialisation
- Silent Signal Techblog
- GRAHAM CLULEY
- blackMORE Ops
- Security Affairs
- Binance Investigates Suspicious Crypto Transfers Worth Up to $5.8 Billion
- US Probes Suspected Hack Behind Military Base Freezer Failures
- 484,142 Exposed Cloud Buckets Contain 18 Billion Files
- U.S. CISA adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog
- Volt Typhoon Used Silent Train to Hide Zero-Day Attacks
- Election Website Security: 42% of US County Sites Still Lack .gov Domains
- ENGIE Data Breach Exposes Customer Details and Energy Contracts
- Virtualine Domain Seized, but Allegedly Abusive Website Remains Online
- Blackhat Library: Hacking techniques and research
- LockBoxx
- Security Weekly Podcast Network (Audio)
Activity