August 2026 Patch Tuesday: One Exploited Zero-Day and 62 Critical Vulnerabilities Among 415 CVEsAug 11, 2026
August 2026 Patch Tuesday: One Exploited Zero-Day and 62 Critical Vulnerabilities Among 415 CVEsAug 11, 2026
2026-08-19 归档
今日共收录 2403 条安全情报，包含 1575 个 CVE，408 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Apple Screen Sharing Security, (Mon, Aug 17th)
About 20 years ago, with macOS 10.5 (Leopard), Apple introduced screen sharing. Apple did not invent a new protocol for
Hacker claims 3.6 million Azure account records stolen from major companies
A threat actor is selling employee databases allegedly stolen from the Microsoft Azure infrastructure of multiple Fortun
Pokémon Center data breach exposes customer info, cancels some orders
Pokémon Center is notifying customers in the United Kingdom and Germany that it suffered a third-party data breach after
Microsoft confirms GitHub is down worldwide
GitHub is down for some users as a widespread outage is causing errors across the website, API, Actions, Pull Requests,
Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
Cybersecurity researchers have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framew
Hunting MacSync Stealer infrastructure through behavioral pivots
MacSync Stealer rapidly rotates domains to evade detection, but its behavior remains consistent. Learn how Microsoft unc
Teaching AI to Reason Through Detection TriageAug 17, 2026
Teaching AI to Reason Through Detection TriageAug 17, 2026
Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect
Research by: Jaromír Hořejší (@JaromirHorejsi) Key points Introduction We first noticed a ransomware family called StopA
Clop created custom web shell for Windchill data theft attacks
A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPL
Your Controls Block Known Attacks. What About the Behavior?
Security controls can block a familiar attack method while missing quieter ways to achieve the same objective. Picus Sec
Microsoft tests faster Windows File Explorer, new context menu
Microsoft has started testing a faster File Explorer and a less cluttered and more customizable context menu in Windows
CISA: Windows Task Host flaw now exploited by ransomware gangs
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting
Microsoft confirms outage affecting search in Microsoft 365 apps
Microsoft says some users are experiencing issues searching in Microsoft 365 apps, including Outlook on the web, Outlook
Microsoft starts removing WMIC tool used by cybercriminals
Microsoft announced that it removed the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 24H2
Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence (AI) platform, and FUXA, an open-s
Measuring Obedience to Authority Across Large Language Models with the Milgram Paradigm
这篇 arXiv 论文将社会心理学中经典的米尔格拉姆服从权威实验移植到大语言模型（LLM）上，系统测量了 LLM 在权威指令下会执行多大程度的有害行为。作者设计了一个完全脚本化、可复现的测试框架：模型扮演“教师”角色，一个确定性的测试环境扮
The Model's Tell: Measuring Context-Leakage Attack Signals with Behavior Gauges
本文研究了大语言模型（LLM）在处理外部上下文（如系统提示、检索文档）时面临的上下文泄露风险。尽管已有研究在隐藏状态中发现泄露相关信号，但提取隐藏状态在实际部署中存在困难。作者提出LeakGauge方法，通过在后缀中附加一个“测量”后缀，利
SpecTrum: Specification-Guided Differential Fuzzing for Ethereum Consensus Clients
该论文提出 SpecTrum，一个面向以太坊共识客户端的规范引导差分模糊测试框架。背景：以太坊共识安全依赖于多个独立实现的共识客户端对每个状态转换达成一致。若实现出错导致分歧，可能引发网络分叉、最终性停滞乃至严重攻击。为防止此类分歧，以太坊
BullsEye: Directed Firmware Fuzzing
该论文针对物联网固件中第三方组件复用带来的已知漏洞问题，提出了一种新的定向模糊测试框架BULLSEYE。定向灰盒模糊测试（DGF）能够将测试资源导向特定二进制位置，但现有方法在固件领域仅能达到函数粒度，无法精确瞄准易受攻击的代码块。BULL