Aggregator

2025年国家网络安全宣传周成都系列活动开幕，以“网络安全为人民”为主题，由多部门联合举办，包括开幕式、交流体验活动、成果展等。CCS2025技术交流活动启动，聚焦AI与网络安全融合创新，并设港澳蓉交流板块。虚拟领航员“小智”升级主持，青少年网络安全素养教育创新升级，《教育大纲》发布并试点。三大展区展示成都“十四五”成果及前沿应用。

A vulnerability, which was classified as problematic, has been found in Apple iOS and iPadOS. This impacts an unknown function of the component Web Handler. This manipulation causes open redirect. This vulnerability is tracked as CVE-2025-31254. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in Apple Safari. Affected is an unknown function of the component Web Handler. Such manipulation leads to open redirect. This vulnerability is listed as CVE-2025-31254. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

A vulnerability marked as critical has been reported in Apple Xcode. This vulnerability affects unknown code. This manipulation causes sandbox issue. The identification of this vulnerability is CVE-2025-43371. The attack can only be executed locally. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability was found in Apple Xcode. It has been classified as critical. This affects an unknown part of the component App. Performing manipulation results in sandbox issue. This vulnerability is known as CVE-2025-43263. Attacking locally is a requirement. No exploit is available. Upgrading the affected component is recommended.

A vulnerability was found in Apple Xcode and classified as critical. The impacted element is an unknown function of the component Path Handler. The manipulation results in path traversal. This vulnerability is reported as CVE-2025-43370. The attacker must have access to the local network to execute the attack. No exploit exists. It is suggested to upgrade the affected component.

Как университет без кафедры математики стал №1 по математике?

少数派 Matrix 社区重启周报，分享派友热议的开机工具列表及用途，并呈现投稿内容如老罗专属泡面评测与Belkin充电底座体验。

Apple Music 推出官方音乐迁移工具，支持从 Spotify、Tidal、SoundCloud 等平台转移音乐和歌单至 Apple Music，在全球范围内可用（中国大陆、缅甸和俄罗斯除外）。

微软宣布从10月起，在欧盟经济区外的Microsoft 365应用将强制安装Copilot Chat功能。Word、Excel等五款办公软件将新增该侧边栏工具，用户可免费使用基本功能或付费解锁高级功能。企业可通过IT管理员在Apps Admin Center中关闭此功能。

微软宣布从 10 月份起，在欧盟经济区（EEA）外的 Microsoft 365 应用将强制安装 Copilot Chat。Word、 Excel、PowerPoint、Outlook 和 OneNote 都将更新包含 Copilot Chat 侧边栏。用户利用 Copilot Chat 可以起草文档、分析电子表格和制作幻灯片。该功能可以免费使用，Copilot 的付费用户则可以访问更高级的功能如对工作数据进行推理、支持上传文件和生成图像，以及使用最新模型如 GPT-5。如果企业不想要该功能，IT 管理员可以在 Apps Admin Center 中修改设置退出 Copilot Chat，方法是 Customization > Device Configuration > Modern App Settings，选择 Microsoft 365 Copilot app，移除 Enable 的勾选框。

大模型安全不仅关乎技术本身，更关乎社会稳定、个人隐私和国家安全。从数据泄露、模型投毒到对抗样本攻击，再到模型部署后的安全漏洞，大模型在其全生命周期中面临着多方面的安全挑战

最近出现以分享文档为主题的恶意活动,通过伪装微软Outlook页面诱导用户提供邮箱并下载恶意MSI文件安装PDQConnect工具。攻击主要针对意大利公共行政机构,利用免费邮箱或已入侵账户注册远程管理服务,并在试用期后迅速更换账户继续活动。相关指示器已共享。

GitHub is adding post-quantum cryptography to secure SSH connections, a move that signals the company’s preparation for a time when current encryption may no longer be safe. What GitHub is changing GitHub has introduced a new type of SSH key that combines both a traditional algorithm and a post-quantum algorithm. This approach is called a hybrid key. It works with existing systems while adding protection against future quantum attacks. “We’re adding a new post-quantum secure … More →

The post GitHub adds post-quantum protection for SSH access appeared first on Help Net Security.

The cybercrime group, named after Japanese ghosts but believed to be from Morocco, uses a modified version of the Prince-Ransomware binary that includes a flaw allowing for partial data recovery. However, an extortion threat remains.

ANY.RUN与Palo Alto Networks Cortex XSOAR集成，通过自动化沙盒分析和威胁情报关联帮助SOC快速识别高风险攻击，减少警报疲劳并提升检测率。该解决方案提供交互式沙盒、威胁情报查找和实时数据源功能，助力组织更高效地应对恶意软件和网络威胁。

An insider data breach at FinWise may have impacted 689,000 customers

Swamped by incident alerts, Security Operations Centers (SOCs) struggle to quickly identify and prioritize high-risk attacks, leaving critical infrastructure exposed to ransomware and data theft. ANY.RUN’s integration with Palo Alto Networks Cortex XSOAR solves this by automating proactive sandbox analysis and threat intelligence correlation to beat alert fatigue, boost detection rates, and accelerate security workflows.  […]

The post ANY.RUN & Palo Alto Networks Cortex XSOAR: Streamline SOC Workflows for Top Performance  appeared first on ANY.RUN's Cybersecurity Blog.

Стали известны страны-клиенты, которым Китай тайно экспортирует цифровой ГУЛАГ.