Aggregator

2026白帽大会 - 破局与重构：多模态AI Agent的红蓝对抗效率革命

A vulnerability, which was classified as problematic, was found in Microsoft Edge on Android. The impacted element is an unknown function. The manipulation results in clickjacking. This vulnerability is identified as CVE-2026-33119. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

A vulnerability identified as problematic has been detected in nghttp2 up to 1.68.0. This impacts the function nghttp2_session_terminate_session of the component HTTP2 Handler. Performing a manipulation results in reachable assertion. This vulnerability is identified as CVE-2026-27135. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

A vulnerability labeled as problematic has been found in F5 NGINX Open Source and NGINX Plus. Affected by this issue is the function ngx_http_mp4_module. The manipulation results in out-of-bounds read. This vulnerability is reported as CVE-2026-32647. The attack requires a local approach. No exploit exists. The affected component should be upgraded.

A vulnerability marked as critical has been reported in F5 NGINX Open Source. This affects the function ngx_http_mp4_module. This manipulation causes integer overflow. This vulnerability appears as CVE-2026-27784. The attack requires local access. There is no available exploit. It is suggested to upgrade the affected component.

仿真内网、内网渗透、横向移动、权限维持、多层代理、evasion

Why Cyber Risk Is Now Shaped as Much by Nations as by Hackers
Wars are becoming more frequent, and are no longer only kinetic. They are just as active in the cyber world, with impacts much larger than can be imagined. This also leads to state-sponsored hacktivists targeting the critical infrastructure of nations.

Veteran Hardware Hacker's Chip Facilitates More Trustworthy and Secure Devices
How can we trust hardware to not betray us? Enter the Baochip-1x, a piece of largely open-source silicon created by Andrew "Bunnie" Huang, which he said is designed to give developers an affordable, security-focused and attestable chip, not least for building high-assurance, embedded devices.

European Governments Grow Suspicious of Silicon Valley
French abandonment of American software for open-source alternatives continues apace, with all government ministries now facing a fall deadline for outlining plans to reduce their dependence on U.S. tech. France must "regain control of our digital destiny," said public action minister David Amiel.

Patients Allege Health Entities Did Not Get Consent to Record Conversations
Proposed federal class action litigation alleges that two California healthcare organizations violated patient privacy in their use of an AI-enabled ambient tool that records, transcribes, and processes sensitive conversations between clinicians and patients without individuals' consent.

Ex-Microsoft CIO: Mythos Could Surface Known Flaws Faster Than Vendors Can Fix Them
Former Microsoft CIO Jim DuBois and IDC's Frank Dickson say Claude Mythos Preview could rapidly surface long-known but unfixed software flaws at scale, forcing vendors and enterprises to strengthen patch validation, orchestration and deployment before attackers exploit the backlog.

Rockstar Games has confirmed a data breach after the notorious hacking group ShinyHunters exploited a third-party integration to access the company’s internal Snowflake data warehouse, ultimately leaking over 78.6 million records on April 14, 2026. The breach did not stem from a direct attack on Rockstar’s infrastructure. Instead, ShinyHunters leveraged Anodot, an AI-powered cloud cost […]

The post Rockstar’s GTA Game Hacked – Attackers published 78.6 Million Records Online appeared first on Cyber Security News.

前言这个漏洞是英国 MDSecLabs 的 Filip Dragovic 发现的，据作者讲述，这个漏洞由于很巧妙，它们在红队评估中从2025年1月就开始使用，直到2026年2月报告给微软后，才在3月的补丁星期二修复，这么看也用够本了，原文只是讲了漏洞的核心部分，本文会讲清楚这个漏洞涉及的概念、如何形成的，如何利用它原文地址：https://www.mdsec.co.uk/2026/03/rip-r

