ARCHIVE
按时间、分类、严重程度检索全部安全漏洞与安全信息。当前共收录 215 条记录。
样本SafewX86.EXE有合法数字签名，但会释放正常安装程序及伪装成Edge的恶意程序。该恶意程序采用随机文件名、Defender排除、延迟删除和自迁移规避防御，通过计划任务和注册表Run键持久化。它利用Sleep时间和进程数检测沙箱，动态生成C2域名ak2.xingxings3.org，接收命令并执行。该样本具备防御规避、持久化、内存执行与远程加载能力，风险较高。
近期，公安部网安局在护网专项工作中发布提醒文章，文中明确点名Sorry、Weax两个勒索家族近期攻击十分活跃，制造、商贸、医疗、教育、科技等行业的企业接连中招。作为长期奋战在一线的应急响应团队，我们对这个提醒的感受比大多数人都要直接，因为我们就身处这些案例的现场。
The Earth is speeding up, the leap second is being abolished, oh, and there's critical vulnerabilities in PHP.
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise th…
作者：Mohammad Kachuee, Phu Mon Htut, Sheng Li, Nikolaos Pappas, Miguel Ballesteros Martinez, Yassine Benajiba, Sujith Ravi, Dan Roth 原文链接：https://arxiv.org/pdf/2610.28397v1 摘要 智能体 AI（Agentic AI）将大语言模型（L...
本文复现 CVE-2026-109618 PHP2Shell OOM 堆破坏 RCE 漏洞，基于 Docker 靶场验证绕过 ASLR 的完整利用链，并对照官方补丁验证修复效果，总结复现坑点与安全加固方案。
样本概述 攻击者将恶意样本伪装成“2025 最新一批非法滞留海外 人员名单.exe”，利用社会工程学手段诱骗用户点击。样本在攻击链中运用安装包捆绑、白文件 DLL 劫持、 指令膨胀混淆、注册表持久化...
PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra.
Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full co…
Two critical remote code execution vulnerabilities in PHP core could have implications across its wider ecosystem. Talos has published a blog to explain what we know so far, and details the Snort coverage available, incl…
Adversaries are turning the tools businesses trust into delivery mechanisms for malicious activity. Cisco Talos observed abuse of more than 25 legitimate platforms over the past year, exploiting the built-in trust of col…
Mercury 是一个基于 Python 的框架，主要用于将 Jupyter Notebook 快速转换为交互式的 Web 应用程序。在早期的版本中，其内核管理接口存在严重的访问控制缺陷。
Parasoft Continuous Testing Platform 10.7.5 - JSP command execution
South River Technologies Titan MFT Server 26.0.0 - code execution
Keycloak 26.7.2 - Unauthenticated Account Takeover
Automotive Shop Management System 1.0 - SQLi
