Posts of last few hours
STT_GNU_IFUNC 的 resolver 是动态链接器在重定位期主动调用的用户代码:它比 main 早,比一切构造函数早,是 ELF 规范里“留了门”的加载期执行点。
任何“加载器在 main 之前调用的回调点”都是加载期代码执行的支点,IFUNC 是最早的那一个,而它的执行时机由绑定模式决定。
https://xz.aliyun.com/news/92771
本文分析并复现了 JeecgBoot 低代码平台（≤ 3.9.3）的未授权权限绕过与 SQL 注入组合漏洞。攻击链由三个缺陷叠加而成：其一，Shiro 过滤链中 /**/*.js 等静态资源后缀匿名放行规则与 Spring MVC 路由解析存在差异，攻击者在 /sys/dict/getDictItems/* 接口后附加 .js 即可绕过 JWT 认证，匿名访问敏感数据接口；其二，字典查询四段式编码
https://xz.aliyun.com/news/92753
一次攻防对抗项目中对某医院 HIS 系统的渗透，目标是验证登录用户权限边界并扩大战果。整个链路走下来很有意思：看似处处有鉴权，实则令牌签名可逆向，最终用一个低权限账号拿到了全量用户数据。
https://xz.aliyun.com/news/92669
本文是CVE-2023-4450的延伸，主要叙述从"回顾 FreeMarker 攻防史"到"利用暴露对象结合 Aviator 表达式进行 FreeMarker 沙箱逃逸"，以及AI时代下漏洞挖掘的应用。
https://xz.aliyun.com/news/92754
很多 open redirect 漏洞第一次看都不太“吓人”。它既不是 RCE，也不会像 SQL 注入那样一眼就让人绷紧神经
https://xz.aliyun.com/news/92756
本文通过拆解六款智能渗透 Agent 的源码与真实执行链路，分析它们在状态管理、上下文控制、工具调用和证据约束上的工程设计与取舍。
https://xz.aliyun.com/news/92778
这类漏洞的攻击价值不在代码执行，而在于用一个看起来并不大的 form 请求，把目标服务拖进高内存占用、长时间 GC，甚至直接 OOM 退出的状态。
https://xz.aliyun.com/news/92757
把确定性留给系统，把不确定性交给模型。
https://xz.aliyun.com/news/92758
Submit #897250 / VDB-399350
https://vuldb.com/submit/897250
Submit #897249 / VDB-399349
https://vuldb.com/submit/897249
本文记录 Hack The Box Zero 靶机的完整渗透过程。目标仅开放 SSH 与 HTTP 服务，初始突破口来自一个支持 SFTP 上传的静态主页系统。通过注册获取 SFTP 凭据后，利用可覆盖的 .htaccess 配置 Apache ErrorDocument 404，实现任意文件读取，并从 Web 源码中泄露数据库凭据，成功拿到普通用户 Shell。随后通过 pspy 捕获 root
https://xz.aliyun.com/news/92665
A vulnerability marked as problematic has been reported in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper authorization.
This vulnerability is uniquely identified as CVE-2026-86212. The attack is possible to be carried out remotely. Moreover, an exploit is present.
To fix this issue, it is recommended to deploy a patch.
https://vuldb.com/vuln/399348
Submit #896623 / VDB-399348
https://vuldb.com/submit/896623
LLM Agent 走进生产环境后，安全工程师面对的最棘手问题不是"模型会不会被骗"，而是三类结构性失范——偷懒、越权、失忆。我们团队在自研数仓 Agent 平台的过程中，设计落地了一套框架层护栏架构，用确定性代码把危险路径在框架层物理封死。本文从我们自己的研发实践出发，论证为什么 prompt 构不成安全边界，并逐层拆解这套护栏方案：读写两侧 offload、HITL 门禁、上下文联动闭环。
我
https://xz.aliyun.com/news/92655
A vulnerability labeled as critical has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the component Login. Executing a manipulation of the argument username/password can lead to sql injection.
This vulnerability is handled as CVE-2026-86211. The attack can be executed remotely. Additionally, an exploit exists.
https://vuldb.com/vuln/399347
本文基于公开的学术研究成果（arXiv:2608.09867，Stealing Reasoning Traces from Proprietary LLM APIs）与笔者对 OpenAI / Anthropic / Google 三家厂商推理模型的协议层分析，拆解"加密推理块（Encrypted Reasoning Blob）"这一新型攻击面。文章还原了跨会话、跨模型重放攻击的完整技术链路，同时
https://xz.aliyun.com/news/92694
`CVE-2026-73653` 的核心不是单个路径遍历点，而是 Vitest Browser Mode 里多条 `browser -> RPC -> provider -> filesystem` 链路同时缺失统一的权限检查。
https://xz.aliyun.com/news/92704
当文件名沦为能力路由器：CFITSIO因I/O副作用优先于校验且无回滚，致使攻击者串联功能达成文件复制、SSRF与敏感外传。
https://xz.aliyun.com/news/92692
Attackers are exploiting two new PaperCut flaws to steal credentials and gain privileged access in education-sector attacks across the U.S. and Europe. Attackers are exploiting two recelty disclosed PaperCut flaws, CVE-2026-81578 and CVE-2026-82078, in attacks targeting schools and other education organizations in the U.S. and Europe, as reported by TheHackerNews. Arctic Wolf researchers observed threat […]
https://securityaffairs.com/198476/hacking/papercut-flaws-exploited-in-attacks-on-u-s-and-european-schools.html
Latest Blog Posts
- 1 week 6 days ago
- 2 months 2 weeks ago
- 2 months 2 weeks ago
- 2 months 2 weeks ago
- 2 months 2 weeks ago
- 7 months 1 week ago
- 1 year ago
- 1 year ago
- 1 year 1 month ago
- 1 year 5 months ago