Aggregator

决赛一共有3个题目有解， 一个misc，两个逆向 ，misc考的是流量分析，逆向考的是 安卓native逆向，和 exe逆向 这个题目全场12解，也是感受到了CTF 线上和线下的巨大差异，在AI时代，线上貌似谁都可以成为全栈，大家都很浮躁，静下心来学东西的人变少了，线下一脱离ai，就原型毕露了 (当然也包括我)，还是想要劝勉一下自己，希望自己不要浮躁，踏实求学

面向移动安全分析场景的 6 阶段总控 Skill。用于统一调度 APK 静态侦察、流量与代码对齐、SO/JNI 深度分析、加密与漏洞综合分析、验证设计与报告交付流程。

Slopsquatting——由 slop（对 AI 低质量输出的俗称）和 squatting（域名/包名抢注）组合而成。大语言模型（LLM）在生成代码时会「幻觉」出实际不存在的第三方包名，而攻击者只需提前在 PyPI、npm 等公共包仓库中注册这些幻觉名称，植入恶意载荷，然后静待开发者按照 AI 的建议执行 pip install。

AI代码审计工作流实现-从想法到实现自动化日入CVE50+、CNVD若干

最近ActiveMQ出了两个有关Jolokia的新漏洞，之前都没看过ActiveMQ，借此机会分析一下，顺带把之前的几个重点漏洞也简单分析一遍。

一种全新的AI Agent攻击方式（或许也不那么新）

本文深入剖析了一类由安全工具隔离机制引发的非典型特权提升漏洞。文章以 ClamAV 的 clamscan --move 参数为切入点，通过对比 /tmp (tmpfs 独立分区) 与 /home (根分区同设备) 两个不同路径下的文件移动行为，揭示了 Linux 内核系统调用 rename() 在跨分区场景下的 Fallback（降级）机制。

类属性污染实现全局权限提升、__globals__ 劫持覆盖 Flask SECRET_KEY 实现会话伪造、以及全局变量篡改实现 RCE。

通过构造恶意的中转站来劫持 opencode，claudecode，openclaw 从而实现命令执行，乃至于上线 c2

记得以前做渗透，信息收集要开一堆工具，漏洞利用要自己找 POC，报告写完一天没了。 最近写了一个 CLI 工具 VulnClaw，把这个流程串起来了： 自然语言输入 → AI 理解意图 → MCP 工具链 → 全自动渗透 → 自动出报告。 GitHub 开源，MIT 协议，欢迎试用。

靶标介绍： Brute4Road是一套难度为中等的靶场环境，完成该挑战可以帮助玩家了解内网渗透中的代理转发、内网扫描、信息收集、特权提升以及横向移动技术方法，加强对域环境核心认证机制的理解，以及掌握域环境渗透中一些有趣的技术要点。该靶场共有4个flag，分布于不同的靶机。

当我们在终端里工作时，大量操作本质上是多轮交互的过程——SSH 登录服务器需要先输入密码，再执行命令；Python REPL 中逐行调试代码，每一步都依赖上一步的结果；交互式安装程序不时弹出 [Y/n] 提示等待回应。这些场景对人类来说稀松平常，但对于 AI Agent 而言却是一道难题：它们原生只能执行一次性命令，运行完毕立刻返回结果，无法在多个对话轮次中持续地读写同一个进程。 intera

钓鱼网站利用AI生成逼真页面、仿冒官方域名排名，诱导用户下载携带恶意载荷的“WinRAR安装包”。

ShinyHunters leaked 234 GB of data allegedly stolen from DentaQuest after failed negotiations, potentially impacting 2.6 million people. The ShinyHunters extortion group has published a 234 GB archive of data allegedly stolen from dental benefits administrator DentaQuest. The cybercrime gang added the company to its Tor data leak site in May, and the data was […]

Новый магнитный материал помог сделать двигатель компактнее, легче и устойчивее к высоким нагрузкам.

A vulnerability identified as critical has been detected in webfactory Advanced Google reCAPTCHA Plugin up to 5.38 on WordPress. This impacts the function ajax_run_tool of the component AJAX Handler. The manipulation leads to authentication bypass using alternate channel. This vulnerability is listed as CVE-2026-5415. The attack may be initiated remotely. There is no available exploit.

A vulnerability labeled as critical has been found in Hippoo Mobile App for WooCommerce Plugin up to 1.9.4 on WordPress. Affected is the function HippooPermissions::get_user_permissions of the file /wc-hippoo/v1/ext of the component REST Endpoint. The manipulation results in improper authorization. This vulnerability is cataloged as CVE-2026-10580. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability classified as problematic was found in ThimPress LearnPress Plugin up to 4.3.6 on WordPress. Affected by this issue is some unknown functionality of the file /wp-json/lp/v1/courses/archive-course. Executing a manipulation of the argument return_type can lead to missing authorization. This vulnerability is registered as CVE-2026-8502. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

A vulnerability classified as problematic has been found in wpdevteam Essential Addons for Elementor Plugin up to 6.6.4 on WordPress. Affected by this vulnerability is the function ajax_load_more of the component Elementor Template Handler. Performing a manipulation results in authorization bypass. This vulnerability is cataloged as CVE-2026-7665. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.