Aggregator

Как эксплойт Coruna превратился в главную загадку кибербезопасности.

Malicious insiders are using misusing AI for nefarious gain, while employees cutting corners also creates risk, warns Mimecast

恶意LLM对话式AI诱使用户泄露个人信息 by 花菜

更多最新文章，请访问SecWiki

在太阳系中，木星是无可争议的行星之王，但在银河系的其它角落，存在着体型比木星还更大的超级木星。发表在《自然天文学》期刊的一项研究利用韦伯太空望远镜观测了距离地球约 130 光年外的 HR 8799 星系。该星系有四颗质量高达木星 5-10 倍的巨型气态行星，它们与母恒星的距离远达 15-70 个天文单位，这在传统行星形成理论中几乎是难以解释的地带。天文学界对于巨大天体的诞生通常有两套剧本：一种是如同木星般由岩石核心缓慢吸积尘埃与气体的「由下而上」模式；另一种则是像恒星一样，由气体云直接因引力坍缩而成的「由上而下」模式。由于 HR 8799 的行星位于物质稀薄的星盘边缘，过去许多专家认为，这些远在天边的巨兽应该是透过引力塌缩直接形成的，因为在那个距离下，传统的核心吸积速度太慢，根本来不及在气体盘消散前拼凑出如此庞大的行星。研究团队利用韦伯望远镜的近红外线光谱仪寻找大气中的「硫」。在行星形成的初期，硫通常被锁在固体的岩石或冰粒中，因此如果在行星大气中发现大量的硫，就代表这颗行星在成长过程中曾经吞噬过大量的固体物质，这强烈暗示它走的是核心吸积路线。研究结果令人惊讶，团队在内侧三颗行星中都发现了硫化氢的踪迹，证实这些质量高达木星 10 倍的巨型行星，其形成方式与木星非常相似，也就是由下而上的核心吸积法。这项发挑战了现有的行星演化模型。

天文学家去年报告发现了已知第三颗星际天体，前两颗分别是 'Oumuamua、彗星 2I/Borisov，第三颗 3I/ATLAS 也属于星际彗星。3I/ATLAS 目前正在太阳系内飞行，根据发表在《The Astronomical Journal》期刊上的一项研究，中科院上海天文台等研究团队模拟分析了彗星 3I/ATLAS 与太阳系内天体碰撞的概率。3I/ATLAS 的轨道倾角约为175°，这意味着其运行方向与太阳系内大部分天体近乎相反。它的近日点距离仅约 1.36 天文单位，相当于其将“逆流而行”穿越内太阳系天体密集区域。这一独特的轨道特征引发了它与数以万计的小行星相遇时发生碰撞的可能性有多大的疑问。研究团队的结论是：在它“逆行穿越”内太阳系期间，共有 31 颗近地小行星和 736 颗主带小行星，会与其物理距离缩小至 0.03 个天文单位（约 450 万公里）以内。其中彗星 3I/ATLAS 核心与小行星 2020 BG107 的发生撞击的概率约为 0.025%，小行星进入彗发范围内的概率则高达 2.7%。

大模型的出现确实改变了我们获取信息的方式，无论是写代码还是日常办公，这些模型展现出的推理能力让人惊艳。但随着使用场景越来越广，大家发现了一个非常头疼的问题，那就是模型经常会一本正经地胡说八道。在技术圈，我们把这种现象称为幻觉。简单来说，就是模型生成的内容听起来逻辑通顺、语气笃定，但实际上内容却是凭空捏造的。

2026 年，AI Agent（智能体）的自主决策能力正成为内网权限控制的新黑洞。本文深入剖析了 Agent 核心架构 ReAct 中的逻辑缺陷，揭示了 LLM 作为“混淆代理”如何被自然语言指令劫持。文章重点展示了针对 PythonREPLTool 的攻击路径，通过本地复现演示了从 Prompt 注入到获取 Root 权限反弹 Shell 的完整 RCE 过程。同时，本文还探讨了多智能体（Mul

Атомная станция будущего отправить угольную электростанцию на свалку истории.

The vendor said it’s not aware of any active exploitation of the vulnerabilities, which could allow remote attackers to achieve root access and execute code.

The post Cisco reveals 2 max-severity defects in firewall management software appeared first on CyberScoop.

思科警告两个 Catalyst SD-WAN Manager 漏洞正被活跃利用，敦促管理员尽快打上补丁堵上漏洞。Catalyst SD-WAN Manager 前称 vManage，允许系统管理员集中监控和管理最多 6,000 台 Catalyst SD-WAN 设备。思科称，它的安全响应团队发现 CVE-2026-20128 和 CVE-2026-20122 漏洞正被活跃利用。CVE-2026-20122 是一个任意文件覆盖漏洞，能被拥有有效只读凭据和 API 访问权限的远程攻击者利用，属于高危漏洞；CVE-2026-20128 只能被本地攻击者利用，威胁等级中等。

Cisco has disclosed that two more vulnerabilities affecting Catalyst SD-WAN Manager (formerly SD-WAN vManage) have come under active exploitation in the wild. The vulnerabilities in question are listed below - CVE-2026-20122 (CVSS score: 7.1) - An arbitrary file overwrite vulnerability that could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system.

Most organizations assume encrypted data is safe. But many attackers are already preparing for a future where today’s encryption can be broken. Instead of trying to decrypt information now, they are collecting encrypted data and storing it so it can be decrypted later using quantum computers. This tactic—known as “harvest now, decrypt later”—means sensitive data transmitted today could become

美国海关和边境保护局（CBP）通过商业采购方式，从在线广告生态系统中获取广告标识符（AdID）关联的用户精准位

Fideo Intelligence announced an expansion of its dark web monitoring and threat intelligence capabilities to help financial institutions, fintech companies, payment service providers (PSPs), and merchants detect fraud earlier and reduce payment risk. As payment credentials, identity data, and fraud tactics spread across hidden forums and encrypted channels, organizations face rising pressure to detect compromise before it reaches a transaction. Fideo’s expanded dark web monitoring and fraud intelligence surfaces early signs of synthetic identities, account … More →

The post Fideo Intelligence enhances dark web monitoring capabilities to reduce payment fraud appeared first on Help Net Security.

A vulnerability categorized as critical has been discovered in Gen Digital Avira Internet Security up to 1.1.109.1990. Affected by this issue is some unknown functionality of the component Optimizer. Such manipulation leads to time-of-check time-of-use. This vulnerability is documented as CVE-2026-27750. The attack needs to be performed locally. There is not any exploit available.

A vulnerability was found in Gen Digital Avira Internet Security up to 1.1.109.1990. It has been rated as critical. Affected by this vulnerability is an unknown functionality of the file Avira.SystemSpeedup.RealTimeOptimizer.exe of the component System Speedup Component. This manipulation causes deserialization. This vulnerability is registered as CVE-2026-27749. The attack needs to be launched locally. No exploit is available. Upgrading the affected component is advised.

A vulnerability was found in Gen Digital Avira Internet Security up to 1.1.109.1990. It has been declared as critical. Affected is an unknown function of the component Software Updater. The manipulation results in link following. This vulnerability is cataloged as CVE-2026-27748. The attack must be initiated from a local position. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in rustdesk-server-pro RustDesk Server Pro up to 1.7.5. It has been classified as problematic. This impacts an unknown function. The manipulation leads to risky cryptographic algorithm. This vulnerability is listed as CVE-2026-3598. The attack may be initiated remotely. There is no available exploit.

Пособие для тех, кто привык доверять заводским настройкам.