Aggregator

2026年06月16日（現地時間）、米国CISAがCISA ICS Advisory / ICS Medical Advisoryを公表しました。

快来注册体验吧~

提升医院整体运转效率。

你们有没有收到过陌生人的好友请求，看了一眼头像，觉得"这人挺正常的"，然后就通过了？几乎所有人都举手。对。

To prevent cheating, Indian authorities ordered Telegram to restrict access nationwide ahead of a major medical entrance exam.

GitHub rejected two formal vulnerability reports identifying design flaws that researchers say are enabling variants of the Shai-Hulud supply-chain worm to infect and compromise hundreds of software packages and developer accounts worldwide.

之前发了篇笔记介绍 iOS 27 链接器机制的一些更新，周末顺手写了英文版发外网了。早上看到🦞作者 Peter Steinberger 一个转发，吓一跳。虽然不知道是他本人还是 ai [旺柴] Peter 在爆红很久以前就经常能刷到他的动态，毕竟以前也是资深 iOS 开发，不是 CRUD 的那种。 做营销号嘛，反正只要关注他，天天截几个图搬回来翻来覆去的嚼，就能养个矩阵。咱可是公众号首发中文，然后才出口的。这个流量我是不能放过了。 一定要大书特书，狠狠蹭 [奸笑][奸笑]

In addition to executing entirely in memory, the malware's infection chain incorporates other anti-analysis techniques designed to evade detection.

供应链攻击已经进化到「精准投毒+凭证窃取+横向渗透」的组合拳模式。攻击者不需要零日漏洞，不需要高超的漏洞利用技术，只需要找到开源项目维护流程中的一个疏忽时刻。 最令人担忧的是攻击的复制成本极低。一旦攻击者掌握了orphan commit技术，可以批量攻击数百个开源项目。防御方需要为每个项目建立防护，而攻击方只需要找到一个薄弱环节。 如果同样的事情发生在我们公司，我们能在多长时间内完成同样的响应？我们有没有类似的自动化密钥轮换系统？我们的异常检测系统够不够灵敏？我们的应急响应预案在哪里？上次演练是什么时候？ 每个安全负责人都应该定期问问自己这些问题。答案决定了我们能否经受住下一次供应链攻击的考验。

An open letter signed by dozens of security experts asked the government to reverse export restrictions on Anthropic's Claude Fable 5 and Mythos 5 models.

At least 15 malicious plugins found on the JetBrains Marketplace were designed to steal AI API keys from developers. [...]

Some panned it, some said they needed more information, but caution figured into all of the responses.

The post Lawmakers leery about Trump administration’s Anthropic order appeared first on CyberScoop.

Fable5才发布几天，特朗普政府就要求Anthropic立即阻止包括员工在内的外国人访问。

A vulnerability marked as critical has been reported in Linux Kernel up to 6.18.16/6.19.6. The affected element is the function ncm_alloc_inst of the component f_ncm. Performing a manipulation results in null pointer dereference. This vulnerability is reported as CVE-2026-23320. The attacker must have access to the local network to execute the attack. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 7.0-rc2 and classified as critical. This affects the function bpf_trampoline_link_cgroup_shim. Executing a manipulation can lead to use after free. The identification of this vulnerability is CVE-2026-23319. The attack needs to be done within the local network. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability categorized as critical has been discovered in Linux Kernel up to 7.0-rc1. This impacts the function UAC_VERSION_2 of the component UAC3 Section. Executing a manipulation can lead to out-of-bounds read. This vulnerability is tracked as CVE-2026-23318. The attack is only possible within the local network. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 7.0-rc1. It has been classified as critical. This issue affects the function vmw_translate_ptr of the component vmwgfx. This manipulation causes uninitialized pointer. This vulnerability is handled as CVE-2026-23317. The attack can only be done within the local network. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability has been found in Linux Kernel up to 6.12.76/6.18.16/6.19.6/7.0-rc2 and classified as critical. Affected by this issue is the function fib_multipath_hash_from_keys of the component net. Performing a manipulation results in denial of service. This vulnerability was named CVE-2026-23316. The attack needs to be approached within the local network. There is no available exploit. The affected component should be upgraded.

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 7.0-rc2. Affected by this vulnerability is the function mt76_connac2_mac_write_txwi_80211 of the component wifi. Performing a manipulation results in out-of-bounds read. This vulnerability is reported as CVE-2026-23315. The attacker must have access to the local network to execute the attack. No exploit exists. It is advisable to upgrade the affected component.