📡 4hou · 2026-04-10 Progress ShareFile曝新漏洞 可组合实现未认证远程代码执行 CVE-2026-2699CVE-2026-2701 Progress ShareFile曝新漏洞 可组合实现未认证远程代码执行 导语：由于系统对 HTTP 重定向处理不当，攻击者可直接访问 ShareFile 管理后台界面。 最新发现，企业级安全文件传输解决方案 Progress ShareFile 存在两处漏洞，攻击者可将其组合利用，在无需身份认证的情况下从受影响环境中窃取文件。Progress ShareFile 是一款文档共享与协作产品，广泛应用于大中型企业。 此类文件传输平台历来是勒索软件团伙的重点攻击目标，此前 Clop 勒索组织就曾利用 Accellion FTA、SolarWinds Serv-U、Gladinet CentreStack、GoAnywhere MFT、MOVEit Transfer、Cleo 等产品中的漏洞实施大规模数据窃取攻击。 watchTowr 的研究人员在 Progress ShareFile

📡 Elastic Security Labs · 0 DFIR: From alert to root cause using Osquery without leaving Elastic Security Modern DFIR doesn't start with a disk image. That model worked when environments were smaller, endpoints were static, and time wasn't the primary constraint. Endpoints are now ephemeral, fleets scale

📡 Elastic Security Labs · 0 Detecting Web Server Probing & Fuzzing in Traefik with Automated Cloudflare Response Introduction Self-hosted services exposed through a reverse proxy inevitably attract automated scanners probing for misconfigurations, admin panels, and vulnerable endpoints. In this article, I show how to turn routine Traefik access logs into an

每日漏洞情报汇总 · 2026-05-21 📊 2026-05-21 漏洞情报日报 📋 共 200 条 🔥 高危/严重 99 条 🚨 CISA-KEV 7 条 🐙 GitHub-Advisory 67 条 🔥33 🛡️ NVD-Latest 66 条 🔥66 ⚔️ Sploitus 60 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-46421 及 @beproduct/nestjs-auth 恶意包事件：影响 @cap-js/* 系列库及 npm 生态。攻击者通过泄露的发布令牌（Token）植入恶意代码，窃取凭证并自我复制。属于供应链投毒（Supply Chain Compromise），利用条件为零，已安装受影响版本的开发环境将被直接感染。 * CVE-2026-43633 (CVSS 10.

📡 Palo Alto Unit42 · 2026-04-01 Threat Brief: Widespread Impact of the Axios Supply Chain Attack Executive Summary Unit 42 researchers have observed widespread impact from the significant supply chain attack targeting the Axios JavaScript library. The attack occurred after an Axios maintainer's npm account was hijacked, leading to the

📡 Palo Alto Unit42 · 2026-03-31 Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure CVE-2025-55182 Executive Summary Between late February and March 2026, threat group TeamPCP conducted a highly calculated, escalating sequence of supply chain threats. It systematically compromised widely trusted open-source security tools, including the vulnerability scanners

📡 Kaspersky Securelist · 2026-04-08 Financial cyberthreats in 2025 and the outlook for 2026 In 2025, the financial cyberthreat landscape continued to evolve. While traditional PC banking malware declined in relative prevalence, this shift was offset by the rapid growth of credential theft by infostealers. Attackers increasingly relied on aggregation and reuse

📡 Elastic Security Labs · 0 How we caught the Axios supply chain attack Preamble Last Monday night I was working late and a Slack alert came in from a monitoring tool I had built three days earlier. Axios compromised; one of the most popular npm packages in the world. My heart

📡 Qualys Security Blog · 0 Dirty Frag: Using the Page Caches as an Attack Surface CVE-2026-43284CVE-2026-31431CVE-2022-0847CVE-2026-43500 Dirty Frag: Using the Page Caches as an Attack Surface Dirty Frag is a Linux local privilege escalation (LPE) chain published on May 7, 2026. It combines two previously unknown kernel vulnerabilities can allow an

📡 Elastic Security Labs · 0 Prioritizing Alerts Triage with Higher-Order Detection Rules At Elastic, we operate a large and diverse set of behavior detection rules across multiple datasets, environments, and severity levels. Most of these rules are atomic, each designed to detect a specific behavior, signal, or attack pattern. In addition,

📡 Elastic Security Labs · 0 Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT A follow-up publication will provide a deeper technical analysis of PHANTOMPULSE itself, covering its injection engines, persistence internals, and C2 protocol in greater detail. Preamble Elastic Security Labs has identified a novel social engineering campaign that

📡 Elastic Security Labs · 0 The Cost of Understanding: LLM-Driven Reverse Engineering vs Iterative LLM Obfuscation Introduction Over the past few years, we have observed a significant evolution in the capabilities of LLMs to be productive and to carry out various tasks that address real-world problems, such as program synthesis, malware

