网络安全信息与动态周报-2026年第12期

本报告为国家互联网应急中心（CNCERT）发布的2026年第12期网络安全信息与动态周报。报告涵盖2026年3月30日至4月5日期间的网络安全态势，主要包括：境内感染网络病毒的主机数量、被篡改网站数量、漏洞通报情况、以及重点事件处置等。本周

历史摘要 · 未重新核验 · CNCERT

网络安全信息与动态周报-2026年第15期

本期周报由CNCERT（国家互联网应急中心）发布，为2026年第15期。报告汇总了该周国内外的网络安全动态，但由于输入中未提供具体正文内容，无法获知详细的攻击事件、漏洞信息或威胁态势。通常此类周报会涵盖漏洞预警、恶意程序活动、网络安全事件通

历史摘要 · 未重新核验 · CNCERT

ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key

## Summary Between 2026-02 and 2026-04-24 a total of 22 public PyPI sdists of `ogham-mcp` contained development credent

历史摘要 · 未重新核验 · GitHub Advisory

sequoia-git has broken hard revocation handling

Before `sq-git` checks if a commit can be authenticated, it first looks for hard revocations. Because parsing a policy

历史摘要 · 未重新核验 · GitHub Advisory

`mysten-metrics` was removed from crates.io for malicious code

`mysten-metrics` included a build script that attempted to exfiltrate data from the build machine. The malicious crate

历史摘要 · 未重新核验 · GitHub Advisory

`sui-execution-cut` was removed from crates.io for malicious code

`sui-execution-cut` included a build script that attempted to exfiltrate data from the build machine. The malicious cra

历史摘要 · 未重新核验 · GitHub Advisory

AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field

## Summary The `cleanUpString()` method in `ConfigWriter.php` uses an ungreedy regex to strip Liquidsoap string interpo

历史摘要 · 未重新核验 · GitHub Advisory

AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration

## Summary The `GET /api/station/{station_id}/file/{id}/play` endpoint, handled by `PlayAction`, is missing the `Middle

历史摘要 · 未重新核验 · GitHub Advisory

AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption

## Summary The `/api/internal/{station_id}/liquidsoap/{action}` endpoint is accessible from the public web interface be

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes

## Summary OpenShell FS bridge reads pin and verify the opened file before returning bytes ## Affected Packages / Versi

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root

## Summary OpenShell FS bridge writes stay pinned to the sandbox mount root. ## Affected Packages / Versions - Package:

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs

## Summary Exec allowlist analysis rejects shell expansion in unquoted heredocs. ## Affected Packages / Versions - Pack

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens

## Summary MCP loopback owner context is derived from server-issued bearer tokens. ## Affected Packages / Versions - Pa

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Workspace dotenv files cannot override connector endpoint hosts

## Summary Workspace dotenv files cannot override connector endpoint hosts. ## Affected Packages / Versions - Package:

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw's ACP child sessions inherit subagent security envelope constraints

## Summary ACP child sessions inherit subagent security envelope constraints. ## Affected Packages / Versions - Package

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw validates Zalo outbound photo URLs through the SSRF guard

## Summary Zalo outbound photo URLs are validated through the SSRF guard. ## Affected Packages / Versions - Package: op

历史摘要 · 未重新核验 · GitHub Advisory

CVE-2026-22738-Spring AI SimpleVectorStore 中的 SpEL 注入导致远程代码执行漏洞分析

CVE-2026-22738

CVE-2026-22738-Spring AI SimpleVectorStore 中的 SpEL 注入导致远程代码执行漏洞分析

历史摘要 · 未重新核验 · 先知社区

Over 40,000 Servers Compromised in Ongoing cPanel Exploitation

CVE-2026-41940

The attacks likely target CVE-2026-41940, a recently patched zero-day leading to administrative access. The post Over 40

历史摘要 · 未重新核验 · SecurityWeek

Detecting Adversarial Data via Provable Adversarial Noise Amplification

本文研究了深度神经网络中对抗性噪声在不同层间的非均匀传播现象，并首次从理论上给出了形式化的对抗噪声放大定理。作者推导出一组充分条件，保证对抗噪声在特定层或特征空间中以可预测的方式放大，从而为对抗样本检测提供了坚实的数学基础。基于理论分析，他

历史摘要 · 未重新核验 · arXiv cs.CR

The 1-Bit Barrier is Universal: k-Stage Pipeline Composition and Unified Leakage Bounds for Standard Modular Reductions in PQC Hardware

本文是后量子密码（PQC）硬件中掩码数论变换（NTT）管道形式化验证系列的第7篇论文。该系列前期工作（Paper 1-6）已为QANARY平台建立结构依赖分析、部分掩码下安全边界、Barrett归约的PF-PINI(2)属性、2级组合定理、

历史摘要 · 未重新核验 · arXiv cs.CR