Aggregator

文章描述了错误代码521的含义及其常见原因和解决方法。

HackerNews 编译，转载请注明出处： 乌克兰计算机应急响应小组（CERT-UA）近期发出警报，发现一种名为LameHug的新型恶意软件。该软件利用大语言模型（LLM） 在受感染的Windows系统上生成并执行攻击指令。乌克兰专家将其归因于与俄罗斯有关的黑客组织APT28（又名UAC-0001、Fancy Bear、Pawn Storm、Sofacy Group、Sednit、BlueDelta和STRONTIUM）。 CERT-UA在警报中指出：“LAMEHUG的显著特征是使用了LLM（大语言模型），根据其文本描述生成可执行命令。我们有中等把握认为该活动与UAC-0001（APT28）组织有关。” 2025年7月10日，CERT-UA发现一起针对政府部门的钓鱼攻击活动，攻击者通过伪装成政府文件的ZIP压缩包进行传播。该压缩包内含伪装成.pif文件的LAMEHUG恶意软件，该软件使用Python编写并通过PyInstaller打包。研究人员发现存在两种不同数据窃取方式的变体。攻击者使用了被入侵的电子邮箱账户，并将基础设施托管在合法但已被攻陷的平台上。 LAMEHUG通过huggingface[.]co服务API调用Qwen 2.5-Coder-32B-Instruct模型，基于静态输入的文本描述生成攻击指令。Qwen 2.5-Coder-32B-Instruct是由阿里巴巴Qwen团队开发的开源大语言模型，专门针对编程任务进行了优化。 该恶意软件会收集系统信息，并在常见文件夹中搜索Office、PDF和TXT文档。收集的数据先存储在本地，然后通过SFTP或HTTP POST方式外传。警报中详细说明：“该软件会收集计算机基本信息（硬件配置、进程、服务、网络连接）并存储在‘%PROGRAMDATA%\info\info.txt’文件中，同时递归搜索‘文档’、‘下载’和‘桌面’目录中的Microsoft Office文档（包括TXT和PDF文件），将其复制到‘%PROGRAMDATA%\info’文件夹。不同版本的程序会使用SFTP或HTTP POST请求外传获取的信息和文件。” LameHug是已知首款利用LLM生成攻击指令的恶意软件，使威胁行为者能够根据实际需求动态调整攻击链。该报告还包含了相关网络威胁指标。       消息来源： securityaffairs； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

Wiz, a cybersecurity firm specializing in cloud infrastructure protection, has uncovered a critical vulnerability in the NVIDIA Container Toolkit, identified as CVE-2025-23266 and rated 9.0 on the CVSS scale. Dubbed “NVIDIAScape,” the flaw poses...

The post NVIDIAScape: Critical Container Escape (CVE-2025-23266, CVSS 9.0) Threatens 37% of AI Cloud Environments appeared first on Penetration Testing Tools.

文章描述了错误代码521的含义及其常见原因。该错误通常由Cloudflare引发，表示Web服务器返回了无效响应。常见原因包括服务器配置问题或暂时不可用。建议检查服务器状态或联系网络管理员以解决问题。

HackerNews 编译，转载请注明出处： 微软于周六向 SharePoint Server 客户发出紧急警告，称攻击者正在利用该软件产品中的一个零日漏洞（CVE-2025-53770，CVSS 评分为 9.8）。 目前尚无针对该漏洞（被命名为“ToolShell”）的补丁，微软称其为 CVE-2025-49706 的变种。这家总部位于华盛顿州雷德蒙德的科技巨头表示，安全更新正在开发中，并提供了缓解措施和检测指导。安全团队应立即采取行动，在此期间实施缓解措施。 谷歌发言人告诉 SecurityWeek：“谷歌威胁情报小组观察到威胁行为者利用此漏洞安装 Webshell，并从受害者服务器窃取加密密钥。这会导致持续的、未经身份验证的访问，并对受影响的组织构成重大风险。” 安全公司 Eye Security 表示，他们发现“数十个系统遭到主动入侵”，入侵可能发生在 7 月 18 日 18:00 左右（中欧时间）和 7 月 19 日 07:30 左右（中欧时间）的攻击中。 Palo Alto Networks Unit42 团队周六表示，他们也观察到影响 Microsoft SharePoint 的漏洞 CVE-2025-49704 和 CVE-2025-49706 正被积极利用。 微软在其安全公告中解释道：“为保护本地 SharePoint Server 环境，建议客户在 SharePoint 中配置 AMSI 集成，并在所有 SharePoint 服务器上部署 Defender AV。这将阻止未经身份验证的攻击者利用此漏洞。” Mandiant Consulting – Google Cloud 首席技术官查尔斯·卡玛卡尔评论道：“各组织需要立即实施缓解措施（并在补丁可用时应用），假设系统已遭入侵，调查在补丁/缓解措施应用之前系统是否已被入侵，并采取补救措施。”       消息来源： securityweek； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

