Aggregator

Overview of Content Published in June Filed under: Announcement — Didier Stevens @ 9:04

Один атакующий — сотни жертв: чем опасны новые дыры в AirDrop и Quick Share.

Before signing a contract, a customer's security team conducted a vendor review, and one question on

0 个全职员工，做出一款爆品。

Aflac Japan has notified regulators that policy details and personal and banking information have been compromised

Jul 1, 2026One of the biggest questions most executives ask is "Why does itstill feel this hard whe

本期活动持续时间：2026年7月2日至2026年7月17日12:00

A vulnerability classified as problematic was found in libarchive. This affects an unknown part of the component RAR5 Reader. Executing a manipulation can lead to double free. The identification of this vulnerability is CVE-2026-14164. The attack may be launched remotely. There is no exploit available. A patch should be applied to remediate this issue.

A vulnerability marked as problematic has been reported in websockets ws up to 8.20.0. This affects the function websocket.close. Performing a manipulation of the argument Reason results in uninitialized resource. This vulnerability is cataloged as CVE-2026-45736. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability was found in IBM WebSphere Application Server up to 26.0.0.7 and classified as critical. Affected by this vulnerability is an unknown functionality. Such manipulation leads to server-side request forgery. This vulnerability is traded as CVE-2026-11546. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in IBM WebSphere Application Server up to 26.0.0.7. Affected by this vulnerability is an unknown functionality. This manipulation causes server-side request forgery. This vulnerability is tracked as CVE-2026-11714. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.12.80/6.18.21/6.19.11. It has been declared as critical. This vulnerability affects unknown code of the component Tegra Crypto Driver. The manipulation results in denial of service. This vulnerability is known as CVE-2026-31739. Access to the local network is required for this attack. No exploit is available. It is recommended to upgrade the affected component.

美国俄勒冈州尤金市（Eugene）警方最近宣布，他们发现了一个隐藏摄像头，据信该摄像头被用于监视一个亚裔美国家庭，这与比弗顿（Beaverton）和塞勒姆（Salem）发生的一系列入室盗窃案有关。 警方未透露发现摄像头的具体方式或地点，但提醒社区居民“检查并留意灌木丛中是否有隐藏摄像头”。 据警方称，一些盗窃团伙已将亚裔美国家庭作为作案目标；在实施盗窃前，他们似乎会对潜在受害者进行暗中监视，同时阻挡或干扰屋主的监控设备。 警方还公布了一张据称来自监控录像的图片，画面中是一辆他们认为可能与案件有关的厢式货车。同时，警方提醒民众要留意周围环境，并在白天注意任何可疑车辆或快递车辆。警方表示，窃贼过去曾利用带有公司标识的服装来掩人耳目，以逃避怀疑。 其实早在一年多前，美国波特兰地区的有关部门就已经发出警告，称有盗窃团伙专门针对富裕的亚裔美国家庭，窃取珠宝、现金、车钥匙及其他高价值物品，但未受到普遍重视。 但现在随着这种明显专门用于秘密监视的隐藏摄像头的发现，也意味着现代犯罪团伙已开始采用高技术手段进行暗中观察和踩点，隐性风险也开始增大。 #出海安全 #海外华人安全 #海外威胁情报 #隐私保护

作者：Jiaqi Li, Yang Zhao, Wen Lu, Lvyang Zhang, and Lidong Zhai 原文链接：https://arxiv.org/pdf/2606.29981v1 摘要 网络攻击正在以机器速度推进；但网络安全研究本身却并非如此。现有的AI科学家系统使得端到端的研究自动化越来越可行，但它们针对的是相对稳定的科学领域。我们认为，AI原生的网络安全是一种不同类型的...

error code: 521

A vulnerability categorized as critical has been discovered in open-webui Open WebUI up to 0.6.36. This vulnerability affects unknown code. Such manipulation leads to server-side request forgery. This vulnerability is referenced as CVE-2025-65958. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component. This entry seems to have a duplicate CVE-2026-56399 assigned.

IntroductionGovernment services are increasingly relying on SMS as a channel t

Adversa AI 公司在多个开源 AI 代理中发现了一个结构性的安全缺陷，并将其称之为“GuardFall”。

但在此次事件中，这两家公司的内部网络似乎均未被攻破。真正遭到入侵的，是这两家全球最具价值企业与其产品制造商共享机密知识产权的整套流程体系。

谷歌即日起将关闭GIF表情图库Tenor的API服务。虽然Tenor网站及其可搜索的GIF库将继续保持在线，但此前集成了该 API 的平台X、Discord、Bluesky 和 WhatsApp等，现