Aggregator

结合jadx进行二进制逆向分析

除了首页时间流和侧栏的精选展位，少数派 Matrix 社区还有很多优秀内容因条件所限无法得到有效曝光，因此我们决定重启 Matrix 周报，并在此基础上添加更多社区内容、作者投稿新玩意呈现给大家。上周

When a ransomware crew locks up your servers, the outside negotiator you hire has to know eve

Nerd Sniping 从 XKCD 漫画的概念演变为 AI Agent 安全攻击向量——攻击者通过构造"看似可解、实则无底"的问题，诱导 Agent 陷入递归思考和无限推理，消耗 token、泄露系统指令、触发工具滥用。防御的核心是让 Agent 学会"思考更少"——给它的思考能力装上刹车。

A vulnerability has been found in Linux Kernel up to 6.19.10 and classified as critical. Affected is the function s_first_data_block of the component ext4. The manipulation leads to privilege escalation. This vulnerability is uniquely identified as CVE-2026-31447. The attack can only be initiated within the local network. No exploit exists. The affected component should be upgraded.

A vulnerability classified as critical has been found in Linux Kernel up to 6.18.20/6.19.10. Affected by this vulnerability is the function damon_call. Performing a manipulation results in null pointer dereference. This vulnerability is known as CVE-2026-31445. Access to the local network is required for this attack. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Linux Kernel up to 6.19.10. Affected by this issue is the function ext4_unregister_sysfs of the file /proc/fs/ext4/xx/mb_groups. Executing a manipulation can lead to use after free. This vulnerability is handled as CVE-2026-31446. The attack can only be done within the local network. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.6.130/6.12.79/6.18.20/6.19.10. This impacts the function smb_grant_oplock. Executing a manipulation can lead to use after free. This vulnerability is handled as CVE-2026-31444. The attack can only be done within the local network. There is not any exploit available. You should upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.18.20/6.19.10. This affects an unknown function of the component dmaengine. Performing a manipulation results in denial of service. This vulnerability is known as CVE-2026-31443. Access to the local network is required for this attack. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability identified as problematic has been detected in Ollama 0.7.1. This affects the function downloadBlob of the component Download Blob. Performing a manipulation results in improper validation of array index. This vulnerability is reported as CVE-2026-15685. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability has been found in js-cookie JavaScript Cookie up to 3.0.6 and classified as problematic. This issue affects the function assign. Performing a manipulation results in improperly controlled modification of object prototype attributes. This vulnerability is known as CVE-2026-46625. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Five people have been charged in the UK following a National Crime Agency (NCA) investigation into Russian Coms, a caller ID spoofing service used by fraudsters. Ayoub Sehailia, 28, Zakkaria Sehailia, 30, Usman Din, 30, Denis Ozmus, 29, and Fadila Salem, 53, all of London, are charged with offences that include conspiracy to supply articles for use in fraud, transferring and converting criminal property, and, for Zakkaria Sehailia, failing to comply with a notice to … More →

The post UK charges five persons linked to fraud platform behind more than a million scam calls appeared first on Help Net Security.

Azuriom 是一款基于 Laravel 的开源游戏社区管理系统，在 Minecraft、Steam 等游戏服务器社区中被广泛使用。2026 年 6 月，该 CMS v1.2.11 之前版本被披露存在一个 CVSS 8.1 的高危漏洞（CVE-2026-54415），其后台 /admin/servers 路由缺少 can:admin.servers 权限中间件，导致仅有基础后台访问权限的用户即可

Currently trending CVE - Hype Score: 1 - httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP ...

Currently trending CVE - Hype Score: 3 - The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.5.0.4. This is due to insufficient input sanitization and output escaping in the ...

Currently trending CVE - Hype Score: 1 - The Starboard Suite Reservation Calendars plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in the [starboard-suite-lightbox] shortcode in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output ...

Currently trending CVE - Hype Score: 2 - Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation. This issue affects MOVEit Automation: from 2025.1.0 before 2025.1.5, from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.

Currently trending CVE - Hype Score: 2 - Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass. This issue affects MOVEit Automation: from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.

Currently trending CVE - Hype Score: 2 - The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce ...

Currently trending CVE - Hype Score: 3 - A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, ...