Posts of last 24 hours
HotSpot 的 Attach API 在 Linux 平台上以 /tmp/.java_pid 这个 Unix Domain Socket（UDS）作为唯一接入点。com.sun.tools.attach.VirtualMachine.attach()、jcmd、jstack、jmap 最终都落到这条 socket 上。
https://xz.aliyun.com/news/92393
Langflow 是一个基于 Python 的低代码 AI 工作流编排平台，允许用户通过拖拽节点来构建和运行 LLM 应用。`CVE-2026-10561` 披露了一条存在于 Langflow `1.9.3` 中的未授权远程代码执行链：攻击者无需任何凭据即可获取 superuser 权限，进而通过内置的 Python 执行组件在目标容器内运行任意代码。这篇文章将沿着 `auto_login` 鉴权
https://xz.aliyun.com/news/92378
深入分析dll劫持技术：利用系统 DLL 搜索顺序缺陷，通过路径优先级实现恶意代码持久化加载。包括共有dll和私有dll的劫持
https://xz.aliyun.com/news/92394
Nerd Sniping 从 XKCD 漫画的概念演变为 AI Agent 安全攻击向量——攻击者通过构造"看似可解、实则无底"的问题，诱导 Agent 陷入递归思考和无限推理，消耗 token、泄露系统指令、触发工具滥用。防御的核心是让 Agent 学会"思考更少"——给它的思考能力装上刹车。
https://xz.aliyun.com/news/92389
本文以学习记录为主，参考网上文章，针对fscan二开流程：利用AI去除fscan敏感特征---->使用garble混淆编译----->利用加载器落地，进行了较为完整的AI闭环。
记录在利用AI实现过程中遇到的一些问题，以及解决思路。
创新点：利用对AI的执行闭环，让Ai自动化fscan二开、不止对fscan进行二开，对加载器也进行二开和规避特征，达到了一定的免杀效果
项目地址：https://gi
https://xz.aliyun.com/news/92390
Monday starts with the usual promise that everything is under control. Then the logs wake up.
This week, trusted tools crossed lines, old flaws found new work, exposed systems stayed exposed, and attackers kept hiding inside normal-looking services. Nothing looked strange at first. That helped.
That is the mood. Here is the full recap.
⚡ Threat of the Week
OpenAI Says Its AI Agent Went Rogue
https://thehackernews.com/2026/07/weekly-recap-rogue-ai-agents-check.html
Shadow AI agents are rapidly spreading across enterprise platforms, often without IT or security visibility. Nudge Security explains how organizations can discover, assess, and govern AI agents before unmanaged permissions and autonomous actions create security risks. [...]
https://www.bleepingcomputer.com/news/security/shadow-ai-agents-are-multiplying-heres-how-to-find-and-secure-them/
После обновления ChatGPT прошлым летом чат-бот начал выдавать инструкции по биооружию.
https://www.securitylab.ru/news/575347.php
Philadelphia, Pennsylvania, 27th July 2026, CyberNewswire
https://hackread.com/security-risk-advisors-named-a-finalist-in-crns-2026-best-of-the-channel-awards/