每日漏洞情报汇总 · 2026-05-20 📊 2026-05-20 漏洞情报日报 📋 共 200 条 🔥 高危/严重 89 条 🐙 GitHub-Advisory 100 条 🔥49 🛡️ NVD-Latest 40 条 🔥40 ⚔️ Sploitus 60 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-45695 (Kopia)： 备份工具Kopia的HTTP服务在未设置密码时，攻击者可通过构造恶意的SFTP存储配置，触发SSH ProxyCommand注入，实现远程代码执行（RCE）。利用条件：服务以--without-password参数启动且暴露于网络。 * CVE-2026-46339 (9router)： 路由器软件9router的两个未认证API端点可被组合利用，允许网络邻近的攻击者在无需任何凭据的前提下，以进程权限执行任意操作系统命令，风险极高。 * CVE-2026-42822 (Azure Local)： Microsoft Azure Local在断网操作模式下存在身份验证缺陷（CV

📡 Elastic Security Labs · 0 CI/CD pipeline abuse: the problem no one is watching CVE-2025-30066 Preamble In 2025 and 2026, we watched a pattern play out across the industry. Attackers stopped going after production servers directly and started targeting the automation that deploys to them. Compromised developer credentials, a modified

📡 Elastic Security Labs · 0 TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook Elastic Security Labs identified a new Brazilian banking trojan that we are tracking as TCLBANKER, a malware family we assess is a major update of the MAVERICK/SORVEPOTEL family. The campaign, tracked as REF3076, features a loader

📡 Elastic Security Labs · 0 Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild CVE-2026-31431 Introduction Recent Linux kernel privilege escalation vulnerabilities, Copy Fail (CVE-2026-31431) , Copy Fail 2, and DirtyFrag, highlight how subtle page cache corruption bugs can become practical, reliable paths to root. These issues are especially relevant

📡 watchTowr Labs · 0 Stop Putting Your Passwords Into Random Websites (Yes, Seriously, You Are The Problem) Stop Putting Your Passwords Into Random Websites (Yes, Seriously, You Are The Problem) Welcome to watchTowr vs the Internet, part 68. That feeling you’re experiencing? Dread. You should be used to it by

📡 GitHub Security Lab · 0 CodeQL zero to hero part 5: Debugging queries Sylwia Budzynska Sylwia is a security researcher at GitHub Security Lab, where she works with finding vulnerabilities in open source software, helping secure the foundations on which all modern software is built upon. Learn to debug and fix

📡 GitHub Security Lab · 0 Strengthening supply chain security: Preparing for the next malware campaign The open source ecosystem continues to face organized, adaptive supply chain threats that spread through compromised credentials and malicious package lifecycle scripts. The most recent example is the multi-wave Shai-Hulud campaign. While individual incidents differ in

📡 GitHub Security Lab · 0 AI-supported vulnerability triage with the GitHub Security Lab Taskflow Agent Get the guide to setting up the GitHub Security Lab Taskflow Agent > Triaging security alerts is often very repetitive because false positives are caused by patterns that are obvious to a human auditor but difficult

📡 watchTowr Labs · 0 Sometimes, You Can Just Feel The Security In The Design (Juniper Junos Evolved CVE-2026-21902 Pre-Auth RCE) CVE-2026-21902 Sometimes, You Can Just Feel The Security In The Design (Juniper Junos Evolved CVE-2026-21902 Pre-Auth RCE) On today’s ‘good news disguised as other things’ segment, we’re turning our

每日漏洞情报汇总 · 2026-05-19 📊 2026-05-19 漏洞情报日报 📋 共 200 条 🔥 高危/严重 89 条 🐙 GitHub-Advisory 50 条 🔥24 🛡️ NVD-Latest 65 条 🔥65 ⚔️ Sploitus 85 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-45697 (Formie) - 服务端模板注入漏洞。未认证用户可通过提交特制数据至Hidden字段触发Twig模板引擎解析，导致Craft CMS站点被完全接管。利用条件低，危害极高。 * GHSA-wx9m-wx4f-4cmg (mistralai PyPI) - 供应链投毒攻击。PyPI上的mistralai包2.4.6版本包含恶意dropper，在Linux系统上导入时执行。由于攻击者已成功上传恶意包，影响范围可能涉及直接或间接依赖该包的开发环境与生产系统。 * CVE-2026-45327 (TinyIce) - 未授权访问。TinyIce的WebRTC推流端点缺少身份验证，攻击者可未授权注入视频

📡 GitHub Security Lab · 0 Bugs that survive the heat of continuous fuzzing CVE-2024-24826CVE-2025-54080CVE-2022-40303CVE-2025-26623 Want to learn how to start fuzzing? Check out our Fuzzing 101 course at gh.io/fuzzing101 > Bugs that survive the heat of continuous fuzzing Learn why some long-enrolled OSS-Fuzz projects still contain vulnerabilities and how

📡 GitHub Security Lab · 0 How to scan for vulnerabilities with GitHub Security Lab’s open source AI-powered framework CVE-2026-25757CVE-2026-25758CVE-2025-64487CVE-2026-28514 For the last few months, we’ve been using the GitHub Security Lab Taskflow Agent along with a new set of auditing taskflows that specialize in finding web security vulnerabilities. They

📡 GitHub Security Lab · 0 A year of open source vulnerability trends: CVEs, advisories, and malware Jonathan Evans Security Analyst, curator of the GitHub Advisory Database, and one of the members of the Security Lab responsible for issuing CVE IDs and publishing CVE records. Reviewed advisories hit a four-year low, malware