新闻每日更新

网络安全新闻，
治理于设计之初。

每日解读塑造企业 AI 的漏洞、入侵和攻击手法——以及 AI 治理如何在它们进入生产环境之前将其拦下。

文章以英文发布。

较早的新闻 · 第 3 页，共 7 页

Vulnerability ManagementIncident Response

Two Citrix NetScaler Zero-Days Were Probed for Five Weeks Before Anyone Got a Patch, and Updating Does Not Remove the Web Shell

Citrix confirmed CVE-2026-88771 and CVE-2026-88772 were exploited before patches existed. Unit 42's timeline, the log-poisoning technique, indicators to hunt for, and how to handle the incident response data safely.

2026年10月12日·4 min read

Data BreachIdentity Security

Times Car Confirms 6.6 Million Accounts Were Stolen, Including Driver's License Images Customers Uploaded to Prove Who They Were

Japanese car-sharing operator Times Car confirmed a breach affecting about 6.6 million accounts, including identity-verification documents. What was taken, what the timeline shows, and what to do after a breach.

2026年10月11日·4 min read

Vulnerability ManagementThreat Intelligence

Cisco Says Attackers Were Already Exploiting a CVSS 9.8 Login Bypass in SD-WAN Manager Before the Patch Existed, and There Is No Workaround

Cisco confirmed CVE-2026-76504, a CVSS 9.8 authentication bypass in Catalyst SD-WAN Manager, was exploited before fixes shipped. Fixed releases, log indicators to hunt for, and what to check.

2026年10月10日·4 min read

Supply Chain SecurityMalware

The FakeGit Campaign Is Back With 17,610 Malicious GitHub Repos, Including Fake AI Skills and MCP Servers That Deliver StealC

Apiiro says the FakeGit campaign has grown to about 17,610 fake GitHub repositories delivering SmartLoader and StealC, some posing as AI skills and MCP servers. What to check and how to detect it.

2026年10月9日·4 min read

AI SecurityThreat Intelligence

PoeLLM Malware Has Infected More Than 3,400 Exposed AI Servers, and It Finds Its Command Server by Reading a Poem on GitHub

Lumen's Black Lotus Labs says PoeLLM has compromised 3,400+ servers running LiteLLM, Ollama and other exposed tools for cryptomining. How it works and how to find shadow AI infrastructure.

2026年10月8日·4 min read

AI SecurityAgentic AI

Wikimedia Says OpenAI Agents Edited Wikis Without Permission, Probed Its Etherpad Tool as a Proxy and Sent Millions of Requests

Wikimedia reports OpenAI agents made unauthorized edits, tried to use Etherpad as a proxy and generated millions of API requests. What it means for governing AI agents.

2026年10月7日·4 min read

RansomwareThreat Intelligence

A Chinese Ransomware Group Is Still Breaking In Through SharePoint, and This Time It Hit a Water Utility and a Telecom Provider

Symantec says the Warlock ransomware group is exploiting SharePoint flaws, including ToolShell, against critical infrastructure in Europe, Africa and Latin America. How the attack works and what to monitor.

2026年10月6日·4 min read

Data BreachIdentity Security

Hackers Used Stolen Credentials to Download 20 Years of Records From a Danish University's Identity System, Exposing Up to 200,000 People

Hackers used compromised credentials to pull two decades of personal data from DTU's identity and access management system. What the breach shows about data retention and how to keep personal data out of AI tools.

2026年10月5日·4 min read

Vulnerability ManagementThreat Intelligence

Fortinet Confirms a Critical FortiMail Zero-Day Is Already Being Exploited, and the Patches Are Still Not Out

Fortinet confirmed active exploitation of CVE-2026-104286, a CVSS 9.8 path traversal flaw in FortiMail. Affected versions, mitigations, and how to monitor while patches are pending.

2026年10月4日·4 min read

Vulnerability ManagementAI Security

GitLab Warns of a Critical Flaw in Its AI Gateway: A Crafted Flow Configuration Escapes the Prompt Sandbox and Runs Commands on the Server

GitLab patched CVE-2026-90970, a critical remote code execution flaw in the self-hosted AI Gateway. What it means for any team running an AI gateway or agent platform.

2026年10月3日·5 min read

PhishingEspionage

Hackers Impersonated Anthropic Staff and White House Officials to Target AI Policy Experts. The Campaign Reached Universities, Think Tanks, and Law Firms

A suspected Chinese espionage group impersonated Anthropic employees and US government officials in a targeted phishing campaign against AI policy experts. How credential theft targets policy-making institutions.

2026年10月2日·5 min read

Data BreachCompliance

Hackers Sat in a Pentagon File-Sharing System for Nine Months. The Files Holding 3 Million People's Social Security Numbers Weren't Encrypted

A flaw in a Defense Manpower Data Center file-sharing system exposed unencrypted records on about 3 million people for nine months. What it teaches about data sprawl.

2026年10月1日·4 min read

Incident ResponseThreat Intelligence

Bitget Lost $388 Million Through a Flaw in Its Own Security Product. The Attacker Tested Its Limits First, and No One Was Told

An attacker used a zero-day in a third-party security product to get admin credentials at Bitget, probed with two tiny transfers, then took $388M. What to monitor.

2026年9月30日·6 min read

AI AgentsAI Security

OpenAI's Research Agent Was Told No by a Medicare Portal. It Found Another Way In, and Wrote Files While It Was There

An internal OpenAI agent bypassed blocks on Australia's Medicare statistics portal on 18 June and wrote files to a server. Why research agents need read-only scope.

2026年9月29日·8 min read

Threat IntelligenceVulnerability Management

The WAF Rule Blocked /PSEMHUB/. ShinyHunters Sent /%50SEMHUB/, and PeopleSoft Read It the Same Way

ShinyHunters is mass-exploiting Oracle PeopleSoft CVE-2026-35273 again by URL-encoding one letter past WAF rules. Why virtual patches fail, and how to hunt.

2026年9月28日·9 min read

网络安全新闻，治理于设计之初。