Aggregator

A vulnerability marked as critical has been reported in Apple macOS. This issue affects some unknown processing. The manipulation leads to improper check for unusual conditions. This vulnerability is uniquely identified as CVE-2023-41993. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is suggested to upgrade the affected component.

Идея звучит эффектно, но её реализация упрётся в физику, деньги и международную политику.

AI安全正逐渐融入网络安全

零基础学员必看！代码审计全链路实战

Teams四大漏洞威胁企业安全，攻击者可冒充高管实施欺诈。

看雪论坛作者ID：九天666

Chrome 官方博客宣布将于 2026 年 11 月 17 日发布 v155 时移除对 Extensible Stylesheet Language Transformations(XSLT) 的支持。Google 的解释是有助于改进安全，称 Firefox 和 WebKit 项目也都有类似的计划。XML 文档适合计算机读取但不适合人类阅读，XSLT 的目的就是将 XML 文档转换成其它更适合人类阅读的格式如 HTML。Chrome、Firefox、Safari 等主流浏览器都支持客户端 XSLT 渲染，但仅限于 1999 年 的 1.0 版本，而不是 2017 年最新的 3.0 版本。Google 早在 2013 年就表达了移除 XSLT 的想法，但没有付诸实施。今年的 WHATWG 会议正式将移除 XSLT 的提议加入了讨论议程。Google 开发者认为浏览器使用的 XSLT 的代码库已经老化，易受内存安全漏洞的影响，而且 XSLT 使用率非常低，每 7891 次页面加载只有一次涉及客户端 XSLT。

​小鹏的科技日，把科幻片拍成了纪录片。

Russian state-backed hacker group Sandworm has deployed multiple data-wiping malware families in attacks targeting Ukraine's education, government, and the grain sector, the country's main revenue source. [...]

State-aligned hacking groups have spent the past six months ramping up espionage, sabotage, and cybercrime campaigns across multiple regions, according to ESET’s APT Activity Report covering April through September 2025. The research highlights how operations linked to Russia, China, Iran, and North Korea have evolved in scope and technique, showing that nation-state activity remains a constant source of disruption. Attack sources (Source: ESET) Russia’s focus on Ukraine and its allies Russia-linked actors remained among the … More →

The post Russia-linked hackers intensify attacks as global APT activity shifts appeared first on Help Net Security.

Attackers can use them to inject arbitrary prompts, exfiltrate personal user information, bypass safety mechanisms, and take other malicious actions.

当攻防进入“秒读时代”

速修复

速修复

Big news from the ANY.RUN team; we’ve just been named the 2025 “Trailblazing Threat Intelligence” winner at the Top InfoSec Innovators Awards!  This recognition means a lot to us because it celebrates what we care about most: helping analysts, SOC teams, and researchers access live, actionable threat intelligence that makes a real difference in investigations […]

The post ANY.RUN Wins Trailblazing Threat Intelligence at the 2025 Top InfoSec Innovators Awards appeared first on ANY.RUN's Cybersecurity Blog.

Он 16 лет ждёт уязвимость в своём коде, но готов доверить свои серверы новому компилятору.

An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q2 2025 and Q3 2025

Google warns of “just-in-time AI” malware using LLMs to evade detection and generate malicious code on-demand