ISC Stormcast For Thursday, October 22nd, 2026 https://isc.sans.edu/podcastdetail/10146, (Thu, Oct 22nd)
ISC Stormcast For Thursday, October 22nd, 2026 https://isc.sans.edu/podcastdetail/10146, (Thu, Oct 22nd)
2026-10-22 归档
今日共收录 1761 条安全情报，包含 937 个 CVE，415 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging i
OpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So
OpenAI has revealed that two artificial intelligence (AI) agents powered by GPT-6.1 Sol and one GPT-6 Astra weakened mis
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an ac
Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands
Google on Tuesday said it's rolling out improved safeguards in its Chrome browser to secure users against ClickFix attac
China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors
Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bron
Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports
Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy word
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't
You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed
The Harness Is the Hard Part of Agentic Pentesting
An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to se
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection
U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases
U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any t
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. Acco
Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
Protections have been added against scams and social engineering, including new site warnings and server-side Gemini ana
‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets
Deceptive prompts lure AI agents into decoys and dead ends, cutting attack success by up to 91% in tests and raising the
Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime Security
Asymptote Labs raises $5.5M seed led by Tower Research Ventures to commercialize its Beacon AI agent runtime security pl
Memory Bugs Account for Most of Chrome’s 353 New Security Fixes
The update fixes 353 flaws, including 163 memory corruption and 125 use-after-free vulnerabilities. The post Memory Bugs
OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor
In two internal incidents, agents read routine coding instructions as permission to weaken monitoring, and one gave a fa
China Defends DeepSeek After US Ban of Its AI From Government Systems
The DHS said agencies should remove DeepSeek products as well as third-party products and services developed using DeepS