CrowdStrike与Zscaler宣布合作，将持续的动态身份验证能力集成到零信任访问框架中。该合作旨在将CrowdStrike Falcon平台的身份威胁检测与Zscaler Zero Trust Exchange的访问控制相结合，实现实时风险评分、自适应访问策略和持续身份验证，以应对身份盗窃、凭证滥用等威胁。合作双方强调，通过共享身份遥测数据，可在用户会话期间持续评估信任等级，一旦检测到异常行为立即触发访问撤销或二次认证。该解决方案面向企业远程办公、云迁移等场景，可减少攻击面并简化安全运维。CrowdStrike的EDR能力与Zscaler的SWG/ZTNA形成互补，提供端到端的身份安全防护。文章中未提及具体的漏洞、攻击事件或恶意软件活动，属于产品与战略合作消息。

From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise

Next-Gen Identity Security

CrowdStrike Named a Leader in Identity Threat Detection and Response

CrowdStrike Expands Identity Leadership with OpenID and IDPro

Frontier AI for Defenders: CrowdStrike and OpenAI TAC

Anthropic Claude Mythos Preview: The More Capable AI Becomes, the More Security It Needs

The Architecture of Agentic Defense: Inside the Falcon Platform

From The Front Lines

Introducing the CrowdStrike Shadow AI Visibility Service

CrowdStrike Flex for Services Expands Access to Elite Security Expertise

Next-Gen SIEM & Log Management

Falcon Next-Gen SIEM Supports Third-Party EDR Tools, Starting with Microsoft Defender

Falcon Next-Gen SIEM Simplifies Onboarding with Sensor-Native Log Collection

CrowdStrike Technical Risk Assessments Reveal Common Exposure Patterns

How to Protect Identities and Sessions from Infostealers

CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms

CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud

CrowdStrike Falcon Platform Achieves 441% ROI in Three Years

Threat Hunting & Intel

Endpoint Security & XDR

Engineering & Tech

EMBER2024: Advancing the Training of Cybersecurity ML Models Against Evasive Malware

Falcon Platform Prevents COOKIE SPIDER’s SHAMOS Delivery on macOS

CrowdStrike’s Approach to Better Machine Learning Evaluation Using Strategic Data Splitting

CrowdStrike Researchers Develop Custom XGBoost Objective to Improve ML Model Release Stability

Executive Viewpoint

Frontier AI Is Collapsing the Exploit Window. Here’s How Defenders Must Respond.

CrowdStrike Named a Leader in the First-Ever Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies

Inside CrowdStrike Automated Leads: A Transformative Approach to Threat Detections

Now Live: The CrowdStrike 2026 Financial Services Threat Landscape Report

Disrupting Glassworm: Inside CrowdStrike’s Takedown of a Developer-Targeting Botnet

CrowdStrike Named a Leader in 2026 Gartner® Magic Quadrant™ for Endpoint Protection for Seventh Consecutive Time

How to Stop AI-Driven Data Loss

CrowdStrike 2026 Technology Threat Landscape Report: China’s Ambitions Fuel Attacks

Cloud & Application Security

CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security

Video Highlights the 4 Key Steps to Successful Incident ResponseDec 02, 2019

Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO]Feb 21, 2019

Analyzing Targeted Intrusions Through the ATT&CK Framework Lens [VIDEO]Jan 22, 2019

Qatar’s Commercial Bank Chooses CrowdStrike Falcon®: A Partnership Based on Trust [VIDEO]Aug 20, 2018

How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem

CrowdStrike Services and Agentic MDR Put the Agentic SOC in Reach

4 Ways Businesses Use CrowdStrike Charlotte AI to Transform Security Operations

Falcon AIDR Detects Threats at the Prompt Layer in Kubernetes AI Applications

New Claude Integration Brings Audit Data into the Falcon Platform

June 2026 Patch Tuesday: Microsoft Patches 206 Vulnerabilities Including Three Publicly Disclosed Zero-DaysJun 09, 2026

Mandiant 发布报告称，KnowledgeDeliver 产品中存在 ViewState 反序列化漏洞，并已被攻击者利用。ViewState 是 ASP.NET 用于保存页面状态的一种机制，如果应用程序对 ViewState 数据未进行充分的签名或验证，攻击者可以通过构造恶意 ViewState 字符串触发反序列化，从而实现远程代码执行。Mandiant 观察到野外利用活动，但未公开具体攻击者归属、受害者行业或地域分布。报告未提供 CVE 编号或具体攻击技术细节。建议用户尽快升级 KnowledgeDeliver 至最新版本，并对 ASP.NET ViewState 启用加密和签名校验。

Threat IntelligenceNorth Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain AttackBy Google Threat Intelligence Group • 16-minute read

Google Cloud Products

Threat Intelligence RSS feed URL

Threat IntelligenceSnow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware SuiteBy Mandiant • 26-minute read

Threat IntelligenceDefending Your Enterprise When AI Models Can Find Vulnerabilities Faster Than EverBy Francis deSouza • 13-minute read

Threat IntelligenceThe German Cyber Criminal Überfall: Shifts in Europe's Data Leak LandscapeBy Google Threat Intelligence Group • 5-minute read

Threat IntelligencevSphere and BRICKSTORM Malware: A Defender's GuideBy Mandiant • 62-minute read

Threat IntelligenceWelcome to BlackFile: Inside a Vishing Extortion OperationBy Google Threat Intelligence Group • 16-minute read

Threat Intelligence2 PhaaS 2 Furious: The Evolution of Chinese-Language Phishing ServicesBy Google Threat Intelligence Group • 7-minute read

Threat IntelligenceSeeking Counsel: Ongoing Targeted Campaign Against US Law FirmsBy Mandiant • 19-minute read

Threat IntelligenceShinyHunters Targets Education Sector with Oracle PeopleSoft ExploitBy Mandiant • 12-minute read

SAP on Google Cloud

Inside Google Cloud

Google Cloud Next & Events

Google Cloud Consulting

Transform with Google Cloud

Infrastructure Modernization

Productivity & Collaboration

Storage & Data Transfer

Financial Services

Healthcare & Life Sciences

Media & Entertainment

Telecommunications

Training & Certifications

Google Maps Platform

Google Workspace

Developers & Practitioners

GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access

Security & Identity

Jump to Content

Get started for free

AI & Machine Learning

Application Development

Application Modernization

Chrome Enterprise

Containers & Kubernetes

Maps & Geospatial

Threat Intelligence

输入情报内容缺失，仅提供了标题“京公网安备 11000002002063号”和来源为360CERT安全报告，但实际URL指向公安局备案页面，未包含任何威胁情报描述、技术细节或攻击活动信息。由于缺乏有效内容，无法提取攻击事件、战术技术或影响范围。

该输入为网站备案号信息，并非威胁情报内容。未发现任何攻击活动、恶意软件、漏洞或安全事件相关细节。

该输入为一个来自360CERT的安全报告页面，标题为“京网文〔2020〕6051-1195号”，该标题实际对应的是北京市网络文化经营许可证编号，而非威胁情报内容。页面标签包含360、APT、恶意软件、报告，但摘要正文为空，未提供任何具体的攻击活动、技术细节或IOC。由于缺乏实际情报内容，本文无法提取有效威胁信息。

本次输入内容为一条来自360CERT安全报告的记录，但标题为备案信息，URL指向工信部备案系统，摘要为空，未提供任何有效威胁情报细节。标签包含360、apt、malware、report，但无具体内容支撑，无法确认是否存在实际攻击活动。报告可能为占位符或错误条目。

Unit 42 has discovered a new macOS Tahoe 26 forensic artifact that tracks user menu selections across the operating system. Learn more here. The post Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered appeared first on Unit 42.

