Aggregator

Мещанский суд отправил в СИЗО троих фигурантов Qiwi-схемы.

A threat actor using the alias NormalLeVrai has posted a “comeback” teaser headlined as a leak of GOV.CO, the official digital platform of the Colombian government, claiming 4,300,002 records.

英国伦敦大学玛丽皇后学院的研究人员分析了 1960-2023 年间发行的逾 38 万首歌曲的歌词后发现，流行音乐中使用的情感语言和道德语言发生了显著变化。表达关怀和体面等道德美德的词语随时间推移变得越来越少见，而与伤害、欺骗、颠覆和堕落相关的语言逐渐增多。研究人员指出，“音乐不仅仅是娱乐。它是社会讲述自身故事的方式之一。通过分析几十年来的歌词，我们可以开始看到情感表达和道德叙事随时间如何演变。”研究还发现，女性艺术家更多与关爱和忠诚等美德联系在一起，而男性艺术家和男女混合组合则更多与反映伤害、颠覆和堕落等负面主题联系在一起。

A Chinese-speaking advanced persistent threat (APT) actor has been linked to a new custom backdoor called TinyRCT as part of cyber attacks aimed at government entities and critical infrastructure in Southeast Asia. The activity, particularly aimed at state-owned enterprises in the energy and government sectors, has been attributed to a threat actor called CL-STA-1062, which Palo Alto Networks

Currently trending CVE - Hype Score: 2 - A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

A threat actor using the alias D3spair157 (operating as “Sociedad Privada 157”) has posted what they describe as a data leak from the Secretaría de Educación del Estado de Durango (SEED), Mexico's Durango state education department, reportedly obtained using administrator credentials to its student-management portal.

A newly disclosed Linux kernel vulnerability combining a Copy-on-Write (COW) page-cache corruption flaw with the net/sched subsystem’s act_pedit component is enabling unprivileged local attackers to escalate privileges to full root access on several major Linux distributions. The exploit, dubbed packet_edit_meme, has been verified in June 2026 against actively maintained enterprise and consumer kernels. The root […]

The post New Linux pedit COW Exploit Allows Attackers to Gain System Root Access appeared first on Cyber Security News.

Cloudflare 复盘了把 AI 用于企业级漏洞发现的工程系统：重点在于搭建可持久、可换模型、可去重和可分诊的 harness，而非押注单一模型。

A vulnerability described as problematic has been identified in Unisoc SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T610, T618, T606, T612, T616, T760, T770, T820 and S8000. Impacted is an unknown function of the component Power Management Service. Executing a manipulation can lead to missing authorization. This vulnerability is tracked as CVE-2022-39095. The attack is restricted to local execution. No exploit exists.

A vulnerability classified as problematic has been found in Unisoc SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T610, T618, T606, T612, T616, T760, T770, T820 and S8000. The affected element is an unknown function of the component Power Management Service. The manipulation leads to missing authorization. This vulnerability is listed as CVE-2022-39096. The attack must be carried out locally. There is no available exploit.

A vulnerability marked as problematic has been reported in Unisoc SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T610, T618, T606, T612, T616, T760, T770, T820 and S8000. This issue affects some unknown processing of the component Power Management Service. Performing a manipulation results in missing authorization. This vulnerability is identified as CVE-2022-39094. The attack is only possible with local access. There is not any exploit available.

Instead of eliminating jobs for early-career cyber pros, AI is creating new opportunities for candidates with strong human decision-making skills.

