macOS，正在大规模失陷
攻击macOS的四类手法解读
Aggregator
Welcoming the Costa Rican Government to Have I Been Pwned
1 month 2 weeks ago
Today, we welcome the 42nd government onboarded to Have I Been Pwned’
Welcoming the Costa Rican Government to Have I Been Pwned
1 month 2 weeks ago
Today, we welcome the 42nd government onboarded to Have I Been Pwned’s free gov service: Costa Rica.
The CSIRT of the Government of Costa Rica now has access to monitor government domains against the data in HIBP. This enables their national cybersecurity incident response team to identify exposure
Troy Hunt
CVE-2026-41018 | Apache Airflow Providers Elasticsearch up to 6.5.2 Elasticsearch task-log log file
1 month 2 weeks ago
A vulnerability was found in Apache Airflow Providers Elasticsearch up to 6.5.2. It has been rated as problematic. This affects an unknown function of the component Elasticsearch task-log Handler. The manipulation leads to sensitive information in log files.
This vulnerability is traded as CVE-2026-41018. It is possible to initiate the attack remotely. There is no exploit available.
Upgrading the affected component is advised.
vuldb.com
CVE-2026-43826 | Apache Airflow Providers OpenSearch up to 1.9.0 OpenSearch task-log log file
1 month 2 weeks ago
A vulnerability was found in Apache Airflow Providers OpenSearch up to 1.9.0. It has been declared as problematic. The impacted element is an unknown function of the component OpenSearch task-log Handler. Executing a manipulation can lead to sensitive information in log files.
This vulnerability appears as CVE-2026-43826. The attack may be performed from remote. There is no available exploit.
It is recommended to upgrade the affected component.
vuldb.com
优步合作伙伴Avride正因自动驾驶碰撞事故接受调查
1 month 2 weeks ago
美国国家公路交通安全管理局（NHTSA) 已对 Avride展开调查，这是一家与优步合作的自动驾驶出租车公司，此前该局发现了十几起碰撞事故和一起轻伤事件。该安全监管机构的缺陷调查办公室（ODI) 表示
Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America
1 month 2 weeks ago
TrendAI™ Research has identified two emerging threat campaigns—SHADOW-AETHER-040 and SHADOW-AETHER-064—that use agentic AI to drive intrusion operations against government and financial organizations in Latin America, marking these among the first cases we have observed of AI agents executing attacks from initial access to data exfiltration.
Joseph C Chen
威努特赋能数字化医院构建全流程数据安全监测防护体系
1 month 2 weeks ago
助力医院在数字化进程中稳步发展。
威努特赋能数字化医院构建全流程数据安全监测防护体系
1 month 2 weeks ago
环境异常 当前环境异常，完成验证后即可继续访问。 去验证
Weekly Update 503
1 month 2 weeks ago
Well, it's the day before the Instructure "pay or leak" deadline (at least by my Aussie watch), and the company remains removed from the ShinyHunters website. In its place sits a press statement that amounts to "we're not making any statements". So
Troy Hunt
CVE-2026-8177 | SHLOMIF XML::LibXML up to 2.0210 on Perl out-of-bounds (Issue 146)
1 month 2 weeks ago
A vulnerability was found in SHLOMIF XML::LibXML up to 2.0210 on Perl. It has been classified as problematic. The affected element is an unknown function. Performing a manipulation results in out-of-bounds read.
This vulnerability is reported as CVE-2026-8177. The attack is possible to be carried out remotely. No exploit exists.
It is suggested to install a patch to address this issue.
vuldb.com
CVE-2026-45191 | STIGTSP Net::CIDR::Lite up to 0.23 on Perl improper validation of unsafe equivalence in input
1 month 2 weeks ago
A vulnerability was found in STIGTSP Net::CIDR::Lite up to 0.23 on Perl and classified as problematic. Impacted is an unknown function. Such manipulation leads to improper validation of unsafe equivalence in input.
This vulnerability is documented as CVE-2026-45191. The attack can be executed remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
vuldb.com
CVE-2026-45190 | STIGTSP Net::CIDR::Lite up to 0.23 on Perl find/bin_find improper validation of unsafe equivalence in input
1 month 2 weeks ago
A vulnerability has been found in STIGTSP Net::CIDR::Lite up to 0.23 on Perl and classified as problematic. This issue affects the function find/bin_find. This manipulation causes improper validation of unsafe equivalence in input.
This vulnerability is registered as CVE-2026-45190. Remote exploitation of the attack is possible. No exploit is available.
The affected component should be upgraded.
vuldb.com
CVE-2026-45180 | RRWO Catalyst::Plugin::Statsd up to 0.10.0 on Perl statsd cleartext transmission (GHSA-gjvr-hq83-fc38)
1 month 2 weeks ago
A vulnerability, which was classified as problematic, was found in RRWO Catalyst::Plugin::Statsd up to 0.10.0 on Perl. This vulnerability affects unknown code of the component statsd. The manipulation results in cleartext transmission of sensitive information.
This vulnerability is cataloged as CVE-2026-45180. The attack may be launched remotely. There is no exploit available.
vuldb.com
CVE-2026-45179 | RRWO Plack::Middleware::Statsd up to 0.8.x on Perl statsd cleartext transmission (GHSA-9gwm-665p-w2xx)
1 month 2 weeks ago
A vulnerability, which was classified as problematic, has been found in RRWO Plack::Middleware::Statsd up to 0.8.x on Perl. This affects an unknown part of the component statsd. The manipulation leads to cleartext transmission of sensitive information.
This vulnerability is listed as CVE-2026-45179. The attack may be initiated remotely. There is no available exploit.
It is advisable to upgrade the affected component.
vuldb.com
CVE-2024-48419
1 month 2 weeks ago
Currently trending CVE - Hype Score: 8 - Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 suffers from Command Injection issues in /bin/goahead. Specifically, these issues can be triggered through /goform/tracerouteDiagnosis, /goform/pingDiagnosis, and /goform/fromSysToolPingCmd Each of these issues allows an ...
CVE-2024-3094
1 month 2 weeks ago
Currently trending CVE - Hype Score: 1 - Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify ...
Two US Men Jailed for Helping North Korean Hackers Infiltrate US Firms
1 month 2 weeks ago
Matthew Knoot and Erick Prince have been jailed for 18 months each for helping North Korean hackers infiltrate US firms through remote laptop farms.
Deeba Ahmed
Микробы с «кнопкой выключения». Ученые предложили новый способ остановить ГМО-организмы после побега из лаборатории
1 month 2 weeks ago
Ученые создали систему, которая необратимо выключает жизненно важные гены и не дает генетически модифицированным клеткам выжить вне лаборатории.
Hackers abuse Google ads, Claude.ai chats to push Mac malware
1 month 2 weeks ago
Attackers are abusing Google Ads and legitimate Claude.ai shared chats in an active malvertising campaign. Users searching for "Claude mac download" may come across sponsored search results that list claude.ai as the target website, but lead to instructions that install malware on their Mac. [...]
Ax Sharma