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Opera

2026年6月11日，CISA发布了一份关于Yarbo Android/iOS移动应用及其云基础设施的工业控制系统（ICS）公告。该公告披露了两个高危漏洞：CVE-2026-10557（硬编码凭据，CVSS 9.8）和CVE-2026-7368（授权缺失，CVSS 8.1）。Yarbo移动应用（版本低于3.17.4）包含硬编码的MQTT代理凭据，这些凭据在所有用户和所有设备中相同，且可通过APK反编译轻松提取。攻击者利用这些凭据可以访问云MQTT代理，订阅所有机器人遥测主题（通配符订阅），并通过仅知道机器人序列号即可向任何机器人的命令主题发布指令。此外，云基础设施缺少每设备或每用户授权，即使移除了硬编码凭据，单个被攻陷的合法凭据仍可导致整个机器人车队被控制。受影响的产品包括Yarbo Android/iOS移动应用（<3.17.4）以及Yarbo云MQTT基础设施（所有版本）。Yarbo建议用户将移动应用更新至3.17.4或更高版本，服务器端代理授权将在2026年5月更新后自动生效。这些漏洞影响商业设施行业，全球部署，公司总部位于中国。此公告由Truesec的Markus Lassfolk报告给CISA。漏洞本身无需用户交互即可远程利用，可导致遥测数据泄露和机器人操作指令的未授权发送，对运营安全构成严重威胁。

美国网络安全和基础设施安全局（CISA）发布ICS公告，披露Brickcom摄像头产品中存在两个高危漏洞。CVE-2026-50245涉及/ONVIF端点缺少关键功能认证，允许远程未授权攻击者访问实时快照图像；CVE-2026-50005则是设备使用默认凭据，攻击者无需认证即可获取摄像头视频流。受影响型号包括Brickcom Cube、Dome、Bullet、Box，固件版本均为3.2.3.5.6。这些漏洞组合利用可让攻击者获得摄像机管理控制权，窃取敏感视觉信息。Brickcom未响应CISA的协调请求，目前无官方补丁。CISA建议用户采取网络隔离、部署防火墙、使用VPN等缓解措施，并对设备进行风险评估。该漏洞影响全球部署，涉及商业设施、关键制造、金融服务、医疗保健等多个关键基础设施领域。CISA同时指出问题发现者已发布概念验证代码，但公告未提及在野利用证据。

2026年6月11日，美国网络安全和基础设施安全局（CISA）将CVE-2026-10520（Ivanti Sentry操作系统命令注入漏洞）添加到其已知被利用漏洞（KEV）目录中，原因是存在主动利用的证据。该漏洞影响Ivanti Sentry产品，允许未经身份验证的攻击者通过发送特制请求执行任意操作系统命令，从而完全控制受影响的资产。CISA在公告中重申了《约束性操作指令（BOD）26-04：基于风险优先进行安全更新》的要求，该指令更新了BOD 22-01，并强化了KEV目录的重要性。BOD 26-04要求联邦民事行政分支（FCEB）机构优先修复高风险漏洞，特别是那些在公开暴露资产上被利用后能获得完全控制权的CVE，同时延迟处理低风险漏洞。此外，该指令还要求机构在应用补丁前检查威胁行为者是否已入侵系统。虽然BOD 26-04仅适用于FCEB机构，但CISA鼓励所有组织采用基于风险的漏洞管理，并优先修复KEV目录中的漏洞。CISA将继续向目录中添加符合指定标准的漏洞。值得注意的是，尽管该公告的标签包含'Conti'，但正文并未提及与Conti勒索软件团伙或其他特定威胁行为者的直接关联，可能为误标。建议受影响组织立即应用Ivanti提供的补丁，并检查系统是否存在后利用迹象。

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to impersonate devices, intercept or manipulate communications, harvest sensitive credentials at scale, or gain unauthorized access. The following versions of Naxclow IoT Platform are affected: Smart Doorbell X3 vers:all/*  X Smart Home vers:all/*  V720 vers:all/*  ix cam vers:all/*  CVSS Vendor Equipm

Protect enterprise AI agents from supply chain risks by auditing third-party skills for hidden vulnerabilities and multi-stage attack chains. The post Trust No Skill: Integrity Verification for AI Agent Supply Chains appeared first on Unit 42.

A shift in operational pattern of the infamous Vietnam-aligned APT group

Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse

CrowdStrike Falcon Cloud Security Delivered 264% ROI Through Unified Cloud Protection

CrowdStrike Launches Falcon OverWatch for Defender

ISO 42001:2023 and the New Reality of Cloud AI Data RiskJun 04, 2026

3 Principles to Safely Scale Agentic AIJun 05, 2026

Threat IntelligenceM-Trends 2026: Data, Insights, and Strategies From the FrontlinesBy Jurgen Kutscher • 8-minute read

Unit 42 research examines attack scenarios targeting cloud logging services. Learn how to defend against log manipulation and defense evasion. The post Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility appeared first on Unit 42.

Learn how to investigate AI activity in Microsoft 365 Copilot and Azure AI services using a structured, telemetry-driven approach. This playbook helps security teams reconstruct events, assess data exposure, and detect potential threats faster. The post Reconstructing AI activity in investigations  appeared first on Microsoft Security Blog.

We include indicators of activity and mitigations for PAN-OS vulnerability CVE-2026-0257. The post Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 appeared first on Unit 42.

2026年6月9日，美国网络安全与基础设施安全局（CISA）发布了施耐德电气（Schneider Electric）EcoStruxure Panel Server系列产品中存在的一个高危漏洞公告（ICSA-26-160-03）。该漏洞编号为CVE-2026-6866，属于CWE-1188（资源的不安全默认初始化）类型。漏洞存在于多个型号和版本中，包括PAS800、PAS800V2、PAS600、PAS600V2、PAS400，受影响版本为002.005.000及更早版本以及002.006.000（仅部分型号）。在罕见情况下，设备的凭据会意外恢复为出厂默认设置，攻击者利用已知的默认凭据可执行未授权认证，从而可能访问敏感信息。CVSS v3.1评分为7.5（高危），攻击复杂度低，无需用户交互，且可远程利用。施耐德电气已在固件版本002.006.000中修复了该漏洞，用户需下载并安装对应型号的固件更新，并重新启动设备。该漏洞影响全球部署的商用设施、关键制造业和能源行业的关键基础设施。目前CISA未报告在野利用或公开PoC。建议所有受影响的用户立即升级固件，并检查系统是否存在异常访问活动。

2026年6月9日，CISA发布了一份关于施耐德电气Modicon系列网络管理型交换机中RADIUS协议漏洞的安全公告。该漏洞编号为CVE-2024-3596，属于通信通道消息完整性执行不当（CWE-924）。当交换机的RADIUS服务器消息认证选项（Message Authenticator）被禁用时，攻击者通过伪造RADIUS响应（Access-Accept、Access-Reject或Access-Challenge），可能导致设备拒绝服务或机密性和完整性受损。该漏洞的CVSS v3.1评分为9.0（严重），攻击向量为网络，攻击复杂度较高，无需权限或用户交互，影响范围包括商业设施、能源、食品与农业、政府、交通运输、水务等关键基础设施领域。受影响的产品涵盖Connexium Managed Switches、Modicon Managed Switches和Modicon Redundancy Switches的所有版本。施耐德电气已确认该漏洞，并建议用户保持Message Authenticator选项的默认启用状态。该参数可通过CLI或SNMP进行配置。此外，公告还提供了一般性网络安全建议，如将控制系统网络与业务网络隔离、实施物理访问控制等。目前该漏洞暂无在野利用报告，但鉴于关键基础设施的广泛部署，风险较高。

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-7473 Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability CVE-2026-11645 Google Chromium V8 Out-of-Bounds Read and Write Vulnerability CVE-2026-20245 Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of O

View CSAF Summary KACO blueplanet Inverters contain multiple vulnerabilities that could allow an attacker to derive the credentials from the devices serial number and misuse them to gain unauthorized access. KACO new energy GmbH has released new versions for several affected products and recommends to update to the latest versions. KACO new energy GmbH is preparing further fix versions and recomme

Every organisation gets audited. The question is who does the auditing.

