安全情报 Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation 📡 Palo Alto Unit42 · 2026-07-07 Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation Menu Tools ATOMs Security Consulting About Us Under Attack? Threat Research Center Threat Research Malware Malware Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders
安全情报 Threat landscape for industrial automation systems. Q1 2026 📡 Kaspersky Securelist · 2026-07-07 Threat landscape for industrial automation systems. Q1 2026 Industrial threat report for Q1 2026 | Securelist Solutions for: Home Products Small Business 1-50 employees Medium Business 51-999 employees Enterprise 1000+ employees by Kaspersky CompanyAccount Get In Touch Dark mode off English Russian Spanish Brazil Solutions Internet of Things
安全情报 Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT 📡 The Hacker News · 2026-07-06 Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million     
安全情报 Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints 📡 The Hacker News · 2026-06-30 Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million     
安全情报 Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands 📡 The Hacker News · 2026-07-01 Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million     
安全情报 Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer 📡 The Hacker News · 2026-07-03 Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million       Get the
安全情报 📊 2026-07-13 漏洞情报日报 · 200 条 · 高危 102 每日漏洞情报汇总 · 2026-07-13 📊 2026-07-13 漏洞情报日报 📋 共 200 条 🔥 高危/严重 102 条 🐙 GitHub-Advisory 32 条 🔥21 🛡️ NVD-Latest 81 条 🔥81 ⚔️ Sploitus 87 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-54089 (CVSS 9.8, File Browser): 认证绕过漏洞。当使用代理认证模式时，未授权攻击者可通过构造伪造的HTTP头直接冒充任意用户（包括管理员），无需凭证即可接管文件管理权限。 * CVE-2026-61447 (CVSS 10.0, PraisonAI): 远程代码执行。LLM生成的Python代码在`CodeAgent._execute_python()`中未经沙箱限制直接执行，攻击者可借助恶意输入实现完全控制。 * CVE-2026-15282 (CVSS 9.
APT情报 2026年Q1工业自动化系统威胁态势：攻击面持续扩大，间谍软件与恶意脚本成主要风险 卡巴斯基ICS CERT发布2026年Q1工业自动化系统威胁报告，全球ICS恶意软件拦截率降至19.6%但区域差异显著。南欧、俄罗斯威胁上升，生物识别系统与制造业成重灾区。间谍软件、恶意脚本和钓鱼页面是主要攻击手段，需加强网络分段、端点保护和员工培训。
APT情报 东南亚政府与关键基础设施遭新型后门TinyRCT定向攻击 Unit42报告揭示CL-STA-1062（UAT-7237）APT组织针对东南亚政府与能源基础设施的攻击活动，使用新型.NET后门TinyRCT及SoftEther VPN等工具，实现持久化窃密。本文提供攻击链分析、IOC及Cortex XDR等缓解措施，帮助防守方识别并防御此类定向威胁。
漏洞分析 [webapps] Joomla Extension 4.1.4 - PHP Object injection CVE-2026-48909是Joomla SP LMS 4.1.3及之前版本中的PHP对象注入漏洞，攻击者通过精心构造的cookie触发反序列化，进而利用Joomla gadget链写入webshell，实现远程代码执行。本文深度分析漏洞根因、攻击链及PoC代码，并提供修复建议和检测规则。
漏洞分析 CVE-2026-56291 - Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-56291 是 Balbooa Forms 组件中的高危任意文件上传漏洞，CVSS 9.8，允许未认证攻击者上传可执行文件导致远程代码执行（RCE）。本文提供详细技术分析、攻击场景及修复建议，帮助 Joomla 管理员及时防护。
漏洞分析 CVE-2026-15282 (CVSS 9.8) - The Instant Appointment plugin for WordPress is vulnerable to arbitrary file upl CVE-2026-15282是WordPress Instant Appointment插件1.2及之前版本中的严重漏洞，CVSS 9.8，允许未经身份验证的攻击者上传任意文件并实现远程代码执行。本文深入分析漏洞根因、攻击场景和修复方案。
漏洞分析 CVE-2026-14894 (CVSS 9.8) - The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to CVE-2026-14894 (CVSS 9.8) 是 Super Forms WordPress插件（版本≤6.3.313）中的一个严重任意文件上传漏洞，允许未认证攻击者通过两步骤HTTP请求上传PHP webshell并实现远程代码执行。漏洞源于submit_form函数缺少文件类型验证与权限检查，且nonce可被super_create_nonce端点绕过。立即升级到6.3.314+或配置WAF规则进行防护。
安全情报 Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations 📡 The Hacker News · 2026-07-06 Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million      
