Security News

学点高级玩意儿

记一次漏洞挖掘，借鉴的是D-Link DIR 615645815 service.cgi远程命令执行漏洞的思路，定位system危险函数，然后去看看能否控制参数等。

该漏洞出自Xiaomi路由器BE10000 Pro 稳定版 存在授权后远程RCE漏洞

JDK17后的高版本触发toString整合

2026年新春杯Misc方向所有题目的正反手解析

re的进阶的知识，补充常见的理论以及新出现的wasm类型

谁在偷窥你的键盘？揭秘潜伏在系统进程背后的“银狐”

第二届“启航杯”网络安全挑战赛应急溯源全解

Cybersecurity researchers have disclosed multiple security vulnerabilities in four popular Microsoft Visual Studio Code (VS Code) extensions that, if ...

The title of the post is"What AI Security Research Looks Like When It Works," and I agree: In the latest OpenSSL security release> on January 27, 2026 ...

In 2025, navigating the digital seas still felt like a matter of direction. Organizations charted routes, watched the horizon, and adjusted course to ...

A maximum severity security vulnerability in Dell RecoverPoint for Virtual Machines has been exploited as a zero-day by a suspected China-nexus threat ...

Security, IT, and engineering teams today are under relentless pressure to accelerate outcomes, cut operational drag, and unlock the full potential of ...

Notepad++ has released a security fix to plug gaps that were exploited by an advanced threat actor from China to hijack the software update mechanism ...

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four security flaws to its Known Exploited Vulnerabilities (KEV) cat ...

After detecting a zero-day attack, the country's effective response was attributed to the tight relationship between its government and private indust ...

Keenadu downloads payloads that hijack browser searches, commit ad fraud, and execute other actions without user knowledge.

Russia-aligned groups are probable culprits behind the wiper attacks against renewable energy farms, a manufacturer, and a heating and power plant.

Remote monitoring and management (RMM) software offers hackers multiple benefits, including stealth, persistence, and operational efficiency.

ClickFix campaigns have adapted to the latest defenses with a new technique to trick users into infecting their own machines with malware.

Cloud attacks move fast — faster than most incident response teams. In data centers, investigations had time. Teams could collect disk images, review ...

Cybersecurity researchers have disclosed that artificial intelligence (AI) assistants that support web browsing or URL fetching capabilities can be tu ...

Here are three papers describing different side-channel attacks against LLMs. "Remote Timing Attacks on Efficient Language Model Inference": Abstract: ...

Well, the ESP32 Bluetooth bridge experiment was a complete failure. Not the radios themselves, they're actually pretty cool, but there's just no way I ...

The GS7 cyber-threat group targets US financial institutions with near-perfect imitations of corporate portals to steal credentials and gain remote ac ...

30 copycat apps tricked users, and Google itself, into thinking they're legitimate AI tools.

Attacks against modern generative artificial intelligence (AI) large language models (LLMs) pose a real threat. Yet discussions around these attacks a ...

This is a current list of where and when I am scheduled to speak: I'm speaking at Ontario Tech University in Oshawa, Ontario, Canada, at 2 PM ET on Th ...

An exploration of the interesting question.

Zscaler's acquisition of SquareX comes as competitors like CrowdStrike and Palo Alto Networks also invest in secure browser technologies.

作者：Georgios Syros, Evan Rose, Brian Grinstead 译者：知道创宇404实验室翻译组 原文链接：https://arxiv.org/html/2602.09222v1 摘要 基于大语言模型（LLM）的网络智能体正被广泛部署，通过直接与网站交互并代表用户执行操作 ...

New York is contemplating a bill that adds surveillance to 3D printers: New York’s 2026­2027 executive budget bill (S.9005 / A.10005) includes languag ...

作者：Nanda Rani, Kimberly Milner, Minghao Shao等 译者：知道创宇404实验室翻译组 原文链接：https://arxiv.org/html/2602.08023v2 摘要 真实世界的攻击性安全操作具有本质上的开放性：攻击者探索未知的攻击面、在不确定的情况下修 ...

I just noticed that the ebook version of Rewiring Democracy is on sale for $5 on Amazon, Apple Books, Barnes & Noble, Books A Million, Google Play, Ko ...

Interesting research: "CHAI: Command Hijacking Against Embodied AI." Abstract: Embodied Artificial Intelligence (AI) promises to handle edge cases in ...

作者：ZHOU XUAN, XIANGZHE XU, MINGWEI ZHENG, LOUIS ZHENG-HUA TAN等 译者：知道创宇404实验室翻译组 原文链接：https://arxiv.org/html/2602.06325v1 理解恶意软件二进制文件中的战术、技术与流程（TTPs）是安 ...

A big "thank you" to everyone who helped me troubleshoot the problem with my "Print Screen" button on the new PC. Try as we all might, none of us coul ...