Attackers are increasingly targeting collaboration platforms like Microsoft Teams. Learn the risks and key steps to strengthen your organization's security. The post When “Hi, This Is IT” Comes Through Microsoft Teams appeared first on Unit 42.

As threat actors operationalize AI to accelerate attacks, they are also leveraging the wider global interest around AI itself as a social engineering lure. The post AI brands as bait: How threat actors are using the AI hype in social engineering appeared first on Microsoft Security Blog.

CISA于2026年6月8日更新了已知被利用漏洞（KEV）目录，新增两个被积极利用的漏洞：CVE-2026-42271（BerriAI LiteLLM命令注入漏洞）和CVE-2026-50751（Check Point安全网关认证不当漏洞）。LiteLLM是一个用于管理大型语言模型API调用的开源库，该命令注入漏洞可能允许攻击者在受影响系统上执行任意命令；Check Point安全网关认证不当漏洞则可能使攻击者绕过认证机制，获得未授权访问。CISA依据《约束性操作指令》（BOD）22-01要求联邦民事行政部门（FCEB）机构在截止日期前修复这些漏洞，并强烈建议所有组织将其纳入漏洞管理优先级。虽然公告未提供具体攻击活动细节，但标记了Conti勒索软件家族，暗示这些漏洞可能被Conti或其他威胁行为者利用。两个漏洞均影响关键基础设施，需紧急修补。

CrowdStrike FalconID Brings Phishing-Resistant MFA to Falcon Next-Gen Identity Security

CrowdStrike Brings Enterprise-Grade Security to the AI Factory with NVIDIA Vera BlueField-4 STXJun 01, 2026

CrowdStrike Scales AI-Native Agents Across Falcon Exposure Management with NVIDIAJun 01, 2026

Microsoft Threat Intelligence identified a prompt injection pathway in Claude Code GitHub Action that allowed access to workflow secrets under specific conditions. This research examines the attack chain, responsible disclosure process, Anthropic's mitigation, and guidance for securing AI-powered CI/CD workflows. The post Securing CI/CD in an agentic world: Claude Code Github action case appeared

2026年6月5日，美国网络安全和基础设施安全局（CISA）将CVE-2026-28318添加到已知被利用漏洞目录（KEV）。该漏洞影响SolarWinds Serv-U产品，属于不受控制的资源消耗漏洞（Uncontrolled Resource Consumption），攻击者可利用该漏洞导致服务拒绝或资源耗尽。CISA依据BOD 22-01指令，要求联邦文职行政分支机构（FCEB）在规定期限内修复该漏洞，以降低已知被利用漏洞带来的风险。虽然该指令仅对FCEB机构具有强制力，但CISA强烈建议所有组织优先修复KEV目录中的漏洞，以减少网络攻击面。目前已有证据表明该漏洞正在被积极利用，恶意软件家族Conti可能与之关联，但具体攻击组织尚未明确。该漏洞的利用可能对受影响系统造成拒绝服务，进而影响业务连续性。组织应立即应用SolarWinds提供的安全更新，并检查环境中是否使用受影响版本。

A surge in real-world attacks against agentic AI systems is reshaping how we think about risk. Based on 12 months of red teaming, this update introduces seven new failure modes, from supply chain compromise to goal hijacking, and the practical mitigations teams need now. The post Updating the taxonomy of failure modes in agentic AI systems: What a year of red teaming taught us  appeared first on M

Secure Shadow AI at the Control Plane with Falcon for ITJun 01, 2026

Threat IntelligenceThe Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat ActorsBy Google Threat Intelligence Group • 34-minute read

2026年6月3日，美国网络安全与基础设施安全局（CISA）将编号为 CVE-2026-45247 的漏洞添加至其已知被利用漏洞（KEV）目录。该漏洞存在于 Mirasvit Full Page Cache Warmer 组件中，属于反序列化不可信数据漏洞，攻击者可以通过特制的序列化数据触发任意代码执行。CISA 依据明确在野利用证据将其列入 KEV，并依据具有约束力的操作指令（BOD）22-01，要求联邦民事行政部门（FCEB）机构在规定日期前完成修复。尽管该指令仅适用于联邦机构，CISA 仍强烈建议所有组织优先修复此类已遭利用的漏洞以降低攻击风险。漏洞类型为反序列化，常被网络犯罪分子用于入侵系统，对联邦企业构成重大威胁。关联的恶意软件家族标签包含 Conti，但原文未明确该漏洞与 Conti 勒索软件的具体关联。漏洞影响的版本范围尚未披露，建议用户立即更新至最新版本或应用供应商提供的补丁。

Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management

Microsoft Threat Intelligence 披露了一起大规模 npm 供应链攻击活动，代号 Miasma。攻击者入侵了 Red Hat 的 npm 组织 @redhat-cloud-services，篡改了超过 90 个版本的合法 package，在 CI/CD 环境和开发者机器中植入恶意代码。该恶意代码会窃取 GitHub 令牌、云服务凭证（如 AWS、Azure）以及本地存储的敏感信息，并通过蠕虫式传播机制，利用已感染的信任关系向其他项目自动推送恶意更新。攻击者在软件供应链的早期阶段（预安装脚本）执行恶意负载，实现了持久化驻留。受影响的主要是依赖 Red Hat 云服务组件的开发者和企业，可能引发大规模凭证泄露和横向移动。微软建议立即审计受影响的 npm 包版本，轮换所有可能暴露的凭证，并加强 CI/CD 管道的安全控制。

Palo Alto Unit 42 于2026年6月2日更新了关于 npm 供应链威胁格局的报告。报告指出，自 Shai Hulud 事件以来，npm 生态系统面临的攻击面持续演化，出现了可蠕虫式传播的恶意软件、针对 CI/CD 管道的持久化机制以及多阶段攻击等新型威胁。这些攻击通常利用软件包依赖关系、混淆技术以及自动化构建流程中的漏洞，在开发者环境中植入后门，进而影响下游用户。报告强调了 npm 作为关键软件供应链环节的脆弱性，并讨论了包括包签名验证、依赖审计、最小权限原则、CI/CD 安全加固在内的缓解措施。尽管未披露具体样本或 IOC，但该分析为安全团队理解当前 npm 威胁态势提供了重要参考。

Discover how Microsoft enables fast, secure AI development with MDASH and new security capabilities. The post Microsoft Build 2026: Securing code, agents, and models across the development lifecycle appeared first on Microsoft Security Blog.

