Aggregator

挂钩都在干什么呢？题目给出了源码，我们先来看环境配置前端使用了Vite，版本是6.4.1我们访问网站。发现前端展示了三角洲行动航天基地的挂钩们实时在干的事情。经过搜索发现有一模一样的项目。这不禁使我联想到了新春杯的终末地拼图生成器，推测这个题的入口也是在框架版本上。果然找到了CVE-2026-39363上网找了一圈发现没有能直接拿来用的exp，我用ds开发了一个，需要自取。sunynov/CVE-

As the cyber scam industry expands globally, the U.S. government wants banks to share more information about what's happening to their customers.

Threat actors are leveraging Microsoft's Graph API to identify lucrative targets, then passing their access to extortion groups like ShinyHunters.

Windows admins report that the September 2026 security updates are causing Remote Desktop Services (RDS) failures on Windows Server 2019, 2022, and 2025 servers, preventing users from connecting and, in some cases, requiring a hard reset to restore functionality. [...]

Oleksii Lytvynenko joined the notorious group in 2021 and was directly involved in attacks on at least 12 companies.

The post Conti ransomware crew member sentenced to four years in prison appeared first on CyberScoop.

摘要：WeiPHP5.0框架的wp_where()函数存在SQL注入漏洞，源于对用户输入的exp数组未作安全校验，直接拼接原始SQL语句。攻击者可通过home/index/bind_follow接口构造恶意参数（如uid[0]=exp&uid[1]=注入代码）触发报错注入，无需登录即可窃取数据库信息。漏洞原理涉及ThinkPHP的Db::raw()机制对用户输入的信任缺陷，以及默认过滤未处理单引号

The Republican lawmaker called OpenAI’s leadership decisions “reckless,” and used recent warnings about the existential risk of AI to bolster his inquiry.

The post Hawley probes OpenAI over Hugging Face breach appeared first on CyberScoop.

The report details a Russian-aligned espionage campaign against more than 20 organizations, an exploit foundry run by Chinese undergraduates and ShinyHunters-affiliated breaches, among other disrupted operations.

The post AI lets small actors run state-level hacking campaigns, Anthropic report finds appeared first on CyberScoop.

Surfshark disclosed that hackers accessed one of its internal test servers after a configuration error exposed it to the internet. [...]

Microsoft Excel users report that this week's KB5002914 Office security update is breaking copy-and-paste operations and formula dragging, with affected users saying that removing or rolling back the update restores normal functionality. [...]

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco, Google Chromium V8, Fortinet, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-20079 (CVSS score of 10.0) is an authentication bypass issue. The flaw resides in Cisco Secure […]

A notice dated September 4 but not widely shared shows that IDScan acknowledged a data breach but did not specify how many people were affected.

Человеку оставляют цель, а всё остальное постепенно передают алгоритмам.

Ronzelle Green, most recently a senior official at the National Geospatial-Intelligence Agency, will be U.S. Cyber Command's chief AI officer.

Предупреждения о сверхинтеллекте теперь звучат не снаружи индустрии, а из её главных лабораторий.

A lot of this week’s security news has the same awkward answer to one question: “Why was that allowed to work?” An extension asks for access and takes too much. A trusted service becomes part of a phishing chain. An old bug still gets results. An exposed system stays exposed. A package looks useful right up until it isn’t. Different stories, same basic problem: the path in was often already