Aggregator

Кто победит в номинации “фейл года”?

科学家几十年以来一直认为地球最丰富的浮游植物原绿球藻（Prochloroccoccus）会受益于暖化的全球环境，然而根据发表在《Nature Microbiology》期刊上的一项研究，海洋暖化会危及原绿球藻的生存，作为全球食物网的关键物种，它的数量如果减少将会产生巨大影响。原绿球藻非常小（0.6 微米），属于光合超微型浮游植物，是地球最丰富的光合生物，是海洋主要的初级生产者，通过光合作用产生了地球约五分之一的氧气。它们将阳光和二氧化碳转化为海洋生态系统底层的食物，热带海洋近半数食物是由原绿球藻产生的，有数以百计的物种依赖于原绿球藻。根据最新研究，如果地表水温超过约 27.8 摄氏度，未来 75 年热带海洋中的原绿球藻种群数量可能会减少一半。

A vulnerability has been found in Google Android 11.0/12.0/13.0 and classified as critical. This issue affects the function startInstrumentation of the file ActivityManagerService.java. The manipulation leads to improper access controls. This vulnerability is documented as CVE-2023-21089. The attack needs to be performed locally. There is not any exploit available. Applying a patch is the recommended action to fix this issue.

A vulnerability, which was classified as problematic, was found in Google Android 13.0. Affected by this vulnerability is the function parseUsesPermission of the file ParsingPackageUtils.java. Such manipulation leads to resource consumption. This vulnerability is documented as CVE-2023-21090. The attack needs to be performed locally. There is not any exploit available. It is best practice to apply a patch to resolve this issue.

A vulnerability identified as problematic has been detected in Google Android 11.0/12.0/13.0. The impacted element is an unknown function of the file PreferencesHelper.java. Performing manipulation results in denial of service. This vulnerability was named CVE-2023-21087. The attack needs to be approached locally. There is no available exploit. Applying a patch is the recommended action to fix this issue.

图片来源：各组提供

Scattered Spider didn't need a zero-day to breach Clorox. They just phoned the help desk—convincing agents to reset passwords & MFA without proper checks. The result: $380M in damages. Learn from Specops Software why caller verification and audit trails are critical. [...]

澳大利亚ACSC警告SonicWall SSL VPN漏洞CVE-2024-40766被利用，导致未授权访问和防火墙崩溃。影响多代设备，需更新固件、重置密码并启用MFA等措施应对威胁。

Kikimora Agent是一款AI驱动的网络安全管理平台，通过对话式AI和自动化工作流程简化资产监控、漏洞检测和合规报告生成。该平台专为中小企业、个人及学生设计，旨在降低复杂性和技能要求，并支持多种安全功能模块。

Sofia, Bulgaria, 10th September 2025, CyberNewsWire

As Kubernetes becomes the foundation of enterprise infrastructure, the underlying operating system must evolve alongside it.

A vulnerability was found in Scada-LTS up to 2.7.8.1. It has been classified as problematic. This issue affects some unknown processing of the file /reports.shtm of the component Reports Module. This manipulation of the argument Colour causes cross site scripting. This vulnerability appears as CVE-2025-10235. The attack may be initiated remotely. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Scada-LTS up to 2.7.8.1 and classified as problematic. This vulnerability affects unknown code of the file /data_point_edit.shtm of the component Data Point Edit Module. The manipulation of the argument Text Renderer properties results in cross site scripting. This vulnerability is reported as CVE-2025-10234. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

航空交通分析在当今开源调查中具有重要意义。然而，这需要理解与航班、飞机构造以及数据收集系统相关的多个因素。本文通过几个例子试图强调这一问题的重要性。

Submit #641972 / VDB-323504

Submit #641922 / VDB-319239

Submit #641896 / VDB-323503

基于RASP的通防工具：AWD-RASP

A vulnerability has been found in kalcaddle kodbox 1.61 and classified as critical. This affects the function fileGet/fileSave of the file app/controller/explorer/editor.class.php. The manipulation of the argument path leads to path traversal. This vulnerability is documented as CVE-2025-10233. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.