2026年6月2日，美国网络安全与基础设施安全局（CISA）联合联邦调查局（FBI）、国家安全局（NSA）、能源部（DOE）、环保署（EPA）、运输安全管理局（TSA）、交通部（DOT）及农业部（USDA）发布联合公告，指出近期观察到针对美国自动油箱表（ATG）系统的恶意网络活动。ATG系统广泛应用于能源、化工、食品与农业、运输系统等行业，用于远程监控储罐参数（如液位、温度、泄漏检测）。威胁行为者通过互联网暴露的ATG系统实施入侵，利用认证绕过、硬编码凭据、操作系统命令执行、SQL注入、权限提升等多种漏洞，获取设备管理界面访问权限，进而执行任意代码、操作数据库并获取完全管理员权限。攻击者可能篡改系统属性（网络设置、产品标识、油罐容量、泵控制），导致操作故障（如罐填充水平不可见），甚至禁用系统警报，增加泄漏或继电器故障等环境或物理危害风险。目前美国政府尚未将攻击归因于特定国家或组织。公告强烈建议所有ATG所有者与运营商立即采取行动：消除公网暴露（关闭默认TCP端口8001、9001、10001等），使用防火墙、ACL或VPN限制远程访问；更改所有默认密码，实施强密码和防范钓鱼的多因素认证；联系认证服务提供商进行合规检查、软件更新和安全补丁安装。

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2022-0492 Linux Kernel Improper Authentication Vulnerability CVE-2025-48595 Android Framework Integer Overflow Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enter

该论文针对高级持续性威胁（APT）恶意软件归因问题提出了一种高精度方法。现有方法通常作为闭集分类器在有限数量的已知APT组上进行训练和评估，但在实际运营环境中，分类器可能遇到来自训练中未出现的组的样本，闭集分类器会错误地将这些样本归入已知组，导致无根据且可能误导的归因。为了解决这一问题，作者提出了一种基于排序二元分类器并带有显式弃权机制的APT恶意软件归因方法。该方法不是训练单个多类分类器，而是为每个APT组训练并调优两个二元分类器，根据验证性能对分类器进行排序，并顺序应用它们。只有当分类器提供足够证据时才对样本进行归因；否则，弃权。论文在APT恶意软件数据集以及一个旨在测试超出范围行为的更大组合数据集上进行了评估。在APT恶意软件数据集上，该方法达到了比先前发布结果更高的精确度。在最具挑战性的设置中（87%的测试样本来自训练中排除的60个APT组），该方法对94%的超出范围样本弃权，同时在其分类的样本上保持了92%的精确度和95%的选择性准确率。该工作的主要贡献在于提供了一种实用且可靠的开放世界APT归因技术，能够有效处理未知组样本，减少误报，提高威胁情报的可信度。

Operation FlutterBridge is a malvertising campaign targeting macOS users. It distributed the new backdoor FlutterShell, built using the Flutter framework. The post Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor appeared first on Unit 42.

Shadow AI: The Hidden Risk Expanding Across the EnterpriseMay 29, 2026

2026年6月1日，美国网络安全与基础设施安全局（CISA）将CVE-2024-21182添加到已知被利用漏洞（KEV）目录中。该漏洞是Oracle WebLogic Server中的一个未指定漏洞，根据证据已被积极利用。CISA依据具有约束力的操作指令（BOD）22-01，要求联邦民事行政部门（FCEB）机构在规定日期内修复此漏洞，以保护其网络免受活跃威胁。虽然BOD 22-01仅适用于FCEB机构，但CISA强烈建议所有组织优先修复KEV目录中的漏洞。该漏洞的利用可能允许攻击者未经授权访问或执行代码，对联邦企业构成重大风险。标签中提及Conti勒索软件家族，可能暗示该漏洞曾被Conti或其他APT组织使用，但原公告未提供具体归因或攻击链细节。CISA将持续根据标准向目录添加新漏洞。

Enhanced Network Visibility: A Dive into the Falcon macOS Sensor's New Capabilities

Measuring AI-Enabled Success: 3 KPIs Leaders Should TrackMay 22, 2026

A dependency confusion campaign leveraged 33 malicious npm packages to collect reconnaissance data from developer and build environments. This report details the attack chain, observed tradecraft, and detection opportunities to help organizations identify and disrupt related activity. The post Malicious npm packages abuse dependency confusion to profile developer environments appeared first on Mic

Microsoft is named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. The post Microsoft is named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection appeared first on Microsoft Security Blog.

2026年5月29日，美国网络安全和基础设施安全局（CISA）将一个新的漏洞CVE-2026-0257添加到其已知被利用漏洞（KEV）目录中，原因是存在主动利用的证据。该漏洞是Palo Alto Networks PAN-OS的身份验证绕过漏洞，属于高危类型，经常被恶意网络行为者用作攻击载体，对联邦企业构成重大风险。根据行政指令BOD 22-01，联邦民事行政分支机构（FCEB）机构必须在规定日期前修复该漏洞，以保护其网络免受活跃威胁。尽管BOD 22-01仅适用于FCEB机构，CISA强烈建议所有组织优先修复KEV目录中的漏洞，将其纳入漏洞管理实践，以降低遭受网络攻击的风险。CISA将继续根据特定标准向目录添加漏洞。本次通报未提供具体的攻击指标（IoC）、攻击者归属或相关恶意软件家族信息，但标签中提及Conti，可能暗示该漏洞曾被Conti勒索软件组织利用，但原文未明确证实。由于CVE-2026-0257已被证实存在在野利用，攻击者可能利用该漏洞绕过身份验证，获取未授权访问权限，进而执行后续攻击活动。组织应立即评估自身受影响程度，并采取缓解措施。

The Mini Shai-Hulud campaign used malicious npm packages to target cloud and CI/CD credentials across developer environments. This report details the attack chain, detection opportunities, and mitigation guidance to help organizations identify and disrupt related activity. The post Typosquatted npm packages used to steal cloud and CI/CD secrets appeared first on Microsoft Security Blog.

Unit 42 explores trends in data theft and extortion, outlining key strategies for organizations as frontier AI models advance. The post Out of the Crypt: The Evolving Cyber Extortion Economy appeared first on Unit 42.

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-8398 Daemon Tools Lite Embedded Malicious Code Vulnerability CVE-2026-45321 TanStack Unspecified Vulnerability CVE-2026-48027 Nx Console Embedded Malicious Code Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cybe

Microsoft exposes a cryptojacking campaign using SEO poisoning and ScreenConnect to target high-performance PCs, with malicious sites also surfaced through AI chatbots. The post From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities appeared first on Microsoft Security Blog.

CISA发布了一份关于ABB Terra AC电动汽车充电桩漏洞的公告（ICSA-26-146-01）。该漏洞被编号为CVE-2025-5517，属于堆缓冲区溢出（CWE-122），CVSS评分为6.8（中等）。攻击者可以利用不安全的HTTP通信或已攻陷的充电站管理系统（CSMS）发送特制的OCPP消息，触发堆内存污染，进而可能导致远程控制设备并篡改固件。受影响的产品包括ABB Terra AC壁挂式充电桩的多款型号（UL40/80A、UL32A、MID/CE、JP），版本分别低于或等于1.8.32、1.8.2、1.8.32、1.8.2。ABB已发布修复版本：Terra AC wallbox (UL40/80A) 1.8.33、Terra AC wallbox (UL32A) 1.8.34、Terra AC MID 1.8.34、Terra AC Juno CE 1.8.34、Terra AC PTB 1.8.33、Terra AC wallbox (JP) 1.8.34。该漏洞由Saiflow的Itai Shmueli报告给施耐德电气。受影响的行业包括商业设施、关键制造业、能源和交通运输系统，设备部署于全球。CISA建议用户尽快应用修补程序，并避免使用不安全的HTTP连接，应始终使用HTTPS（TLS）与OCPP后端通信，同时确保CSMS本身的安全。目前没有证据表明该漏洞已被公开利用或在野外被利用，但由于涉及关键基础设施，修复优先级较高。

