Aggregator

引言随着大型语言模型（LLM）和深度学习技术在安全领域的广泛应用，传统的基于特征码、抽象语法树（AST）或沙箱行为分析的 Webshell 检测手段正逐渐向基于 AI 的语义分析演进。AI 模型能够理解代码的逻辑意图，从而识别出经过复杂混淆的恶意脚本。然而，AI 模型本身存在一个本质性的弱点：它们在处理代码时，往往将代码逻辑与注释、元数据等“非执行内容”置于同一语义空间进行推理。这就为提示词注入（

谁在偷窥你的键盘？揭秘潜伏在系统进程背后的“银狐”

本文将结合关键代码，对 OpenClaw 低于 2026.2.14 版本中 Feishu 扩展存在的服务端请求伪造（SSRF）漏洞成因与官方修复方案进行简要分析，为相关开发者及安全从业人员提供参考。

CVE-2026-31975：Cloud CLI WebSocket Shell OS命令注入漏洞分析

原创

本文是一篇探讨如何将AI（尤其是大语言模型）与Web3智能合约安全审计深度结合的技术实践与方法论文章。基于实际工作经验，提出在AI时代，真正高效的自动化代码审计不应依赖简单的指令或具体的漏洞案例，而应回归“提示词编写（Prompt Engineering）”的基本功。

原域名已变更且将在2024年彻底废弃，请访问 https://govuln.com/news/ 查看新的RSS订阅

2026年Django爆出的SQL注入漏洞CVE-2026-1312: Potential SQL injection via QuerySet.order_by and FilteredRelation 看描述有点意思，似乎是解决了我一直无法bypass的一个点，于是进行深入分析下

该漏洞源于服务端 authorized() 中间件在识别 Webhook 路径时使用了非锚定正则表达式，导致其错误地匹配了 URL 中的查询参数。远程攻击者只需在 API 请求末尾拼接特定的 Webhook 路径字符串（如 ?/webhooks/trigger），即可绕过身份认证、角色鉴权及 CSRF 防护，实现对服务端所有 API 端点的完全访问与操作。

Is Your Organization’s Non-Human Identity Strategy Robust Enough? What if the backbone of your organization’s cybersecurity strategy is more susceptible to breaches than you think? Where machine identities increasingly outnumber human ones, focusing on Non-Human Identities (NHIs) is critical. NHIs serve as the “tourists” navigating through vast cloud environments. Much like human identities, they require […]

The post Does your NHI system deliver essential value appeared first on Entro.

The post Does your NHI system deliver essential value appeared first on Security Boulevard.

What Are Non-Human Identities (NHIs) and Why Are They Critical in Cybersecurity? How do we ensure the security of these interactions? The concept of Non-Human Identities (NHIs) offers a compelling solution. NHIs, an advanced concept in cybersecurity, are designed to safeguard machine identities, ensuring that their actions are secure from creation to decommissioning. The Relevance […]

The post Is your Agentic AI optimized for latest threats appeared first on Entro.

The post Is your Agentic AI optimized for latest threats appeared first on Security Boulevard.

Are You Confident in Your Secrets Vaulting Strategy? The management of machine identities—what the industry terms Non-Human Identities (NHIs)—has become a linchpin in safeguarding cloud environments. When organizations increasingly transition to cloud-based architectures, ensuring the security of NHIs and their associated secrets is paramount. But how can organizations feel truly reassured in their secrets vaulting […]

The post How relieved are you with your secrets vaulting strategy appeared first on Entro.

The post How relieved are you with your secrets vaulting strategy appeared first on Security Boulevard.

笔者最近一直在关注银狐的攻击，发现有一类的银狐变化特别快，而且还特别活跃。相信各位师傅看过这样子的银狐钓鱼:**2026年第一季度违规内职人员名单信息公告.exe**，这个团伙现在的加载器已经是多次迭代的，近期主要在混淆方面进行迭代，增加了混淆后，又不好分析，ida还容易崩，单步调试好一会，找到关键函数却眼前一黑，密密麻麻的基本块糊在一起，文章会着重分析如何减轻垃圾代码的影响。

A vulnerability was found in Linksys MR9600 2.0.6.206937 and classified as critical. Affected is the function smartConnectConfigure of the file SmartConnect.lua. Executing a manipulation of the argument configApSsid/configApPassphrase/srpLogin/srpPassword can lead to os command injection. The identification of this vulnerability is CVE-2026-4558. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in code-projects Exam Form Submission 1.0 and classified as problematic. This impacts an unknown function of the file /admin/update_s1.php. Performing a manipulation of the argument sname results in cross site scripting. This vulnerability was named CVE-2026-4557. The attack may be initiated remotely. In addition, an exploit is available.

JDK17后的高版本触发toString整合

On March 20, 2026 at 20:45 UTC, Aikido Security detected an unusual pattern across the npm registry: dozens of packages from multiple organizations were receiving unauthorized patch updates, all containing the same hidden malicious code. What they had caught was CanisterWorm, a self-spreading npm worm deployed by the threat actor group TeamPCP. We track this […]

The post CanisterWorm: The Self-Spreading npm Attack That Uses a Decentralized Server to Stay Alive appeared first on Security Boulevard.

在全保护开启的64位环境下，通过栈上格式化字符串漏洞实现一次性覆写返回地址，结合libc基址泄露与one_gadget构造ROP链。

网上没看到此漏洞的分析，所以自己分析看看何意味

A vulnerability marked as critical has been reported in Canva Affinity. Impacted is an unknown function of the component EMF File Parser. Performing a manipulation results in out-of-bounds read. This vulnerability is identified as CVE-2025-61979. The attack can be initiated remotely. There is not any exploit available.