Aggregator

2026 年 10 月 21 日，#PHP 8.5.12 等版本紧急修复两个 CVSS 9.2 的未认证 RCE。本文从当晚半个互联网的停服现场说起，拆解 CVE-2026-109618 / 109619 的三条利用路径、可复用攻击原语，以及 9bie 在官方默认配置上跑通的纯 HTTP 武器化链，兼谈修复与检测。

Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At […]

A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's access rules permit to connect to the target. The findings were

Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. "In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor

Name: cruXipher 2026 - ATMoS '26, BITS Hyderabad (an cruXipher event.)
Date: Oct. 23, 2026, 12:30 a.m. — 25 Oct. 2026, 00:30 UTC  [add to calendar]
Format: Jeopardy
On-line
Offical URL: https://cruxipher.crux-bphc.com/
Rating weight: 0
Event organizers: CRUx BPHC

Name: HITCON CTF 2026 (an HITCON CTF event.)
Date: Oct. 23, 2026, 2 p.m. — 25 Oct. 2026, 14:00 UTC  [add to calendar]
Format: Jeopardy
On-line
Offical URL: https://ctf2026.hitcon.org/
Rating weight: 91.16
Event organizers: HITCON

Name: RSTCON 2026 CTF (an RSTCON CTF event.)
Date: Oct. 23, 2026, 5 p.m. — 25 Oct. 2026, 17:00 UTC  [add to calendar]
Format: Jeopardy
On-line
Offical URL: https://ctf.rstcon.org/
Rating weight: 25.00
Event organizers: RSTCON

Name: Cryovault 2026 Finals (an ISFCR PESU CTF event.)
Date: Oct. 24, 2026, 3:30 a.m. — 25 Oct. 2026, 06:30 UTC  [add to calendar]
Format: Jeopardy
On-site
Location: Bengaluru, India
Offical URL: https://isfcrpesu.ctfd.io/
Rating weight: 0.00
Event organizers: x6e.x65.x78.x75.x73

Name: H7CTF 2026 Finals (an H7CTF event.)
Date: Oct. 24, 2026, 6:30 a.m. — 25 Oct. 2026, 06:30 UTC  [add to calendar]
Format: Attack-Defense
On-site
Location: Chennai, Tamil Nadu
Offical URL: https://2026.h7tex.com/
Rating weight: 0
Event organizers: H7Tex

Name: BSides Peoria CTF 2026 (an BSides Peoria CTF event.)
Date: Oct. 24, 2026, 2:45 p.m. — 24 Oct. 2026, 20:45 UTC  [add to calendar]
Format: Jeopardy
On-site
Location: Peoria, Illinois, USA
Offical URL: https://bsidespeoriac.tf/
Rating weight: 0
Event organizers: BSides Peoria CTF Village

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Auditing the auditor: Unmasking Apex Accelerator GhostAction Attack Escalates By Targeting GitHub Users       Plex vulnerabilities being exploited in the wild to drop a cryptominer   WordPress Rank Math SEO PRO Plugin 3.0.123 is vulnerable […]

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Capcom Data Breach Exposes 11.7 Million Email Addresses U.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known […]

自古以来，人类就从抚摸狗中获得慰藉。大量研究承认养宠物对福祉的益处，但驱动这些益处的机制仍不清楚。在一项研究中，研究人员邀请了 64 名狗主人及其宠物来到实验室，研究抚摸狗是否能帮助人们更好地应对压力，以及身体接触是否是这种对大脑和身体产生影响的关键。研究人员设计了实验，以分离触摸狗如何影响人在压力期间和之后的大脑、心脏和情绪状态。51 名女性和 13 名男性，平均年龄 34 岁，带着自己的宠物狗参加了研究。狗必须至少 2 岁、健康，并在新环境中感到舒适。团队追踪了参与者的大脑活动，并使用心电图监测测试前、测试中和测试后的心脏活动。他们还询问参与者在关键时间点的感受，从平静到兴奋、从负面到正面、从失控到掌控。研究人员最初预测，在高压力任务后立即抚摸狗会帮助身体恢复，但身体触摸没有提供即时恢复优势。无论参与者抚摸狗还是不触摸狗坐在狗附近，脑波模式和心率指标都以相似速度恢复到静息水平。然而，在压力任务后的五分钟休息期间抚摸狗，在参与者再次面对压力时产生了差异。当参与者后来面对第二项压力任务时，他们的身体表现出弱得多的压力反应。这在脑记录中很明显，显示在参与者触摸狗后，α 波活动在整个第二实验区组中保持更高，表明大脑激活减少。在第一区组中没有触摸狗而恢复的参与者没有表现出类似效果。

48小时27起史诗级安全事件：PHP漏洞细节泄露150万主机裸奔、Claude+Grok攻击拉美400家银行、华尔街拦截第三方AI智能体

数世咨询9月月报：暗网在售2亿条中国快递数据、2.9亿条支付数据，以色列国防部、美国国家实验室、FBI数据均现身

安克创新、NIKE、盒马等企业微信账号集体发布涉黄链接，官方确认第三方外挂软件服务被攻破，受影响账号已强制下线