Aggregator

A vulnerability marked as critical has been reported in Eventlet up to 0.40.2 on Python. This affects an unknown part of the component WSGI Parser. The manipulation leads to http request smuggling. This vulnerability is listed as CVE-2025-58068. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

为全力消除安全隐患，严厉惩处“黑飞”行为，公安部近期在全国部署开展严厉打击超高“黑飞”违法犯罪“净空”专项工作，并于近日公布了一批典型案例。案例显示，多人因破解无人机后台禁飞区、限飞区，在管制空域内实施超高“黑飞”……

近年来，我国人工智能在技术创新、产品创造、场景创新和行业应用等方面发展迅速，处在全球第一方阵，人工智能标准化体系发挥了重要引领保障作用。

数据流通服务机构是数据要素市场化价值化的重要载体。近日，国家数据局等四部门联合发布《关于培育数据流通服务机构 加快推进数据要素市场化价值化的意见》，首次对我国数据流通服务机构做出了体系化的安排，标志着我国数据流通交易政策体系迈向纵深阶段。

《关于提升境外人员入境数字化服务便利性的实施意见》旨在建立互联互通、包容普惠、标准互认的数字化服务体系，打造更加国际化、便利化的数字化服务环境，从而以数字开放赋能高水平对外开放。

2025年，网络安全漏洞呈现规模持续扩大、成因体系化、传播供应链化、利用智能化和治理复杂化等特征。漏洞已由单一技术问题演变为兼具技术风险和系统风险的安全治理对象，其治理难度和不确定性明显上升。在国际层面，漏洞治理嵌入国家安全与制度竞争框架……

Industrial control system networks continue to run on legacy communication protocols that were built for reliability and uptime, not authentication or data integrity. In many environments, malicious actors with access to the OT network can impersonate devices, issue unauthenticated commands, or modify messages in transit without detection. A new guidance document from the Cybersecurity and Infrastructure Security Agency (CISA) explains why secure versions of common industrial protocols remain underused, even though they have existed since … More →

The post Why secure OT protocols still struggle to catch on appeared first on Help Net Security.

Список устройств Apple, для которых вышли экстренные исправления.

Olympic merchandise is already being used as bait. We’ve identified nearly 20 fake shop sites targeting fans globally.

The post Fake shops target Winter Olympics 2026 fans appeared first on Security Boulevard.

BSRC马年限定红包封面开抢！

The distribution of malicious software through pirated games and cracked applications continues to be a highly effective strategy for cybercriminals. By exploiting the widespread desire for free access to premium content, attackers can easily bypass initial user suspicions and deliver complex threats directly to personal devices. A newly identified campaign exemplifies this persistent trend, utilizing […]

The post Surge in AI-Driven Phishing Attacks and QR Code Quishing in 2025 Spam and Phishing Report appeared first on Cyber Security News.

在日常样本狩猎中，我们发现捕获的一枚银狐样本尝试加载了先前未曾出现过的可疑驱动STProcessMonitor Driver，最终加载WinOs远控程序操控用户计算机。

2026年开年，Seedance2.0将AI视频生成技术推向新高度，也加剧了AI视频泛滥的隐患。游戏科学创始人、《黑神话：悟空》制作人冯骥体验后惊叹其多模态整合能力并感慨“AIGC的童年时代结束了”，同时也警示，该模型让逼真假视频生成变得毫无门槛，冲击现有知识产权与审查体系，假视频引发的信任危机成为AI发展亟待解决的核心问题。

图：网络截图

当AI造真的能力不断突破，唯有更硬核的AI鉴真技术，才能对抗技术作恶、守护内容真实。国投智能股份旗下美亚柏科自主研发的美亚鉴真小程序，以先发优势卡位AI安全赛道，凭借稀缺的技术实力稳居行业第一梯队，成为破解假视频信任危机的关键利器。

作为网络空间安全与社会治理领域国家队，国投智能股份不仅在AI鉴真技术上深耕细作，更实现了G端夯实、B端突破的全维度布局：在G端，美亚鉴真小程序已覆盖全国27个省，对接近120个地市级反诈及政务平台，成为各地反诈工作的“电子哨兵”，获央视新闻专题报道；