CISA发布了一份针对Eppendorf BioFlo 320生物反应器的ICS医疗咨询（ICSMA-26-146-01），披露了一个关键漏洞CVE-2026-7251，CVSS评分9.8。该漏洞源于VNC服务器使用了硬编码密码（CWE-259）。远程攻击者若知道设备的网络地址且远程访问已启用，可通过该密码完全控制生物反应器的用户界面，包括所有控制面板功能，且VNC流量未加密。受影响产品为所有版本的Eppendorf BioFlo 320生物反应器，全球部署，主要应用于医疗保健和公共卫生领域。Eppendorf已发布软件更新（版本5.0）永久移除VNC访问，并指出VNC默认禁用且仅能本地启用，相关文档已删除VNC配置信息。厂商建议：验证VNC已禁用、启用安全设置仅允许管理员和主管角色更改VNC设置、尽快安装版本5.0软件。CISA还建议用户采取网络隔离、使用VPN等防御措施。该漏洞由BIO-ISAC报告，目前无在野利用报告。

CISA发布了一份关于ABB AC500 V2可编程逻辑控制器（PLC）中缓冲区超读漏洞（CVE-2025-7745）的咨询通告。该漏洞影响AC500 V2固件版本2.5.2及更早版本（版本2.5.3于2016年发布并修复了该漏洞）。漏洞由Dragos公司的Reid Wightman发现，并报告给施耐德电气（ABB产品的相关方）。攻击者可通过向AC500 V2的Modbus服务器发送不支持的功能码，触发无效响应，导致响应末尾附加之前已发送的Modbus电报片段。这可能导致敏感数据泄露，例如其他会话中传输的明文数据。漏洞的CVSS 3.1评分为5.8（中等），攻击向量为网络，攻击复杂度低，无需特权或用户交互，影响范围涉及机密性（低），但无完整性或可用性影响。该漏洞关联CWE-126（缓冲区超读）。受影响的行业包括关键制造业、能源以及水务和废水处理系统，设备部署遍布全球，供应商总部位于瑞士。CISA建议用户采取防御措施，包括：将固件升级至2.5.3或更高版本；避免通过Modbus服务器发送任何敏感数据；仅使用受支持的Modbus功能码；将控制系统网络与商业网络隔离，并使用防火墙和VPN进行远程访问。该漏洞已由官方修复，但未提供在野利用的证据。

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.  CVE-2026-48172 LiteSpeed cPanel Plugin Privilege Escalation Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing t

View CSAF Summary ABB is aware of public reports of vulnerabilities in a 3rd party component VLC media player Version 2.2.4 which was delivered together with the installation package of Camera Connect Version 1.5.0.14 and below. An update is available that resolves a privately reported outdated 3rd party component with vulnerabilities in the product versions listed as affected in this advisory. An

View CSAF Summary An update is available that resolves a vulnerability identified by B&Rs internal security analysis in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could cause the product to stop. The following versions of ABB B&R Automation Runtime DoS Vulnerability in System Diagnostics Manager (SDM) are affected: Automatio

View CSAF Summary ABB became aware of an internally discovered vulnerability in the MConfig product versions listed as affected in the advisory. An attacker with access to local networks who successfully exploits vulnerability could have access to application’s sensitive information. ABB strongly advises customers to update MConfig with latest software version. The following versions of ABB LVS MC

View CSAF Summary ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. The vulnerability enables unauthorized access to the Reboot OS function within the Remote Transport Service, allowing an attacker to trigger a system reboot without the required authentication. This functionality initiates a system reboot on the target machine. However, remote exploitation

CrowdStrike Named a Customers’ Choice in 2026 Gartner® Peer Insights™ Voice of the Customer for User Authentication

Tune In: The Future of AI-Powered Vulnerability Discovery

Threat IntelligenceRansomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat LandscapeBy Google Threat Intelligence Group • 53-minute read

Threat IntelligenceProactive Preparation and Hardening Against Destructive Attacks: 2026 EditionBy Mandiant • 222-minute read

Microsoft has been recognized as a Leader in The Forrester Wave™: Workforce Identity Security Platforms, Q2 2026, receiving the highest scores in both the current offering and strategy categories. The post Microsoft recognized as a Leader in The Forrester Wave™ for Workforce Identity Security Platforms appeared first on Microsoft Security Blog.

微软威胁情报团队报告了一起针对Linux环境的多阶段入侵攻击事件。攻击始于一台暴露在公网的F5 BIG-IP边缘设备，该设备被作为初始访问入口。攻击者利用该设备作为跳板，通过内网横向移动至Confluence服务器，并试图窃取凭证和破坏身份认证系统。在攻击过程中，攻击者尝试了Kerberos中继攻击以提升权限和扩大访问范围。Microsoft Defender for Endpoint成功检测并阻止了多个攻击阶段，包括异常的网络连接和凭证访问行为。该事件展示了边缘设备暴露带来的严重风险，以及攻击者如何从边界设备深入内网核心系统。攻击者的具体身份未明确归因，但攻击手法具有APT组织特征。目前没有披露具体的漏洞利用（CVE），但强调了暴露的服务和配置不当带来的风险。微软建议组织加强边缘设备的安全配置，实施网络分段，并部署端点检测与响应（EDR）系统以监控横向移动和凭证滥用行为。

How Frontier firms secure AI at scale: read how Microsoft customers embed governance, identity, and cloud security to make protection an enabler of AI growth. The post Microsoft Security success stories: How St. Luke’s and ManpowerGroup are securing AI foundations appeared first on Microsoft Security Blog.

Unit 42 details Screening Serpens' use of AppDomainManager hijacking and new RAT variants to target tech and defense sectors in recent campaigns. The post Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns appeared first on Unit 42.

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-9082 Drupal Core SQL Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk o

Open-source framework ROADtools is being misused by threat actors for cloud intrusions. Learn how to identify its malicious use. The post Paved With Intent: ROADtools and Nation-State Tactics in the Cloud appeared first on Unit 42.

Inside the Human-AI Feedback Loop Powering CrowdStrike’s Agentic Security

May 2026 Patch Tuesday: 30 Critical Vulnerabilities Among 130 CVEsMay 12, 2026

Microsoft Security’s latest updates extend visibility, control, and protection across expanding ecosystems as organizations accelerate AI adoption. The post What’s new in Microsoft Security: May 2026 appeared first on Microsoft Security Blog.

Hitachi Energy GMS600是一款工业控制产品，CISA发布安全公告指出其使用的OpenSSL组件存在CVE-2022-4304漏洞。该漏洞为基于时序的侧信道攻击，影响RSA解密实现，攻击者可通过发送大量试验消息并记录处理时间来恢复TLS连接中的预主密钥，进而解密应用数据。受影响版本为GMS600 1.3.0和1.3.1，需升级至1.3.2修复。CVSS评分5.9，中等严重性。CISA建议采取网络层安全措施如IP白名单和速率限制作为缓解。该漏洞不涉及在野利用，但影响关键制造行业，全球部署。

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-34291 Langflow Origin Validation Error Vulnerability CVE-2026-34926 Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to th

View CSAF Summary ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability could cause the pollution of heap memory which potentially takes remote control of the product and performs a write operation to the flash memory to alter the firmware behavior. The following versions of ABB Terra AC Wallbox are aff

View CSAF Summary ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is available that replaces an outdated third-party component. Although no successful exploitation was observed during testing of the affected B&R products, the identified vulnerabilities could present potential attack vectors that might enable unauthorized access, data exposure

View CSAF Summary An update is available that resolves a vulnerability identified by B&Rs internal security analysis in the product versions listed as affected in this advisory. An attacker who successfully exploited these vulnerabilities could take over a remote session or execute code in the context of the user’s browser session. The following versions of ABB B&R Automation Runtime are affected:

View CSAF Summary ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is now available that addresses and remediates the vulnerability. A network attacker could exploit the vulnerabilities to execute remote code, initiate DoS attacks, conduct DNS cache poisoning, or extract sensitive information. The following versions of ABB B&R PCs are affected

Compromised @antv npm packages deploy the Mini Shai-Hulud payload to steal CI/CD secrets from Linux-based automation environments. The malware executes during npm install and targets credentials across GitHub, AWS, Kubernetes, Vault, npm, and 1Password platforms. The post Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft appeared first on Microsoft Security Blog.

