Aggregator

每一次“授权”背后，都可能藏着一次信息的“越界”。从填表到刷脸，到底谁拿走了人们的个人信息？

随着各国经济交融进一步加深，平台跨国经营、数据跨境流动、技术全球传播已成为经济发展的新业态。我国数字产业在参与全球合作与竞争过程中离不开相关法律规则体系的保障，加强数字领域涉外法治体系建设，成为当前完善中国特色社会主义法治体系建设……

近日，全国网络安全标准化技术委员会发布《关于2026年41项网络安全国家标准项目立项的通知》。

新一轮人工智能（AI）技术革命加速落地，传统国际安全秩序正遭遇前所未有的冲击。当前，核威慑力量、网络空间对抗、军用AI深度耦合，形成多域交织的复合安全新形态。以往分领域单独搭建的战略稳定理论体系，已难以应对风险跨域传导引发的系统性危机。

当前，人工智能（AI）技术迭代加速、产业规模扩大、应用深化，大模型与智能体的普及在提升效率的同时，打破了传统供应链安全边界，引发新型网络安全风险，使AI供应链安全治理趋于复杂。一方面，AI技术的广泛应用带来大量新型安全风险……

A vulnerability has been found in Vmware Spring Security up to 7.0.4 and classified as critical. This affects the function securityMatchers/PathPatternRequestMatcher.Builder. Performing a manipulation results in improper authorization. This vulnerability is reported as CVE-2026-22753. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

A vulnerability, which was classified as problematic, has been found in Vmware Spring Security up to 6.3.14/6.4.14/6.5.9/7.0.4. This vulnerability affects the function NimbusJwtDecoder/NimbusReactiveJwtDecoder of the component JWT Decoding. Performing a manipulation results in an unknown weakness. This vulnerability is cataloged as CVE-2026-22748. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

A vulnerability was found in Vmware Spring Security up to 6.4.15/6.5.9/7.0.4. It has been classified as problematic. This vulnerability affects unknown code of the component One-Time Token Login. The manipulation leads to time-of-check time-of-use. This vulnerability is traded as CVE-2026-22751. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

A vulnerability classified as problematic has been found in Vmware Spring Security up to 7.0.4. Affected by this issue is some unknown functionality of the component DaoAuthenticationProvider. This manipulation of the argument UserDetails causes information disclosure. This vulnerability is tracked as CVE-2026-22746. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Vmware Spring Security up to 7.0.4. This affects an unknown part of the component x.509 Certificate Handler. Such manipulation leads to improper certificate validation. This vulnerability is listed as CVE-2026-22747. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Cybersecurity researchers have called attention to a new modular malware called TELEPUZ that's been spreading via websites infected with ClickFix lures since late April 2026. "The malware is full-featured, lightweight, and modular," Elastic Security Labs researcher Cyril François said in a technical report. "While the number of C2 [command-and-control] domains is currently small, the daily

Cybersecurity researchers have called attention to a new modular malware called TELEPUZ that's been

Hackers are actively exploiting two zero-day vulnerabilities in the SonicWall SMA 1000 Series remote access appliances. They are chaining a critical server-side request forgery flaw with a local code injection bug to execute commands with root privileges. Rapid7’s Managed Detection and Response team detected targeted attacks before SonicWall publicly disclosed these vulnerabilities on July 14, […]

The post Hackers Exploit SonicWall SMA1000 Zero-Days to Execute Commands as Root appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A newly proposed framework argues that AI penetration testing must move beyond conventional infrastructure compromise and assess whether an adversary can make an AI-enabled system act against its intended operational purpose. Traditional penetration testing typically measures compromise through outcomes such as unauthorized access, privilege escalation, data theft, service disruption, or persistence. Those outcomes remain critical […]

The post New Framework Redefines AI Penetration Testing Around Prompt Injection and Behavioral Objective Violations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A vulnerability labeled as critical has been found in SICK MSC800. This affects an unknown part of the component Sopas ET. Executing a manipulation can lead to missing authentication. This vulnerability appears as CVE-2024-8751. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

A vulnerability, which was classified as problematic, was found in mackron dr_libs up to 0.13.3. This affects the function drflac__read_and_decode_metadata of the component PICTURE Handler. Executing a manipulation of the argument mimeLength/descriptionLength can lead to uncontrolled memory allocation. This vulnerability is registered as CVE-2026-32836. The attack needs to be launched locally. No exploit is available.

A vulnerability has been found in mackron miniaudio up to 0.11.25 and classified as problematic. This vulnerability affects unknown code of the component WAV File Parser. The manipulation leads to improper null termination. This vulnerability is documented as CVE-2026-32837. The attack can be initiated remotely. There is not any exploit available.

A vulnerability was found in Linux Kernel up to 6.18.18/6.19.8/7.0-rc3. It has been declared as critical. Affected by this vulnerability is the function teql_master_xmit of the component TEQL. Such manipulation leads to null pointer dereference. This vulnerability is uniquely identified as CVE-2026-23277. The attack can only be initiated within the local network. No exploit exists. It is recommended to upgrade the affected component.