在B端，核心鉴真技术已在运营商、银行反欺诈领域实现0到1的突破，相关方案正往全国范围推广，为金融、通信行业抵御AI伪造诈骗风险筑牢防线。同时，国投智能正积极探索与互联网大厂的深度合作，在内容安全、侵权鉴定、UGC内容审核等领域建立对接，计划将成熟的鉴真技术融入平台内容审核体系，从源头把控内容真实性。

技术的硬实力，更在无数真实案例中得到印证。

·针对抖音、微信等平台频发的AI换脸仿冒名人带货、虚假代言问题，美亚鉴真小程序可快速识别伪造痕迹，为名人维权提供技术举证支撑；·面对淘宝等电商平台AI合成破损图骗退款的灰色产业链，鉴真能精准识别虚假图片，解决商家维权举证难的痛点；·在金融反欺诈领域，与头部金融机构合作的防深伪模型，成功拦截多起AI冒充用户的电信诈骗案件；·在市场监管领域，鉴真为监管部门查处AI虚假广告案件提供关键技术依据，助力打造全国AI虚假广告监管样本。

AI技术的发展不应成为虚假内容的温床，而美亚鉴真小程序，正是国投智能股份与美亚柏科为AI时代打造的 “信任基石”。公司以年均超17%的科研投入持续迭代技术，不断优化检测算法，紧跟AI伪造技术的更新趋势，用技术对抗技术，用专业守护真实。

当前，美亚鉴真小程序能有效识别近500种各类伪造生成手段，对主流AI生成内容的识别平均精度超94.6%，普通用户只需上传图片、视频或输入链接，三步即可完成鉴真，轻松识破AI伪造陷阱。

当你在抖音刷到离奇的视频、在微信看到存疑的画面、在淘宝遇到可疑的广告，别再凭肉眼猜测真假！打开美亚鉴真小程序，让国投智能股份&美亚柏科的硬核技术为你辨明真假，守护你的每一次线上信任，让AI时代的内容世界，真实可触、值得信赖！

A vulnerability identified as critical has been detected in Linux Kernel up to 6.17.12/6.18.1. This affects the function devm_clk_get_enabled of the component rtc. This manipulation causes double free. This vulnerability appears as CVE-2025-68754. The attacker needs to be present on the local network. There is no available exploit. You should upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.17.12/6.18.1 and classified as critical. This vulnerability affects unknown code of the component staging. Such manipulation leads to null pointer dereference. This vulnerability is listed as CVE-2025-68755. The attack must be carried out from within the local network. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.12.62/6.17.12/6.18.1. Affected by this vulnerability is the function quiesce_tagset of the component NVMe Driver. The manipulation leads to improper initialization. This vulnerability is referenced as CVE-2025-68756. The attack needs to be initiated within the local network. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability classified as critical has been found in Linux Kernel up to 6.12.62/6.17.12/6.18.1. Affected by this issue is the function put_user of the component ALSA. The manipulation leads to buffer overflow. This vulnerability is uniquely identified as CVE-2025-68753. The attack can only be initiated within the local network. No exploit exists. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.17.12/6.18.1. It has been classified as critical. This issue affects the function ptp_clock_settime of the component iavf. Performing a manipulation results in null pointer dereference. This vulnerability is cataloged as CVE-2025-68752. The attack must originate from the local network. There is no exploit available. Upgrading the affected component is recommended.

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.17.12/6.18.1. Affected by this issue is the function fpu_vstl of the component Helper Call Handler. The manipulation results in uninitialized pointer. This vulnerability is identified as CVE-2025-68751. The attack can only be performed from the local network. There is not any exploit available. You should upgrade the affected component.

Threat actors have started to exploit a recently disclosed critical security flaw impacting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products, according to watchTowr. "Overnight we observed first in-the-wild exploitation of BeyondTrust across our global sensors," Ryan Dewhurst, head of threat intelligence at watchTowr, said in a post on X. "Attackers are abusing