Read about the unique challenges and rewards of securing gaming platforms and how to better protect gaming communities. The post Securing the gaming culture of cultures appeared first on Microsoft Security Blog.

The AI systems shipping inside enterprises today are fundamentally different from the ones we were building even two years ago, because they have moved well past answering questions and into accessing your email, retrieving records from your CRM, writing and executing code, and taking actions on your behalf across dozens of connected systems. The post Introducing RAMPART and Clarity: Open source t

CISA于2026年5月20日将7个已知被利用的漏洞（KEV）添加到其已知被利用漏洞目录中。这些漏洞包括：CVE-2008-4250（Microsoft Windows缓冲区溢出漏洞）、CVE-2009-1537（Microsoft DirectX NULL字节覆盖漏洞）、CVE-2009-3459（Adobe Acrobat和Reader堆缓冲区溢出漏洞）、CVE-2010-0249（Microsoft Internet Explorer释放后使用漏洞）、CVE-2010-0806（Microsoft Internet Explorer释放后使用漏洞）、CVE-2026-41091（Microsoft Defender权限提升漏洞）和CVE-2026-45498（Microsoft Defender拒绝服务漏洞）。这些漏洞已被恶意网络行为者频繁利用，对联邦企业构成重大风险。根据BOD 22-01指令，联邦民事行政部门（FCEB）机构必须按时修复这些漏洞。CISA强烈建议所有组织优先修复KEV目录中的漏洞，以降低遭受网络攻击的风险。目前没有提供具体的攻击活动或威胁行为者归因，但标签中提及了APT和Conti恶意软件家族。

Unit 42 analyzes TamperedChef malware clusters that use trojanized productivity apps and malvertising to deliver stealthy payloads to targets. The post Tracking TamperedChef Clusters via Certificate and Code Reuse appeared first on Unit 42.

CrowdStrike to Acquire Seraphic to Secure Work in Any Browser

Fox Tempest is a financially motivated threat actor operating a malware‑signing‑as‑a‑service (MSaaS) used by other cybercriminals, including Vanilla Tempest and Storm groups, to more effectively distribute malicious code, including ransomware. The post Exposing Fox Tempest: A malware-signing service operation appeared first on Microsoft Security Blog.

2026年5月19日，美国CISA发布ICS公告（ICSA-26-139-05），披露Kieback & Peter DDC系列楼宇控制器中存在一个存储型跨站脚本（XSS）漏洞（CVE-2026-4293，CVSS v3 5.3）。该漏洞源于Web页面生成时未对输入进行正确中和，攻击者可通过向设备Web界面注入恶意脚本，当管理员或其他受害者访问时，脚本在浏览器中执行，从而控制浏览器以窃取会话凭证或执行其他恶意操作。受影响型号包括DDC4002、DDC4100、DDC4200、DDC4200-L、DDC4400（固件≤1.12.14）、DDC4002e、DDC4200e、DDC4400e、DDC4020e、DDC4040e（固件≤1.23.4）以及DDC520（固件≤1.24.1）。其中前5个型号已停止维护（end-of-maintenance），厂商不再提供固件更新。受影响的设备广泛应用于商业设施、通信、金融服务、食品与农业、政府服务、医疗保健及信息技术等关键基础设施领域，部署于奥地利、中国、法国、德国、阿联酋等国。厂商建议：对于停止维护的型号，应严格进行网络隔离，仅在OT环境内运行，限制仅信任人员访问Web门户，如非必要则禁用Web访问；对于仍受支持的型号（DDC520及'e'系列），应限制网络访问、避免直接连接互联网，并将固件更新至最新版本。目前未发现该漏洞已被在野利用的证据。

CISA 发布了一份关于 Siemens RUGGEDCOM APE1808 设备的安全公告，该设备因集成了 Palo Alto Networks PAN-OS 软件而受到 CVE-2026-0300 漏洞的影响。该漏洞位于 PAN-OS 的 User-ID 认证门户（即 Captive Portal）服务中，属于缓冲区溢出漏洞（CWE-787）。未经身份验证的攻击者可以通过发送特制数据包，在 PA-Series 和 VM-Series 防火墙上以 root 权限执行任意代码，CVSS 3.1 评分为 10.0（严重）。Siemens 的 RUGGEDCOM APE1808 设备所有版本均受影响（CVE-2026-0300）。该设备广泛应用于关键制造业，全球部署，总部位于德国。目前尚无在野利用报告。Siemens 建议用户采取多项缓解措施：禁用接口管理配置文件中的响应页面（仅在信任区域启用）、禁用不必要的 User-ID 认证门户、将访问限制为仅允许受信任的内部 IP 地址，并联系客户支持获取补丁。CISA 还建议将控制系统网络与互联网隔离，使用 VPN 进行远程访问，并遵循 Siemens 的工业安全操作指南。由于漏洞影响关键基础设施且可远程利用，安全团队应尽快采取缓解措施，并监控是否存在异常认证尝试或未授权访问。

CISA发布了一份ICS公告（ICSA-26-139-04），披露了ZKTeco CCTV摄像头中存在一个高危漏洞（CVE-2026-8598）。该漏洞涉及摄像头的一个未文档化的配置导出端口，无需身份验证即可访问，导致敏感信息泄露，包括开放的摄像头服务和账户凭证。CVSS v3.1评分为9.1，严重程度为CRITICAL。受影响的设备为ZKTeco SSC335-GC2063-Face-0b77 Solution，固件版本低于V5.0.1.2.20260421。该摄像头广泛应用于全球的商业设施领域。目前尚未有公开的利用报告，但漏洞本身具备远程攻击、无需权限、复杂度低等特点，一旦被利用可能导致摄像头被完全控制。ZKTeco已发布固件更新（V5.0.1.2.20260421）进行修复。CISA建议用户尽快升级固件，并采取网络隔离、最小化暴露面等防御措施。该漏洞由研究员Souvik Kandar报告。由于漏洞利用难度低且影响关键资产，建议相关单位立即评估并修复。

View CSAF Summary An update is available that resolves vulnerability in the product versions listed as affected in this advisory. A path traversal vulnerability in these products can allow unauthenticated users to gain access to restricted directories. Exploiting this vulnerability can lead to complete system compromise and exposure of sensitive information. The following versions of ABB CoreSense

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to perform unauthenticated remote code execution. The following versions of ScadaBR are affected: ScadaBR 1.2.0 (CVE-2026-8602, CVE-2026-8603, CVE-2026-8604, CVE-2026-8605) CVSS Vendor Equipment Vulnerabilities v3 9.1 ScadaBR ScadaBR Missing Authentication for Critical Function, Improper Neutraliza

A complete decoupling from US technology is neither realistic nor necessary, but the changing environment does require nations and companies to reassess their relationships and dependencies

Storm-2949 turned stolen credentials into a cloud-wide breach, moving from identity compromise to large-scale data theft without using malware. This incident shows how threat actors can exploit trusted systems to operate undetected. The post How Storm-2949 turned a compromised identity into a cloud-wide breach appeared first on Microsoft Security Blog.

See how built-in security helps keep your growing business running, protect customer trust, and support growth. The post How to better protect your growing business in an AI-powered world appeared first on Microsoft Security Blog.

