Aggregator

A vulnerability marked as problematic has been reported in PaperCut NG and MF up to 25.0.4. Affected is an unknown function of the component Communication Channel Handler. Performing a manipulation results in cleartext transmission of sensitive information. This vulnerability is cataloged as CVE-2026-5115. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in SciTokens up to 1.9.6. This impacts an unknown function. Such manipulation leads to path traversal. This vulnerability is listed as CVE-2026-32727. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

A vulnerability identified as critical has been detected in SciTokens up to 1.9.5. This affects an unknown function. This manipulation causes improper authorization. This vulnerability is tracked as CVE-2026-32716. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

A vulnerability categorized as critical has been discovered in SciTokens up to 1.9.5. The impacted element is the function str.format. The manipulation results in sql injection. This vulnerability is identified as CVE-2026-32714. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability was found in jhimross Debugger & Troubleshooter Plugin up to 1.3.2 on WordPress. It has been rated as critical. The affected element is the function wp_debug_troubleshoot_simulate_user. The manipulation of the argument cookie leads to cookies without validation. This vulnerability is referenced as CVE-2026-5130. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

好的，我现在需要帮用户总结这篇文章的内容，控制在100个字以内。首先，我得仔细阅读文章，理解主要事件。 文章讲的是Axios这个流行的HTTP客户端遭受了供应链攻击。攻击者利用了维护者被入侵的npm账号，发布了包含恶意依赖的版本。这个恶意依赖会执行一个后安装脚本，作为跨平台的远程访问木马（RAT）释放器，影响macOS、Windows和Linux系统。 攻击者在发布前精心策划，提前18小时准备了恶意包，并在短时间内发布了两个被污染的Axios版本。恶意软件会在执行后删除自身，并替换package.json以避免检测。 用户需要立即降级到安全版本，并采取措施检查和清除恶意软件。此外，还有其他两个包也被发现分发了相同的恶意软件。 总结时要抓住关键点：供应链攻击、Axios版本、恶意依赖、RAT释放器、影响范围和应对措施。确保在100字以内简洁明了地表达这些信息。 Axios遭遇供应链攻击，两个版本引入恶意依赖"plain-crypto-js"，通过后安装脚本分发跨平台远程访问木马（RAT），影响macOS、Windows和Linux系统。攻击者利用被入侵的npm账号发布恶意包，并删除痕迹以规避检测。用户需降级至安全版本并清除恶意软件。

The popular HTTP client known as Axios has suffered a supply chain attack after two newly published versions of the npm package introduced a malicious dependency that delivers a trojan capable of targeting Windows, macOS, and Linux systems. Versions 1.14.1 and 0.30.4 of Axios have been found to inject "plain-crypto-js" version 4.2.1 as a fake dependency. According to StepSecurity, the two

嗯，用户让我总结这篇文章的内容，控制在一百个字以内，而且不需要特定的开头。首先，我需要快速浏览文章内容，找出主要信息。 文章标题提到了几个安全工具和技术，比如Ludus MCP/Skills、Grapefruit安全套件、Citrix NetScaler的两个帖子、BIOS绕过等。接下来是上周的安全新闻摘要，时间范围是2026年3月24日至30日。 新闻部分包括苹果发送安全警报、Cobalt Strike研究实验室的介绍、Wyden对NSA行动的批评、FBI局长的邮件泄露。技术方面有Citrix NetScaler的漏洞分析、BIOS安全功能禁用、Claude Code在安全代码审查中的应用以及音频隐写术在供应链攻击中的使用。 工具和漏洞部分提到了多个开源工具和补丁，如ludus-mcp、Grapefruit、emulat3等。还有新出现的技术和工具，如raptor将Claude Code用于安全代理。 总结时需要涵盖主要新闻事件和技术工具，同时保持简洁。确保不超过100字，并且直接描述内容。 这篇文章总结了2026年3月24日至30日的网络安全新闻和技术动态，包括苹果加强iOS安全警报、Cobalt Strike研究实验室发布新工具、FBI局长邮箱遭入侵等事件。同时介绍了Citrix NetScaler漏洞分析、BIOS安全绕过技术及Claude Code在安全审查中的应用等技术内容，并提到了多个开源安全工具和漏洞利用工具的更新。