A vulnerability has been found in Microsoft Windows NT 4.0/2000/XP/Server 2003 and classified as very critical. This vulnerability affects unknown code in the library msasn1.dll of the file lsass.exe of the component ASN.1. The manipulation as part of BER Decoding leads to integer coercion error. This vulnerability was named CVE-2003-0818. The attack can be initiated remotely. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Microsoft ISA Server 2000. It has been rated as critical. Affected by this issue is some unknown functionality of the component H.323/H.225.0/Q.931 Handler. The manipulation leads to memory corruption. This vulnerability is handled as CVE-2003-0819. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in Microsoft ISA Server 2000. This affects an unknown part of the component H.323 Filter. The manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2003-0819. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Microsoft Word 97/98/2000/2002. It has been classified as critical. Affected is an unknown function of the component Macro Name Handler. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2003-0820. It is possible to launch the attack remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Microsoft Excel up to 2002. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Macro Security Handler. The manipulation leads to memory corruption. This vulnerability is known as CVE-2003-0821. The attack can be launched remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Microsoft Windows NT 4.0/2000/XP/Server 2003 and classified as very critical. This issue affects some unknown processing of the file GS of the component WINS Server. The manipulation leads to improper input validation. The identification of this vulnerability is CVE-2003-0825. The attack may be initiated remotely. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in GNU lsh Daemon 1.4. It has been rated as critical. This issue affects some unknown processing of the file read_line.c/channel_commands.c/client_keyexchange.c. The manipulation leads to heap-based buffer overflow. The identification of this vulnerability is CVE-2003-0826. The attack may be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

由于出现错误代码521（Cloudflare 错误），无法正常加载文章内容。建议检查网络连接或联系网站管理员以解决问题。

A vulnerability was found in Chanjet CRM 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /mail/mailinactive.php of the component Login Page. The manipulation leads to sql injection. This vulnerability is handled as CVE-2025-7915. The attack may be launched remotely. Furthermore, there is an exploit available.

HackerNews 编译，转载请注明出处： 里士满放射学协会（Radiology Associates of Richmond，简称RAR）披露了一起影响超过140万人的数据泄露事件。 该医疗机构在其官网上发布的《数据安全事件通告》显示，黑客在2024年4月的几天内入侵了该组织的系统。 超过一年后，里士满放射学协会确认，被入侵的系统中存储了包含可识别个人身份的健康及隐私信息的文件。 该机构目前没有证据表明泄露信息已被恶意使用，仅向社会保障号码（Social Security number）被包含在泄露文件中的患者提供免费的信用监控服务。 里士满放射学协会总部位于弗吉尼亚州里士满，在弗吉尼亚州中部多家医院、独立急诊中心和门诊影像中心提供医学影像服务。 美国卫生与公众服务部（HHS）的医疗数据泄露追踪系统显示，此次事件影响了1,419,091人。 目前没有已知的勒索软件组织宣称对此次攻击负责。 这并非近期披露的唯一重大医疗数据泄露事件。HHS追踪系统显示，马里兰州皮肤病服务提供商安妮阿伦德尔皮肤病学中心（Anne Arundel Dermatology）也遭遇了一起影响190万人的数据泄露。       消息来源： securityweek； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

奖品上新，2025年未在补天提交过有效漏洞的白帽子均可参与！

当前环境出现异常状态,需完成验证后方可继续访问。

A vulnerability was found in Linux Kernel up to 6.8.2 and classified as problematic. This issue affects some unknown processing of the file drivers/usb/gadget/udc/core.c of the component usb. The manipulation leads to denial of service. The identification of this vulnerability is CVE-2024-35822. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in Linux Kernel up to 6.8.2 and classified as problematic. This vulnerability affects the function cgr_lock of the component qbman. The manipulation leads to denial of service. This vulnerability was named CVE-2024-35819. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.8.2. It has been declared as problematic. This vulnerability affects the function brcmf_cfg80211_detach. The manipulation leads to use after free. This vulnerability was named CVE-2024-35811. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.