CISA于2026年5月15日将其已知被利用漏洞（KEV）目录新增一个漏洞CVE-2026-42897，该漏洞为Microsoft Exchange Server中的跨站脚本（XSS）漏洞。CISA根据已发现的在野利用证据将该漏洞列入KEV目录。该漏洞属于频繁被攻击者利用的类型，对联邦企业构成重大风险。根据约束性操作指令BOD 22-01，联邦民事行政分支（FCEB）机构必须在截止日期前修复该漏洞。CISA强烈建议所有组织优先修复KEV目录中的漏洞，以降低遭受网络攻击的风险。该漏洞的具体技术细节未在公告中披露，但已知攻击者可利用XSS漏洞在Exchange Server环境中执行恶意脚本，可能导致信息泄露或权限提升。由于该漏洞已被公开披露且存在利用证据，攻击者可能结合其他技术进行渗透，例如配合鱼叉式钓鱼邮件或利用已获取的凭证发起攻击。当前已知的恶意软件家族Conti被标记为相关，但公告未明确说明该漏洞与Conti勒索软件的直接关联。总体而言，该漏洞构成了严重的安全威胁，需要立即采取修补措施。

Unit 42 analyzes the evolution of Gremlin stealer. This variant uses advanced obfuscation, crypto clipping and session hijacking to compromise data. The post Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files appeared first on Unit 42.

Defending Against CORDIAL SPIDER and SNARKY SPIDER with Falcon Shield

Threat IntelligenceLook What You Made Us Patch: 2025 Zero-Days in ReviewBy Google Threat Intelligence Group • 23-minute read

As AI agents gain autonomy, defense in depth must evolve, with application-layer design, identity, and human oversight at the center. The post Defense in depth for autonomous AI agents appeared first on Microsoft Security Blog.

Kazuar, a sophisticated malware family attributed to the Russian state actor Secret Blizzard, has been under constant development for years and continues to evolve in support of espionage-focused operations. Over time, Kazuar has expanded from a relatively traditional backdoor into a highly modular peer-to-peer (P2P) botnet ecosystem designed to enable persistent, covert access to target environme

Exposed UIs, weak authentication, and risky defaults could turn cloud-native AI apps on Kubernetes into potential targets by threat actors. Learn how exploitable misconfigurations lead to RCE and data leaks. The post When configuration becomes a vulnerability: Exploitable misconfigurations in AI apps appeared first on Microsoft Security Blog.

CISA 发布了一份关于 Siemens ROS# 的安全公告 (ICSA-26-134-08)，指出该产品存在一个路径遍历漏洞 (CVE-2026-41551, CVSS 9.1 严重)。该漏洞存在于 ROS# 的 file_server 服务中，影响版本 2.2.2 之前的所有版本。攻击者无需身份验证即可通过网络远程利用该漏洞，读取或写入运行该服务的系统上任意文件（受服务运行用户权限限制）。该漏洞的根源是用户输入未正确过滤（CWE-23: 相对路径遍历）。Siemens 已发布版本 2.2.2 修复该漏洞，并提供了临时缓解措施，包括仅将 file_server 部署在受信任网络、使用最小权限运行、限制其使用场景等。CISA 建议用户尽快更新，并遵循工业控制系统安全最佳实践，如隔离网络、使用防火墙、仅允许远程访问通过 VPN 等。漏洞由 VyPr AI 的 Alifia Rahmah 报告。受影响的关键基础设施部门为关键制造业，产品全球部署。

2026年5月14日，CISA发布了一则关于西门子gPROMS Web Applications Publisher（gWAP）的安全公告。该产品存在一个远程代码执行漏洞（CVE-2026-40175），源于其使用的第三方Axios HTTP客户端库存在特定的“Gadget”攻击链，该攻击链可利用原型污染在其他第三方库中上升为任意代码执行。漏洞影响gWAP 3.1.1之前的所有版本。CVSS v3.1评分为8.0，攻击复杂度高，需要高权限，但影响范围广，可导致机密性、完整性和可用性完全丧失。西门子已发布gWAP V3.1.1修复版本。该漏洞涉及的CWE为CWE-113（CRLF序列注入），但实际利用链结合了原型污染。公告提及受影响行业为关键制造业，产品全球部署。目前没有在野利用的证据，但CISA建议用户尽快升级并采取网络隔离等防御措施。

CISA 发布 ICS 安全公告（ICSA-26-134-12），披露 Siemens Ruggedcom ROX 系列工业交换机/路由器中存在一个操作系统命令注入漏洞（CVE-2025-40949，CVSS 3.1 评分 9.1，严重）。该漏洞源于 Web UI 的调度器（Scheduler）功能对用户输入未正确净化，导致经过身份验证的远程攻击者能够以 root 权限在底层操作系统上执行任意命令。受影响产品包括 RUGGEDCOM ROX MX5000、MX5000RE、RX1400、RX1500、RX1501、RX1510、RX1511、RX1512、RX1524、RX1536、RX5000，所有版本低于 2.17.1 均受影响。漏洞由 Palo Alto Networks OT 威胁研究实验室的 Emmanuel Zhou、Rick Wyble、Mehemt Balta 和 Adam Robbie 报告给 Siemens。Siemens 已发布新版本固件 V2.17.1 修复该漏洞。CISA 建议用户立即采取防御措施，包括升级固件、最小化网络暴露、将控制系统网络与业务网络隔离，并遵循工业安全运营指南。目前该漏洞尚未发现有在野利用报告。

View CSAF Summary Simcenter Femap is affected by heap based buffer overflow vulnerability in Datakit library that could be triggered when the application reads files in IPT format. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process. Siemens has released a ne

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and execute code. The following versions of Universal Robots Polyscope 5 are affected: Polyscope 5 <5.25.1  CVSS Vendor Equipment Vulnerabilities v3 9.8 Universal Robots Universal Robots Polyscope 5 Improper Neutralization of Special Elements used in an OS Command ('OS Comm

View CSAF Summary Ruggedcom Rox contains an input validation vulnerability in the feature key installation process that could allow an authenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens Rugge

View CSAF Summary Solid Edge SE2026 before Update 5 is affected by two file parsing vulnerabilities that could be triggered when the application reads specially crafted files in PAR format. This could allow an attacker to crash the application or execute arbitrary code. Siemens has released a new version for Solid Edge SE2026 and recommends to update to the latest version. The following versions o

View CSAF Summary The web server in SENTRON 7KT PAC1261 Data Manager Before V2.1.0 contains a request smuggling vulnerability in the Go Project's net/http package that could allow an attacker to retrieve authorization tokens that can be used to gain administrative control over the device. Siemens has released a new version for SENTRON 7KT PAC1261 Data Manager and recommends to update to the latest

View CSAF Summary Ruggedcom Rox contains an improper access control vulnerability that could allow an authenticated remote attacker to read arbitrary files with root privileges from the underlying operating system's filesystem. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens Ruggedcom Rox are affected:

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.  CVE-2026-20182 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability  This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Note: Please adhere to CISA’s guidelines t

View CSAF Summary Multiple industrial devices contain a vulnerability that could allow an attacker to cause a denial of service condition. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. The follow

View CSAF Summary SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version. The following versions of Siemens SIMATIC are affected: SIMATIC CN 4100 vers:intdot/hpo_dp_link_enc before using it [WHAT & HOW] Functi

View CSAF Summary Ruggedcom Rox before v2.17.1 contain multiple third-party vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens Ruggedcom Rox are affected: RUGGEDCOM ROX MX5000 vers:intdot/<2.17.1 (CVE-2019-13103, CVE-2019-13104, CVE-2019-13106, CVE-2019-14192, CVE-2019-14193, CVE-2019-1419

View CSAF Summary Siemens Teamcenter is affected by multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens Teamcenter are affected: Teamcenter V2312 vers:intdot/<2312.0014, vers:intdot/<2312.00

View CSAF Summary Opcenter RDnL is affected by missing authentication in critical function in ‘ActiveMQ Artemis’. An unauthenticated attacker within the adjacent network could use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in availability impacts or message injection into any q

View CSAF Summary SIMATIC S7 PLCs contain multiple vulnerabilities in the web server that could allow an attacker to perform cross-site scripting attacks. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet avail

View CSAF Summary SIMATIC HMI Unified Comfort Panels before V21.0 are affected by a vulnerability that allows an unauthenticated attacker to access the web browser via the help link. This vulnerability allows an attacker to access the web browser through the Control Panel if it is not protected by the corresponding security mechanisms. This opens the possibility for the attacker to find backdoors,

View CSAF Summary The SIPROTEC 5 devices do not use sufficiently random numbers to generate session identifiers. This could facilitate a brute-force attack against a valid session identifier which could allow an unauthenticated remote attacker to hijack a valid user session. The affected session identifiers are only used in a subset of the endpoints that are provided by the affected products. Siem

CrowdStrike Advances CNAPP with Industry-First Adversary-Informed Risk Prioritization

What if you could generate realistic attack telemetry on demand? Explore research methods that translate attacker behaviors (TTPs) into synthetic logs that can trigger detections at scale and without sensitive data. The post Accelerating detection engineering using AI-assisted synthetic attack logs generation appeared first on Microsoft Security Blog.

