Aggregator

为在情报学领域深入落实国家人才培养战略，激发大学生对开源情报分析的热情，提升学生在数据采集、深度分析及情报应用等方面的综合能力，特举办“第四届全国大学生开源情报数据采集与分析挑战专项”活动。

2022年以来，印俄联合研制的布拉莫斯（BrahMos）超音速反舰导弹先后进入菲律宾、越南、印度尼西亚三个南海周边国家，构成南海方向冷战后最显著的一次导弹扩散。本报告基于公开政策文献评估，核心发现有五。

A vulnerability was found in Linux Kernel up to 6.6.142/6.12.92/6.18.34/7.0.11 and classified as very critical. This impacts the function usb_fill_control_urb of the file drivers/media/rc/igorplugusb.c of the component igorplugusb. The manipulation of the argument Request results in memory corruption. This vulnerability is cataloged as CVE-2026-64240. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability has been found in Linux Kernel up to 6.6.142/6.12.92/6.18.34/7.0.11 and classified as critical. This affects the function damon_sysfs_scheme_regions_rm_dirs/kobject_init_and_add of the file mm/damon/damon-sysfs-schemes.c of the component DAMON Sysfs. The manipulation leads to use after free. This vulnerability is listed as CVE-2026-64239. The attack must be carried out locally. There is no available exploit. The affected component should be upgraded.

A vulnerability classified as problematic was found in Linux Kernel up to 6.18.34/7.0.11. Impacted is the function probe of the component davinci. Such manipulation of the argument clock-frequency leads to divide by zero. This vulnerability is referenced as CVE-2026-64236. The attack can only be performed from a local environment. No exploit is available. Upgrading the affected component is advised.

A vulnerability, which was classified as problematic, was found in Linux Kernel up to 7.0.11. The impacted element is the function gpio_chip::of_xlate of the component GPIO Shared. Executing a manipulation of the argument offset can lead to deadlock. This vulnerability is tracked as CVE-2026-64238. The attack is restricted to local execution. No exploit exists. You should upgrade the affected component.

A vulnerability classified as very critical has been found in Linux Kernel up to 7.0.11. This issue affects the function dma_handle_rx of the component pch_uart. This manipulation causes null pointer dereference. The identification of this vulnerability is CVE-2026-64234. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Attackers used Hermes, an autonomous open source tool, in unrestricted "YOLO mode" to conduct espionage against Thailand's Ministry of Finance.

四个问题先放在前面：两条链分别需要什么条件，本地复现和流量看到了什么，企业先做什么，威胁检索从哪里开始查。

谷歌 CEO 称正在训练 Gemini 4，据过往节奏推测有望于今年年底发布； OpenAI CEO 奥尔特曼：人类已经进入了「奇点」时代； Claude 对话分享链接意外被谷歌收录，用户隐私聊天内容曝光；

Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges. [...]

Wondershare Media.io brings AI story writing, character creation, storyboards, and video generation into one workflow for faster, simpler content creation work.

Arista has patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator deployments that is being actively exploited in attacks. [...]

It includes the new agentic model MAI-Cyber-1-Flash and the Project Perception platform, with the tech giant claiming it’ll do a better job than its rivals at half the cost.

The post Microsoft debuts AI cybersecurity offerings as competition heats up appeared first on CyberScoop.

In a Monday filing, the Justice Department said states sued before agencies even decided how the order would work.

The post Trump asks Supreme Court to let him curtail mail-in voting ahead of midterms appeared first on CyberScoop.

Reuters says OpenAI failed to detect its AI agent hacking Hugging Face for days, discovering the breach only after FBI involvement. Reuters reported that the OpenAI agent responsible for the Hugging Face breach operated undetected for over a week before OpenAI realized what had happened, long after the FBI had been alerted and Hugging Face […]

A botnet called Dysphoria has compromised around 200,000 devices across the world and is using them for distributed denial of service (DDoS) attacks and traffic relay operations. [...]

A proof-of-concept exploit for "Certighost," a Windows Active Directory Certificate Services vulnerability, has been released that can allow authenticated attackers to potentially compromise a Windows domain. [...]