Posts of last few hours
Please support the site operations by clicking ads.
These are the top threats you should know about this week.
https://www.f5.com/labs/articles/weekly-threat-bulletin-november-11th-2026
原域名已变更且将在2024年彻底废弃，请访问 https://govuln.com/news/ 查看新的RSS订阅
https://govuln.com/news/url/x8dB
Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems.
The vulnerabilities are listed below -
CVE-2026-108186 (CVSS score: 9.6) - An improper input validation vulnerability that could allow an unauthenticated user to conduct an escalation of privilege via
https://thehackernews.com/2026/11/critical-zoom-workplace-flaw-could.html
社会热点的法律视角解读
https://mp.weixin.qq.com/s?__biz=MzAwNDcwMDgzMA==&mid=2651049262&idx=2&sn=59404c6094848ec5d1848e5b99c89856
司法的公正，就藏在这些最细微的数字里......
https://mp.weixin.qq.com/s?__biz=MzAwNDcwMDgzMA==&mid=2651049262&idx=1&sn=62cfa22e8736a8daf36407138feb44b6
几十年了，无线电通信和雷达一直是两套独立系统。通信基站负责把数据从A点搬到B点，雷达负责探测天空里有什么，前者管连得上，后者管看得见，井水不犯河水。
https://mp.weixin.qq.com/s?__biz=MzAxOTM1MDQ1NA==&mid=2451189808&idx=1&sn=5668dd5867c250918f27096fa8a26de0
Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and pivot laterally into compromised environments.
"In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against
https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html
https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247502484&idx=1&sn=5724e1c4b44fa2ebdfea212cea3baf50
Mozilla 宣布，为迎接年底的假期 Firefox 内置的 VPN 服务从 11 月 10 日到 2027 年 1 月 31 日之间不限制流量。Firefox 内置的 VPN 不同于 Mozilla VPN，前者设计通过 Mozilla 管理的服务器路由浏览器的流量隐藏用户的真实 IP 地址；后者则是独立的付费订阅服务，可同时在五台设备上使用。Firefox 内置 VPN 服务尚未向全球推广，目前仅限于美国、法国、德国和英国等国的用户。
https://www.solidot.org/story?sid=85861
苹果突然宣布关闭其支持社区 Support Community：它将于 2026 年 11 月 20 日永久关闭，即日起进入只读模式，用户无法再发新帖。想要获得帮助的苹果用户可访问 Apple Support 网站，但他们将无法互相交流。苹果支持社区创建于 1998 年，是一个用户互相交流和讨论问题的论坛，它的关闭标志着三十年积累的建议、故障排查经验以及未获解答问题都戛然而止，苹果未说明支持社区存档是否还能访问。
https://www.solidot.org/story?sid=85860
Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026.
Cynet's CyOps and Research teams said they identified the suspicious activity in October 2026 against several E.U.-based customers within a narrow window of just over three minutes.
The activity has been found to share some
https://thehackernews.com/2026/11/hackers-target-qlik-sense-servers-with.html
Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday.
They included 24 apps built by staff at the social network X and at SpaceXSI, the company that makes the Grok AI assistant. Most of the open apps were games, landing pages, and calculators, but about 1 in 10 contained internal business or
https://thehackernews.com/2026/11/over-35000-grok-built-apps-exposed.html
We tell customers three things about securing AI agents: they need their own identities, access that fits the job they’re given, and traceability that’s separate from any human’s. That was true for us at Token as well. Then, we built an agent that broke all three by default.
This helped us think through how such agents should be defended. When a browser agent acts inside a user’s authenticated
https://thehackernews.com/2026/11/we-built-agent-that-broke-all-of-our.html
The in-house Python script behind eMudhra's October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys.
Each intermediate CA has its own private key, which the company uses to sign the certificates it issues. The 8 intermediate CAs compromised in October had a different problem: a single line in the script
https://thehackernews.com/2026/11/emudhra-revokes-8-more-cas-it.html
11月11日，绿盟科技CERT监测到微软发布11月安全更新补丁，修复了1094个安全问题，涉及Windows、Microsoft Office、Microsoft Outlook、Microsoft Exchange Server、Microsoft SQL Server等广泛使用的产品。
https://mp.weixin.qq.com/s?__biz=Mzk0MjE3ODkxNg==&mid=2247494028&idx=1&sn=07060cd606411c72d8cf9de343af89e6
能翻跟头的机器人，这次接了一个更具体的活儿。
https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2653116309&idx=1&sn=2b89ce9f4ea1bbf9e69e014239eab8ef
长期以来，人们认为野生黑猩猩的发声完全由遗传决定，无需学习。发表于 PNAS 期刊上的一项研究挑战了这一观点，首次发现了野生黑猩猩中存在任意性、习得性发声惯例的证据。该发现缩小了黑猩猩交流与人类交流之间的差距。词语在人类语言中具有任意性和习得性。这里的任意性指一个词语在不同背景或领域里含义可能完全不同。词语在使用过程中的任意性，最终形成了因社群而异的语言惯例。一个人之所以遵循这些惯例，是因为同伴都这样做；如果同伴改变了用法，个体也就会遵循这些改变。研究人员分析了野生黑猩猩和圈养黑猩猩都会发出的嘟噜声的使用情况。研究涵盖了91只年龄在0到55岁的黑猩猩，其中一部是科特迪瓦塔伊国家公园的野生黑猩猩，另一部是塞拉利昂塔库加马黑猩猩保护区中由与同龄伙伴一起长大的孤儿黑猩猩。分析结果表明，野生黑猩猩只在相互梳理毛发时才使用这种叫声，而保护区里的孤儿黑猩猩则在多种社交互动中使用它。这表明该叫声的用法需要习得，而非遗传决定的。为了进一步证明该结论，研究人员在第二阶段的实验中，将一只成年黑猩猩引入其中一个孤儿黑猩猩群体。结果随着时间推移，该群体使用嘟噜声的方式明显趋于一致，并向成年黑猩猩的用法靠拢。这表明幼年黑猩猩会像人类一样，向年长者学习叫声的功能。上述发现表明，黑猩猩的声音交流比此前认为的更接近人类。
https://www.solidot.org/story?sid=85859
OpenAI发布GPT-6 Cyber模型专为漏洞挖掘设计，成本降至千美元级别，在Linux内核中发现948个本地提权漏洞
https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652079834&idx=3&sn=9f5233b9da2385dbe4ce4527012d3c10
OpenAI发布GPT-6 Cyber模型专为漏洞挖掘设计，成本降至千美元级别，在Linux内核中发现948个本地提权漏洞
https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652079834&idx=2&sn=f9a3ec5c78818d7d7509c38d4e00528b
OpenAI发布GPT-6 Cyber模型专为漏洞挖掘设计，成本降至千美元级别，在Linux内核中发现948个本地提权漏洞
https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652079834&idx=1&sn=87414c25c31b4e94e839597e00255ff4
Latest Blog Posts
- 1 day 22 hours ago
- 1 day 22 hours ago
- 1 day 22 hours ago
- 1 day 22 hours ago
- 1 day 22 hours ago
- 1 day 22 hours ago
- 1 day 22 hours ago
- 1 day 22 hours ago
- 1 day 22 hours ago
- 1 day 22 hours ago