Today Microsoft is announcing a major step forward in AI-powered cyber defense: a new multi-model agentic scanning harness (codenamed MDASH). The post Defense at AI speed: Microsoft’s new multi-model agentic security system tops leading industry benchmark appeared first on Microsoft Security Blog.

Read how to protect consumer websites and defend against modern DDoS attacks with layered security, resilient architecture, and graceful service degradation. The post Defending consumer web properties against modern DDoS attacks appeared first on Microsoft Security Blog.

Microsoft Incident Response investigated an attack operated through legitimate and trusted administrative mechanisms to blend seamlessly into routine operations and remain undetected demonstrating that intrusions have increasingly avoided using noisy exploits, obvious malware, or custom tooling, instead leveraging systems that organizations already trust within their environments. The post Undermi

CISA发布了一份关于ABB Automation Builder Gateway for Windows的安全公告（ICSA-26-132-04），披露了一个严重漏洞（CVE-2024-41975）。该漏洞源于网关配置的默认设置不安全：默认情况下，网关监听所有可用网络适配器的TCP 1217端口，导致未经身份验证的远程攻击者可以扫描并尝试访问AC500 PLC网络。虽然PLC本身具有用户管理机制可阻止未经授权的访问，但如果用户禁用了该机制，则攻击者可能直接访问PLC。受影响的版本包括Automation Builder 2.9.0之前的所有版本（含2.9.0）。CVSS v3.1评分为5.3（中危），攻击向量为网络、低复杂度、无需权限。受影响的关键基础设施行业包括化工、关键制造、能源、水和废水处理，部署范围遍及全球。ABB已发布修复版本Automation Builder 2.9.0，将默认访问限制为本地地址；同时提供了手动配置缓解方案：在网关配置文件中设置`LocalAddress=127.0.0.1`并重启服务。本漏洞属于初始化资源时使用不安全默认值（CWE-1188），目前未公开在野利用证据或概念验证代码。

CISA and the Group of Seven (G7) international partners—Germany, Canada, France, Italy, Japan, the United Kingdom, and the European Union—have released joint guidance, Software Bill of Materials for AI – Minimum Elements, to help public and private sector stakeholders improve transparency in their artificial intelligence (AI) systems and supply chains. A software bill of materials (SBOM) acts as a

View CSAF Summary ABB became aware of vulnerability in the products versions listed as affected in the advisory. An update is available that resolves publicly reported vulnerability. An attacker who successfully exploited these vulnerabilities could cause a crash, denial-of-service (DoS), or potentially remote code execution. The following versions of ABB AC500 V3 Stack Buffer Overflow in Cryptogr

View CSAF Summary Successful exploitation of these vulnerabilities could allow an authenticated attacker to expose sensitive information or cause a CRLF injection. The following versions of Subnet Solutions PowerSYSTEM Center are affected: PowerSYSTEM Center 2020 =5.8.x|=5.11.x|=6.0.x|=5.8.x|=6.0.x|=5.11.x|<=5.28.x Product Status:known_affected Remediations MitigationSubnet Solutions recommends

View CSAF Summary ABB became aware of multiple internally discovered vulnerabilities in the WebPro SNMP card PowerValue for the product versions listed as affected in the advisory. Depending upon the vulnerability, an attacker with access to local network who successfully exploited this vulnerability could have - Unauthorized access - Insufficient Session Expiration leading to resource unavailabil

View CSAF Summary ABB became aware of severe vulnerability in the products versions listed as affected in the advisory. An update is available that resolves these vulnerabilities. An attacker who successfully exploited these vulnerabilities could bypass the user management and read visualization files (CVE-2025-2595), read and write certificates and keys (CVE-2025-41659) or cause a denial-of-servi

View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to elevate privileges from user to system, which may then enable the attacker to cause a temporary denial of service, open files, or delete files. The following versions of Fuji Electric Tellus are affected: Tellus 5.0.2 CVSS Vendor Equipment Vulnerabilities v3 7.8 Fuji Electric Fuji Electric Tellus E

Unit 42 analyzes AD CS exploitation through template misconfigurations and shadow credential misuse while offering behavioral detection for defenders. The post Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools appeared first on Unit 42.

Smart glasses allow anyone to track and record the world around them. That could put your data and the privacy of those nearby at risk.

Falcon for XIoT Extends Asset Protection to Healthcare Environments

Threat IntelligenceCoruna: The Mysterious Journey of a Powerful iOS Exploit KitBy Google Threat Intelligence Group • 25-minute read

Dirty Frag is a newly disclosed Linux local privilege escalation vulnerability affecting kernel networking and memory-fragment handling components including esp4, esp6, and rxrpc. The vulnerability enables reliable escalation from an unprivileged user to root and may be leveraged after initial compromise through SSH access, web shells, containers, or low-privileged accounts. Microsoft Defender is

2026年5月8日，美国网络安全与基础设施安全局（CISA）在其已知被利用漏洞（KEV）目录中新增了一个漏洞CVE-2026-42208。该漏洞是BerriAI LiteLLM中的一个SQL注入漏洞，已被发现存在积极利用的证据。LiteLLM是一个用于管理多种语言模型API的库，该SQL注入漏洞可能允许攻击者通过精心构造的输入执行任意SQL命令，从而可能访问、修改或删除后端数据库中的敏感信息。CISA根据联邦运营指令（BOD）22-01的要求，将此类频繁被恶意网络行为者利用且对联邦企业构成重大风险的漏洞纳入KEV目录。BOD 22-01强制要求联邦民事行政分支（FCEB）机构在规定期限内修复这些漏洞，以保护其网络免受活跃威胁。尽管该指令仅适用于联邦机构，但CISA强烈建议所有组织优先修复KEV目录中的漏洞，作为其漏洞管理实践的一部分。CISA将持续向目录中添加符合标准的新漏洞。此次新增的漏洞与Conti勒索软件家族存在关联（根据标签信息），但公告未提供具体的攻击链细节或受害者信息。建议组织立即评估受影响系统，并应用厂商提供的补丁或缓解措施，同时加强针对SQL注入的检测与防护。

New research exposes how prompt injection in AI agent frameworks can lead to remote code execution. Learn how these vulnerabilities work, what’s impacted, and how to secure your agents. The post When prompts become shells: RCE vulnerabilities in AI agent frameworks appeared first on Microsoft Security Blog.

This World Passkey Day, read how Microsoft is advancing passkey adoption to replace passwords, cut phishing risk, and deliver simpler, more secure sign-ins. The post World Passkey Day: Advancing passwordless authentication appeared first on Microsoft Security Blog.