作者：JIAQI GAO, ZIJIAN ZHANG, YUQIANG SUN, YE LIU等 译者：知道创宇404实验室翻译组 原文链接：https://arxiv.org/html/2602.03271v1 摘要 业务逻辑漏洞已成为智能合约中最具破坏性但最难以理解的漏洞类型之一。与重入攻击或算 ...

This week I'm in Hong Kong, and the day after recording, I gave the talk shown in the image above at INTERPOL's Cybercrime Expert Group. I posted a li ...

作者：Haoyun Yang, Ronghong Huang, Yong Fang等 译者：知道创宇404实验室翻译组 原文链接：https://arxiv.org/html/2601.22770v1 摘要 传输层安全（TLS）是保障在线通信安全的基础，但证书验证过程中的漏洞可能导致中间人（MitM ...

Author: Guancheng Li and Zheng Wang of Tencent Xuanwu Lab 本文是腾讯玄武实验室发布的《AI网络爬虫安全白皮书》。我们系统分析了 AI 时代服务端浏览器 / 爬虫在真实业务中的典型使用方式，以及由此带来的新的攻击面与风险。 在这篇白皮书中，我们 ...

作者：Narek Maloyan, Dmitry Namiot 译者：知道创宇404实验室翻译组 原文链接：https://arxiv.org/html/2601.17549v1 摘要 模型上下文协议（MCP）已成为大型语言模型（LLMs）与外部工具集成的事实标准，但目前尚未有针对该协议规范的正式安 ...

作者：Nitin Choudhury, Bikrant Bikram Pratap Maurya, Orchid Chetia Phukan, Arun Balaji Buduru 译者：知道创宇404实验室翻译组 原文链接：https://arxiv.org/html/2601.17638v1 摘 ...

It's the discussion about the reaction of some people in the UK regarding their impending social media ban for under 16s that bugged me most. Most not ...

作者：Marcell Szakály, Martin Strohmeier, Ivan Martinovic, Sebastian Köhler 译者：知道创宇404实验室翻译组 原文链接：https://arxiv.org/html/2601.15515v1 摘要 电动汽车（EV）的普及正迅速推进 ...

A new Internet-of-Things botnet called Kimwolf has spread to more than 2 million devices, forcing infected systems to participate in massive distribut ...

I thought Scott would cop it first when he posted about what his solar system really cost him last year. "You're so gonna get that stupid AI-slop resp ...

I’m in Oslo! Flighty is telling me I’ve flown in or out of here 43 times since a visit in 2014 set me on a new path professionally and, many years lat ...

Microsoft today issued patches to plug at least 113 security holes in its various Windows operating systems and supported software. Eight of the vulne ...

Remember the Ashley Madison data breach? That was now more than a decade ago, yet it arguably remains the single most noteworthy data breach of all ti ...

Our first story of 2026 revealed how a destructive new botnet called Kimwolf rapidly grew to infect more than two million devices by mass-compromising ...

15 mins and 40 seconds. That's how long it took to troubleshoot the first tech problem of 2026, and that's how far you'll need to skip through this vi ...

近期腾讯玄武实验室发现可视化 AI 工作流工具 ComfyUI 的官方扩展组件 ComfyUI-Manager 中存在一个高危漏洞（CVE-2025-67303）。利用该漏洞可在无需任何账号的情况下远程入侵安装 ComfyUI 的系统。玄武实验室在发现漏洞后向 ComfyUI 官方进行了报告，目前该 ...

The story you are reading is a series of scoops nestled inside a far more urgent Internet-wide security advisory. The vulnerability at issue has been ...

KrebsOnSecurity.com celebrates its 16th anniversary today! A huge "thank you" to all of our readers -- newcomers, long-timers and drive-by critics ali ...

The Trump administration has pursued a staggering range of policy pivots this past year that threaten to weaken the nation’s ability and willingness t ...

Direct navigation -- the act of visiting a website by manually typing a domain name in a web browser -- has never been riskier: A new study finds the ...

Microsoft today pushed updates to fix at least 56 security flaws in its Windows operating systems and supported software. This final Patch Tuesday of ...

Author: Guancheng Li of Tencent Xuanwu Lab 在当今数字世界中，RSA‑2048 与 ECC 等经典公钥密码是最广泛应用的加密标准，支撑着网络安全、金融交易和隐私保护的底层信任。然而，这一基石正面临量子计算的潜在威胁。理论上，量子计算机能够以远快于经典计算机的 ...

Author: Guancheng Li, Xiaolin Zhang and Yang Yu of Tencent Xuanwu Lab 2025 年 8 月，腾讯玄武实验室的阿图因自动化漏洞挖掘引擎在零知识证明库 gnark 中发现了一个高危漏洞（CVE-2025-57801，CVSS 8.6） ...