Canvas login portals hacked in mass ShinyHunters extortion campaign
The ShinyHunters extortion gang has breached education technology giant Instructure again, this time exploiting another
2026-05-09 归档
今日共收录 1190 条安全情报，包含 490 个 CVE，393 篇安全通告，以及 21 篇研究论文。
← 返回归档列表New TCLBanker malware self-spreads over WhatsApp and Outlook
A new trojan named TCLBanker, which targets 59 banking, fintech, and cryptocurrency platforms, uses a trojanized MSI ins
Australia warns of ClickFix attacks pushing Vidar Stealer malware
The Australian Cyber Security Center (ACSC) is warning organizations of an ongoing malware campaign using the ClickFix s
PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm-Like Across Cloud Systems
Cybersecurity researchers have disclosed details of a new credential theft framework dubbed PCPJack that targets exposed
One Click, Total Shutdown: The "Patient Zero" Webinar on Killing Stealth Breaches
The hardest part of cybersecurity isn't the technology, it’s the people. Every major breach you’ve read about lately usu
Active attack: Dirty Frag Linux vulnerability expands post-compromise risk
Dirty Frag is a newly disclosed Linux local privilege escalation vulnerability affecting kernel networking and memory-fr
NVIDIA confirms GeForce NOW data breach affecting Armenian users
NVIDIA has confirmed in a statement for BleepingComputer that GeForce NOW user information has been exposed in a data br
Why More Analysts Won’t Solve Your SOC’s Alert Problem
Attackers move faster than overwhelmed SOC teams can realistically investigate alerts. Prophet Security breaks down how
Trellix source code breach claimed by RansomHouse hackers
The attack on the Trellix source code repository disclosed last week has been claimed by the RansomHouse threat group, w
Zara data breach exposed personal information of 197,000 people
Hackers who gained access to the databases of Spanish fast-fashion retailer Zara stole data belonging to more than 197,0
Former govt contractor convicted for wiping dozens of federal databases
A 34-year-old Virginia man was found guilty of conspiring to destroy dozens of government databases after getting fired
New Linux 'Dirty Frag' zero-day gives root on all major distros
A new Linux zero-day exploit, named Dirty Frag, allows local attackers to gain root privileges on most major Linux distr
Quasar Linux RAT Steals Developer Credentials for Software Supply Chain Compromise
A previously undocumented Linux implant codenamed Quasar Linux RAT (QLNX) is targeting developers' systems to establish
‘PCPJack’ Worm Removes TeamPCP Infections, Steals Credentials
The malware framework targets web applications and cloud environments, including AWS, Docker, Kubernetes, and more. The
Ransomware Group Takes Credit for Trellix Hack
RansomHouse has published several screenshots to demonstrate access to internal Trellix services. The post Ransomware Gr
FedAttr: Towards Privacy-preserving Client-Level Attribution in Federated LLM Fine-tuning
该论文提出了一种名为 FedAttr 的新协议，用于在联邦学习（FL）环境下对大型语言模型（LLM）微调过程进行客户端级别的归属分析。传统的基于水印的放射性检测方法已证明在集中式LLM微调中有效，但在联邦学习中面临挑战：联邦学习依赖安全聚合
PACZero: PAC-Private Fine-Tuning of Language Models via Sign Quantization
本文提出 PACZero，一种基于 PAC（Probably Approximately Correct）隐私的零阶（Zeroth-Order）微调框架，旨在解决大语言模型（LLM）在强隐私保护下的可用性问题。核心思想是利用符号量化（Sig
网络安全信息与动态周报-2026年第12期
本报告为CNCERT发布的2026年第12期网络安全信息与动态周报，汇总了近期国内外网络安全态势。报告覆盖了多个方面：包括漏洞威胁通报（如操作系统、应用软件高危漏洞）、恶意程序活动（如僵尸网络、勒索软件家族动态）、网络攻击事件（如DDoS攻
网络安全信息与动态周报-2026年第13期
国家互联网应急中心（CNCERT）发布的2026年第13期网络安全信息与动态周报，汇总了近期国内外网络安全动态、漏洞威胁、攻击事件和预警信息。本期周报涵盖政府、通信、金融等关键行业的网络安全态势，包括重要漏洞通告、恶意程序传播、钓鱼活动监测
GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
Summary The patch for CVE-2026-42215 (GitPython 3.1.49) validates newlines only in the value parameter of set_value().