好的，我现在需要帮用户总结一篇文章的内容，控制在100字以内。首先，我得仔细阅读文章，理解主要信息。 文章讲的是微软正在研究将OpenClaw集成到Microsoft 365中，目的是让Copilot能够自主运行任务。目前Copilot只能通过用户的指令来操作，缺乏自主性。而OpenClaw可以全天候运行，比如监控邮箱、生成待办事项、智能日程安排等。此外，OpenClaw还能帮助销售自动联系客户和收集反馈。 不过，文章也提到OpenClaw权限高带来的安全风险。微软计划推出更安全的版本，定制权限以降低风险。最终目标是提升Copilot在企业级市场的竞争力。 现在，我需要把这些要点浓缩到100字以内。要涵盖微软的研究、集成的目的、当前Copilot的限制、OpenClaw的功能以及安全措施和目标。 可能的结构是：微软计划将OpenClaw集成到365中，赋予Copilot自主能力，如监控邮箱、安排日程等。同时解决安全问题，并提升竞争力。 检查一下字数是否在限制内，并确保内容准确传达关键信息。 微软计划将开源项目 OpenClaw 集成到 Microsoft 365 中，赋予 Copilot 自主运行能力，如监控邮箱、生成待办事项和智能日程安排等。为降低高权限带来的安全风险，微软将推出定制权限版本，并提升 Copilot 在企业级市场的竞争力。

嗯，用户让我用中文帮他总结一下这篇文章的内容，控制在100字以内，而且不需要用“文章内容总结”或者“这篇文章”这样的开头。直接写描述就行。 首先，我需要通读整篇文章，抓住主要信息。文章提到东芝的REGZA之后，索尼也退出了蓝光设备的生产。现在只剩下松下和夏松作为供应商。索尼已经停止出货BD录像机，而这些设备是保存电视节目的主要手段。 然后，文章提到一些粉丝群体对此表示担忧。比如一位30多岁的女性公司职员，她喜欢把偶像节目剪辑后刻录到BD上保存。她会把各种节目内容像拼图一样组合，尽量压缩到一张光盘里。 接下来，我需要把这些信息浓缩到100字以内。重点包括：索尼退出蓝光生产，只剩下松下和夏普；BD录像机是保存节目的主要手段；粉丝群体担忧影响他们的使用习惯。 最后，组织语言，确保简洁明了。避免使用复杂的句子结构，直接点明关键点。 索尼退出蓝光设备生产,仅剩松下和夏普供应BD录像机,追星群体担忧影响节目保存方式。

嗯，用户让我用中文总结一篇文章，控制在100字以内，而且不需要特定的开头。首先，我需要仔细阅读用户提供的文章内容。看起来这篇文章是关于ISC Stormcast的播客，日期是2026年4月14日，标题是“Handler on Duty: Xavier Mertens”，威胁级别是绿色。还有提到Johannes在SANS的教学课程链接。 接下来，我需要提取关键信息：播客名称、日期、主持人、威胁级别以及相关课程链接。然后，把这些信息浓缩成一段简短的文字，不超过100字。要注意语言简洁明了，不使用复杂的结构。 可能会遇到的问题是如何在有限的字数内涵盖所有重要点。可能需要省略一些次要信息，比如联系方式或工具部分。确保总结准确传达文章的核心内容。 最后，检查字数是否符合要求，并确保没有使用任何禁止的开头语句。 ISC Stormcast播客于2026年4月14日发布，主持人Xavier Mertens值班期间讨论了网络安全相关话题，当前威胁级别为绿色。

嗯，用户让我总结一下文章内容，控制在一百字以内，而且不需要用“文章内容总结”之类的开头。直接写描述就行。那我先看看用户给的文章内容是什么。 文章标题是“环境异常”，内容提到当前环境异常，完成验证后可以继续访问，并有一个“去验证”的链接。看起来这是一个提示用户需要进行验证的页面，可能是由于安全原因或者系统检测到异常活动。 接下来，我需要把这些信息浓缩成一句话，不超过一百字。要抓住关键点：环境异常、需要验证、继续访问。所以可能的表达是：“当前环境异常，需完成验证后方可继续访问。” 检查一下是否符合要求：没有使用特定的开头，直接描述了情况，控制在一百字以内。看起来没问题。 当前环境异常，需完成验证后方可继续访问。

📝 编者语最近有学员在面试中被问到了JS相关的知识，刚好我这里有一篇单点漏洞挖掘记录。我们不看结果，只看过程

一名国家安全局分析师利用第702条监视权，对其在约会应用程序上结识的女友进行监视。