安全情报 ISC Stormcast For Monday, July 6th, 2026 https://isc.sans.edu/podcastdetail/9994, (Mon, Jul 6th) 📡 SANS ISC · 2026-07-06 ISC Stormcast For Monday, July 6th, 2026 https://isc.sans.edu/podcastdetail/9994, (Mon, Jul 6th) ISC Stormcast For Monday, July 6th, 2026 https://isc.sans.edu/podcastdetail/9994 --> Internet Storm Center Sign In Sign Up Handler on Duty: Johannes Ullrich Threat Level: green previous
安全情报 RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS 📡 The Hacker News · 2026-06-30 RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million     
安全情报 JADEPUFFER: First End-to-End AI-Driven Ransomware Operation 📡 Security Affairs · 2026-07-03 JADEPUFFER: First End-to-End AI-Driven Ransomware Operation JADEPUFFER: First End-to-End AI-Driven Ransomware Operation Home Cyber Crime Cyber warfare APT Data Breach Deep Web Hacking Hacktivism Intelligence Artificial Intelligence Internet of Things Laws and regulations Malware Mobile Reports Security Social Networks Terrorism ICS-SCADA Crypto POLICIES Contact me MUST READ
安全情报 RCS and DNS: The NAPTR Record, (Mon, Jul 6th) 📡 SANS ISC · 2026-07-06 RCS and DNS: The NAPTR Record, (Mon, Jul 6th) RCS and DNS: The NAPTR Record - SANS Internet Storm Center --> Internet Storm Center Sign In Sign Up Handler on Duty: Johannes Ullrich Threat Level: green previous Click HERE to learn more about classes Johannes is
安全情报 France to Stop Certifying Non-Quantum-Safe Encryption 📡 Schneier on Security · 2026-07-06 France to Stop Certifying Non-Quantum-Safe Encryption France to Stop Certifying Non-Quantum-Safe Encryption - Schneier on Security Schneier on Security Menu Blog Newsletter Books Essays News Talks Academic About Me Search Powered by DuckDuckGo Blog Essays Whole site Subscribe Home Blog France to Stop Certifying Non-Quantum-Safe Encryption
安全情报 When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website 📡 Kaspersky Securelist · 2026-07-06 When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website When checking the URL isn’t enough: phishing via the Microsoft identity platform | Securelist Solutions for: Home Products Small Business 1-50 employees Medium Business 51-999 employees Enterprise 1000+ employees by Kaspersky
安全情报 AirDrop and Quick Share Flaws Let Nearby Attackers Trigger Crashes and Bypass Checks 📡 The Hacker News · 2026-06-30 AirDrop and Quick Share Flaws Let Nearby Attackers Trigger Crashes and Bypass Checks AirDrop and Quick Share Flaws Let Nearby Attackers Trigger Crashes and Bypass Checks --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million    
安全情报 📊 2026-07-12 漏洞情报日报 · 200 条 · 高危 94 每日漏洞情报汇总 · 2026-07-12 📊 2026-07-12 漏洞情报日报 📋 共 200 条 🔥 高危/严重 94 条 🚨 CISA-KEV 2 条 🐙 GitHub-Advisory 40 条 🔥26 🛡️ NVD-Latest 68 条 🔥68 ⚔️ Sploitus 90 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-54088 / CVE-2026-54089 (File Browser)：两大致命漏洞组合。命令注入允许管理员通过认证钩子执行任意命令；代理认证绕过允许攻击者伪造HTTP头直接获取管理员权限。产品多用于企业内部文件管理，攻击面极大，PoC已公开。 * CVE-2026-54769 (Langroid)：基于LLM的应用框架存在沙箱逃逸漏洞，CVSS 10.0。攻击者可利用TableChatAgent的eval()缺陷实现远程代码执行，严重影响AI产品安全边界。 * CVE-2026-56291 (Balbooa Forms)：Joomla扩展中未经验证的文件上传漏洞，
APT情报 AI算力劫持、苹果邮件漏洞、蓝锤勒索软件：本周网络安全威胁全景 本周安全新闻盘点：AI算力劫持（Claude Cowork沙箱逃逸）、苹果“隐藏我的邮件”漏洞、蓝锤勒索软件通过伪造国际刑警邮件传播。此外还包括BeepRAT间谍软件、GPT-5.6 Sol攻击能力评估、平台感知钓鱼等14个威胁故事。
APT情报 OpenClaw技能市场沦为AI供应链攻击温床，新型恶意技能绕过检测窃取数据 Palo Alto Unit42报告揭示OpenClaw AI代理技能市场ClawHub成为供应链攻击新目标，攻击者通过恶意技能分发macOS信息窃取器（如AMOS），利用文件膨胀绕过检测，并实施代理金融欺诈。本文深度分析攻击链、IOC及缓解建议，助力安全团队防御AI供应链威胁。
安全情报 Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks 📡 The Hacker News · 2026-06-29 Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million     