A vulnerability was found in woocommerce WooPayments Plugin up to 10.5.1 on WordPress. It has been declared as critical. Impacted is the function save_upe_appearance_ajax of the component Setting Handler. Executing a manipulation can lead to improper authorization. The identification of this vulnerability is CVE-2026-1710. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Shopify ruby-lsp up to 0.26.8. It has been classified as critical. This issue affects some unknown processing of the file vscode/settings.json. Performing a manipulation results in code injection. This vulnerability was named CVE-2026-34060. The attack needs to be approached locally. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability was found in baserproject basercms up to 5.2.2 and classified as critical. This vulnerability affects the function require_once. Such manipulation leads to unrestricted upload. This vulnerability is uniquely identified as CVE-2025-32957. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability has been found in Dolibarr up to 22.0.4 and classified as problematic. This affects the function restrictedArea of the file /core/ajax/selectobject.php of the component AJAX Endpoint. This manipulation of the argument objectdesc causes improper control of filename for include/require statement in php program ('php remote file inclusion'). This vulnerability is handled as CVE-2026-34036. The attack can be initiated remotely. There is not any exploit available. Applying a patch is the recommended action to fix this issue.

A vulnerability, which was classified as problematic, was found in Microsoft vcpkg up to 3.6.1#2. Affected by this issue is some unknown functionality of the component OpenSSL. The manipulation results in uncontrolled search path. This vulnerability is known as CVE-2026-34054. Attacking locally is a requirement. No exploit is available. You should upgrade the affected component.

好的，我现在需要帮用户总结一篇文章的内容，控制在100字以内。用户给的文章是关于世界备份日的，内容挺多的，我得先快速浏览一下。 文章主要讲的是每年3月31日的世界备份日，强调保护数字数据的重要性。里面提到意大利的数据安全情况，还有专家的意见和一些最佳实践。比如3-2-1备份规则，以及如何应对勒索软件等威胁。 用户要求用中文总结，不需要特定开头，直接描述内容。我得抓住关键点：世界备份日的目的、数据安全的重要性、意大利的情况、专家建议和最佳实践。 然后我要把这些信息浓缩到100字以内，确保涵盖主要方面。可能需要提到备份作为企业韧性的一部分，以及防范网络攻击的措施。 最后检查一下语言是否简洁明了，确保没有遗漏重要信息。 世界备份日提醒人们保护数字数据的重要性，防范 ransomware、盗窃和硬件故障等威胁。文章强调了备份作为企业韧性和信息安全的关键，并提供了最佳实践，如3-2-1规则和清洁恢复策略。专家指出，在数字化时代，数据不仅是资产，更是身份的一部分，需通过加密、多重身份验证等措施加强保护。

A vulnerability, which was classified as critical, has been found in baserproject basercms up to 5.2.2. Affected by this vulnerability is an unknown functionality of the file /baser/api/admin/bc-theme-file/theme_files/add.json of the component Theme File Management API. The manipulation of the argument path leads to path traversal. This vulnerability is traded as CVE-2026-30940. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

A vulnerability classified as problematic was found in themetechmount Truebooker Plugin up to 1.1.4 on WordPress. Affected is an unknown function. Executing a manipulation can lead to missing authorization. This vulnerability appears as CVE-2026-1797. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

A vulnerability classified as problematic has been found in RocketGenius Gravity SMTP Plugin up to 2.1.4 on WordPress. This impacts the function register_connector_data of the file /wp-json/gravitysmtp/v1/tests/mock-data of the component REST API Endpoint. Performing a manipulation of the argument Query results in information disclosure. This vulnerability is reported as CVE-2026-4020. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

A vulnerability described as critical has been identified in WPEverest Everest Forms Pro Plugin up to 1.9.12 on WordPress. This affects the function process_filter. Such manipulation leads to code injection. This vulnerability is documented as CVE-2026-3300. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

如果手机莫名其妙发烫，这可能是你的手机正在被窃密者操纵着进行远程实时监控，即使手机关机，窃密行为也没有停止。

这是全球野外实战攻击中，首例采用该底层绕过机制的窃密恶意软件。