sentinelone新近披露的一款 Rust 语言编写的 macOS 平台植入程序macOS.Gaslight，归属于朝鲜背景的威胁活动集群。 该恶意程序最核心的突破在于，其反分析逻辑跳出了传统沙箱对抗、调试器检测的思路，转而攻击安全行业日益普及的LLM 辅助分析分诊流水线，通过在样本内预置伪造的系统故障信息，诱导大语言模型中断分析或输出错误结论。 macOS.Gaslight的反分析设计，攻击对象并非执行环境，而是分析环节中的 LLM 辅助工具，干扰后续的自动化分析流程。 样本二进制内嵌入了一段 3.5KB 的恶意文本载荷，包含 38 条完全伪造的系统消息，以{{DATA}}作为内容分隔标记，整体采用 Markdown 格式排版。这套结构与安全行业 LLM 分析流水线常用的提示模板框架高度吻合：这类提示模板通常会用固定标记分隔系统指令、样本数据、输出格式，以规范 LLM 的分析行为；而 Gaslight 通过模仿模板的格式与标记，模糊了 “不可信的样本数据” 与 “可信的系统指令 / 环境信息” 之间的边界。 当安全团队将样本的静态字符串、运行日志、反汇编注释等内容直接投喂给 LLM，用于批量生成分析报告、自动判定威胁等级时，这些伪造内容会混入模型的输入上下文，被 LLM 误判为自身分析环境产生的状态信息。 这些伪造消息覆盖了运维与分析场景中大量常见的异常状态，包括令牌过期、工作进程被系统资源管理机制杀死、内存溢出、磁盘空间耗尽、Redis 连接池超时、JSON 解析报错、CI 流水线构建失败、定时备份任务执行异常等，甚至植入了虚假的 “SQL 注入漏洞告警”“静态分析标记异常” 等误导性内容。 最终效果是让 LLM 误以为分析环境出现了连锁故障，进而出现分析流程中断、结果被截断、输出错误的无风险判定，甚至直接拒绝执行本次分析任务。 此类针对分析师与分析工具的提示注入并非全新概念，但野外在野样本的实现程度存在明显代差： 披露的Hades 供应链窃密载荷，仅在文件头部加入伪造的提示注入头 泄露的 Shai-Hulud 恶意代码，仅携带针对 Claude Code 的magic字符串，试图终止特定模型的分析。 上述案例均依赖单条注入内容或头部标记实现，而 macOS.Gaslight 采用 38 条成体系的级联伪造消息，模拟完整的环境故障链路，其伪装规模、场景还原度在已知野外在野恶意样本中均处于较高水平。 该样本的常规反分析手段仅通过dlsym动态解析系统 API 以规避静态符号表检测、动态获取自身可执行文件路径而非硬编码，其核心反分析能力完全聚焦于 LLM 分析链路。

今日暂未更新资讯~
更多最新文章，请访问SecWiki

A vulnerability labeled as critical has been found in Linux Kernel up to 6.18.32/7.0.9. This affects the function psp_dev_check_access of the component net. Executing a manipulation can lead to permission issues. This vulnerability appears as CVE-2026-52978. The attacker needs to be present on the local network. There is no available exploit. The affected component should be upgraded.

A vulnerability was found in Linux Kernel up to 6.18.32/7.0.9. It has been declared as critical. Impacted is the function psp_assoc_device_get_locked of the component net. Such manipulation of the argument lock leads to improper locking. This vulnerability is referenced as CVE-2026-52979. The attack needs to be initiated within the local network. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.12.90/6.18.32/7.0.9. The impacted element is the function __sched_fork of the component sched. Executing a manipulation of the argument rel_deadline can lead to denial of service. This vulnerability is tracked as CVE-2026-52980. The attack is only possible within the local network. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.1.174/6.6.140/6.12.90/6.18.32/7.0.9. It has been rated as critical. The affected element is the function futex_wait_requeue_pi of the component futex. Performing a manipulation results in infinite loop. This vulnerability is identified as CVE-2026-52977. The attack can only be performed from the local network. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability categorized as problematic has been discovered in Unisoc SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T610, T618, T606, T612, T616, T760, T770, T820 and S8000. Affected by this issue is some unknown functionality of the component Power Management Service. The manipulation results in missing authorization. This vulnerability was named CVE-2022-39091. The attack needs to be approached locally. There is no available exploit.

A vulnerability identified as problematic has been detected in Unisoc SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T610, T618, T606, T612, T616, T760, T770, T820 and S8000. This affects an unknown part of the component Power Management Service. This manipulation causes missing authorization. The identification of this vulnerability is CVE-2022-39092. The attack can only be executed locally. There is no exploit available.