Aggregator

360发布《2026攻防演练必修漏洞清单》

The Office of the Maine Attorney General has suspended its breach reporting portal

A phishing kit subverting Microsoft’s legitimate authentication flow lets attackers break into accounts without stealing passwords or creating fake login pages

上周关注度较高的产品安全漏洞(20260608-20260614)

国家信息安全漏洞共享平台（以下简称CNVD）本周共收集、整理信息安全漏洞582个，其中高危漏洞307个、中危漏洞215个、低危漏洞60个。

Один спорный отказ поставил под вопрос всю логику вознаграждения за поиск уязвимостей.

中国高校正在大规模课程重组，撤掉了数千个“过时”专业，转而开设以科技为导向的新兴专业。这场教育改革正值中国力争成为众多高科技未来产业的全球领导者，解决严重的毕业生就业危机之际。这场危机已导致数百万年轻人难以找到工作。根据新华社援引教育部的数据，2021-2025 年间，中国高校撤销或暂停了 12200 个本科专业，同时新增了 10200 个专业，意味着逾三成的高校课程进行了调整。

Attackers compromised Awesome Motive CDN files, backdooring WordPress sites running OptinMonster, TrustPulse, and PushEngage. Sansec researchers discovered an active supply chain attack hitting WordPress sites running OptinMonster, TrustPulse, and PushEngage, three plugins operated by Awesome Motive, one of the largest WordPress plugin companies in the world. The malicious JavaScript wasn’t sitting on any victim’s server. […]

黄金是少数几乎不会被氧化的金属之一，但黄金的纳米粒子却能充当催化剂。根据发表在《Physical Review Letters》期刊上的一项研究，科学家指出黄金的惰性并非源于原子本身，而是源于黄金晶体形成的表面。黄金会形成晶体。如果沿着不同的原子平面切割晶体，会得到不同的表面排列。在黄金中，部分平面呈正方晶格，部分平面呈六方晶格。研究人员测试了不同黄金晶体表面对氧分子的吸附能力。结果显示，最常见的六方晶格黄金晶体对氧的吸附力较弱，而正方晶格则很容易吸附氧分子，能促使其发生形变至分裂，在这种情况下黄金被氧化了。

Внутри компании накопилось раздражение, которое уже не получилось спрятать за красивыми обещаниями.

Снаружи — красивый экран, внутри — тихая фабрика трафика.

A vulnerability marked as problematic has been reported in Envoy. The affected element is an unknown function of the component HPACK Compression Handler. The manipulation leads to denial of service. This vulnerability is documented as CVE-2026-47774. The attack can be initiated remotely. There is not any exploit available.

A vulnerability labeled as critical has been found in Softaculous Page Builder Plugin up to 2.0.9 on WordPress. Impacted is an unknown function. Executing a manipulation can lead to incorrect authorization. This vulnerability is registered as CVE-2026-2470. It is possible to launch the attack remotely. No exploit is available.

The Gentlemen ransomware used infostealer credentials, AI tools, and affiliates to hit 483 victims across 66 countries in under a year. The Gentlemen surfaced as a ransomware operation in September 2025 and by June 13, 2026 had listed 483 victims on their dark-web leak site, 380 of them in 2026 alone. That makes them the […]

За кулисами всплыла версия, о которой никто ещё не высказывался публично.