Aggregator

A vulnerability identified as problematic has been detected in OpenClaw up to 2026.3.1. Affected is an unknown function. This manipulation causes incorrect authorization. This vulnerability is registered as CVE-2026-32035. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

A vulnerability was found in OpenClaw up to 2026.3.1. It has been rated as critical. This vulnerability affects unknown code of the file /api/channels. Performing a manipulation results in authentication bypass using alternate channel. This vulnerability is identified as CVE-2026-32004. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability identified as very critical has been detected in Kubernetes up to 1.13.8/1.14.4/1.15.0. This issue affects some unknown processing of the component ingress-nginx. Performing a manipulation results in improper input validation. This vulnerability is reported as CVE-2026-4342. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

HackerNews 编译，转载请注明出处：  WorldLeaks团伙本周同时对洛杉矶及其地铁系统发动攻击，导致部分服务被迫中断；与此同时，旧金山湾区两座城市也因遭遇勒索软件攻击而宣布进入紧急状态。 洛杉矶地铁系统遭袭，服务受限 据当地媒体报道，本周洛杉矶地铁（Metro）内部系统检测到未授权活动，迫使该机构限制系统访问权限，车站到站显示屏也因此受到影响。 NBC洛杉矶报道称：”内部行政计算机系统出现未授权活动，促使Metro限制了对这些系统的访问，导致车站显示屏无法显示列车到达时间。” 目前乘客在通过网站或客服热线为TAP交通卡充值时遇到困难，Metro建议乘客改用站内售票机完成充值。铁路和公交服务仍在正常运行，且没有客户或员工的个人信息受到影响。Metro方面表示，正在进行全面的安全检查，并努力恢复系统的完全访问权限。 湾区城市相继沦陷，紧急状态接踵而至 另一起事件中，福斯特市（Foster City）官员表示，一场勒索软件攻击正在广泛破坏市政服务，迫使市领导宣布进入紧急状态，以便争取外部支持和资金援助。虽然911等紧急服务仍在正常运转，但许多依赖内部系统的市政服务已无法使用。市政厅虽保持开放，但仅能提供有限服务。 该市于周四早些时候发现攻击后，迅速将大部分系统下线以保护网络安全。目前 officials 正与独立网络安全专家合作，开展调查并努力恢复运营。 此次攻击主要影响了数字服务和信息获取渠道，核心的应急响应能力保持完好。当局表示，目前尚不清楚攻击者是否访问或复制了敏感数据，但警告公众信息可能已遭泄露。作为预防措施， officials 敦促所有曾与市政府有过业务往来的市民更改密码，并采取措施保护个人数据。 据《旧金山纪事报》报道，该市表示：”出于谨慎考虑，建议所有与福斯特市有过业务往来的市民更改个人密码，并采取措施保护自己的个人数据。” WorldLeaks认领洛杉矶市政府为受害者 2026年3月20日，WorldLeaks勒索软件团伙将其数据泄露网站上的受害者名单更新，加入了洛杉矶市政府。该团伙声称窃取了159.9GB数据，共计779份文件。 WorldLeaks是一个以勒索为目的的网络犯罪组织，通过窃取企业数据向受害者施压，威胁若不支付赎金就将数据公开泄露。该团伙于2025年更名自2023年起活跃的Hunters International勒索团伙。在面临日益严厉的执法压力后，该组织放弃了文件加密手段，全面转向数据窃取和勒索模式，至今已宣称对数百名受害者下手。 消息来源：securityaffairs.com； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

“这是网络战新时代的开端”

好的，我现在需要帮用户总结这篇文章的内容，控制在100个字以内。首先，我得仔细阅读文章，理解主要信息。 文章主要讲微软正在讨论是否继续强制Windows 11用户在OOBE阶段登录账户。微软的高管也承认不喜欢这种情况，并在努力解决。另外，用户可以使用Rufus工具跳过登录。微软计划在2026年重塑Windows 11，包括允许移动任务栏和改进性能等。 接下来，我需要提取关键点：微软讨论是否继续强制登录、高管反对、用户可用工具跳过、未来计划改进系统。 然后，我要把这些点浓缩成一句话，不超过100字。可能的结构是：微软考虑停止强制登录，高管反对，用户可用工具绕过，未来计划优化系统。 最后检查字数是否符合要求，并确保表达清晰。 微软考虑停止强制Windows 11用户在安装阶段登录账户，高管反对该做法，用户可使用工具跳过登录。微软计划于2026年优化系统功能。

A vulnerability was found in Google Chrome. It has been classified as critical. This impacts an unknown function of the component V8. This manipulation causes sandbox issue. This vulnerability is handled as CVE-2026-4447. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability has been found in Google Chrome and classified as critical. This affects an unknown part of the component ANGLE. Performing a manipulation results in heap-based buffer overflow. This vulnerability is reported as CVE-2026-4448. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

A vulnerability was found in Google Chrome and classified as critical. This vulnerability affects unknown code of the component V8. Executing a manipulation can lead to out-of-bounds write. This vulnerability appears as CVE-2026-4450. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability was found in Google Chrome. It has been classified as critical. This issue affects some unknown processing of the component Blink. The manipulation leads to use after free. This vulnerability is traded as CVE-2026-4449. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

A vulnerability was found in Google Chrome. It has been declared as critical. Impacted is an unknown function of the component Navigation. The manipulation results in sandbox issue. This vulnerability is known as CVE-2026-4451. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability was found in Google Chrome on Windows. It has been rated as critical. The affected element is an unknown function of the component ANGLE. This manipulation causes external control of assumed-immutable web parameter. This vulnerability is handled as CVE-2026-4452. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability categorized as critical has been discovered in Google Chrome. The impacted element is an unknown function of the component Network. Such manipulation leads to use after free. This vulnerability is uniquely identified as CVE-2026-4454. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability identified as critical has been detected in Google Chrome. This affects an unknown function of the component PDFium. Performing a manipulation results in heap-based buffer overflow. This vulnerability was named CVE-2026-4455. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

A vulnerability described as critical has been identified in Google Chrome on macOS. Affected by this vulnerability is an unknown functionality of the component Dawn. The manipulation results in external control of assumed-immutable web parameter. This vulnerability is identified as CVE-2026-4453. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability labeled as critical has been found in Google Chrome. This impacts an unknown function of the component HTML Page. Executing a manipulation can lead to use after free. The identification of this vulnerability is CVE-2026-4456. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability marked as critical has been reported in Google Chrome. Affected is an unknown function of the component V8. The manipulation leads to type confusion. This vulnerability is referenced as CVE-2026-4457. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Google Chrome. This impacts an unknown function of the component WebAudio. This manipulation causes out-of-bounds write. This vulnerability is tracked as CVE-2026-4459. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability categorized as critical has been discovered in Google Chrome. Impacted is an unknown function of the component Extensions. Such manipulation leads to use after free. This vulnerability is traded as CVE-2026-4458. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.