Aggregator

作者：Zhenfeng Cao 原文链接：https://arxiv.org/pdf/2606.05608 摘要 半个多世纪以来，软件工程一直建立在一个基本前提之上：人类工程师负责拆解问题，将决策逻辑编码为静态代码，并在需求演变时手动调整代码。本文认为，AI智能体（AI agents）的出现——即以大型语言模型作为主要推理引擎，将代码动态生成与丢弃作为工具性资源的系统——并非渐进式的改进，而是对软...

Google has released emergency updates to patch another Chrome zero-day vulnerability that has been exploited in the wild, the fifth such flaw patched since the start of the year. [...]

国家网信办、市场监管总局联合发布了《网络测评活动规范》。网信办称，制定该规范的原因是“一些网络测评存在夸大宣传、只评不测、商测一体等问题，不仅影响消费者信任度和购物体验，也扰乱市场环境”。《规范》要求： 三、网络测评所选取的样本，应当是消费者可以从市场上购买到的普通商品且来源可以追溯，不得是为测评活动准备的特殊物品。从事网络测评活动，接受第三方委托、赞助或者与测评样本相关方存在利益关系的，应当作出显著提示。
四、从事网络测评活动，涉及对产品功能、性能等项目测试，应当委托具有法定检验检测资质许可的检验检测机构按照相关标准以及技术规范开展测试，并明示测试依据的标准以及技术规范，按照规定保留测试样本以及测试数据、图片、视频等记录，确保测试数据、结果可以追溯。
五、未对产品开展测试，仅凭感知、观察、体验等主观感受对产品进行评价，应当进行说明，并在信息展示过程中显著标明“仅为个人体验”或者“主观感受，仅供参考”等内容。

Музыка останется бесплатной, но дорога к ней пройдёт через необычный цифровой барьер.

社交网络不再是为了社交，而是为了跟随时尚潮流。今天的社交活动主要发生在消息应用上。社交媒体正演变成类似电视的被动式平台，但不同于需要遥控器去切换电视频道，社媒平台的算法已经为你量身定制了内容，平台利用你的信息获利，作为回报它提供的内容是免费的。社交平台的核心商业模式仍然是广告，而且其收入还在持续增长。2026 年全球社交媒体广告收入将达到 3170 亿美元，超过 2025 年的 2770 亿美元。其中 Meta 的广告收入将达到 2430 亿美元，预计将首次超过 Google。Instagram 和 TikTok 之类的大型平台越来越注重娱乐和发现内容，而 WhatsApp 之类的应用则变成社交活动的主要场所，但此类消息应用的变现比较难。

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity flaw impacting BerriAI LiteLLM to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-42271 (CVSS score: 8.7), is a command injection vulnerability that could allow any authenticated user to run arbitrary commands on the

VerdantBamboo целенаправленно атаковали устройства, на которых средства защиты традиционно отсутствуют.

The advent of AI-assisted vulnerability discovery and autonomous exploit development has brought about a new age in cybersecurity—one in which we can no longer rely on patching as a primary defense mechanism. Patching is, by definition, a reactive approach to security. It cannot occur until after a vulnerability is discovered and a vendor fix is made available, an operational delay that all too often lands well after an exploit is already weaponized in the wild. … More →

The post The architecture of subtraction: Why it’s time to erase the roads, not just map the traffic appeared first on Help Net Security.

deepsec @ DARKNAVY

In our post about Project Glasswing, we made the argument that the architecture around a vulnerability matters more than the speed of the patch. Here we walk through what that architecture looks like, the threats it defends against, and how we run it ourselves as Cloudflare's customer zero.

A vulnerability was found in Apache Answer up to 2.0.0 and classified as problematic. This issue affects some unknown processing of the component API. The manipulation results in information disclosure. This vulnerability is known as CVE-2026-34905. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability has been found in hapijs content up to 2.0.0 and classified as problematic. This vulnerability affects unknown code of the component Email Handler. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2026-34033. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability, which was classified as critical, was found in Apache Answer up to 2.0.0. This affects an unknown part of the component Custom Avatar Handler. Executing a manipulation can lead to unrestricted upload. This vulnerability appears as CVE-2026-34031. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Apache Answer up to 2.0.0. Affected by this issue is some unknown functionality of the component TIFF File Handler. Performing a manipulation results in unrestricted upload. This vulnerability is reported as CVE-2026-33582. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability classified as problematic was found in Apache Answer up to 2.0.0. Affected by this vulnerability is an unknown functionality of the component Timeline API. Such manipulation leads to authorization bypass. This vulnerability is documented as CVE-2026-25699. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability classified as problematic has been found in Apache Answer up to 2.0.0. Affected is an unknown function of the component AI Answer Rendering. This manipulation causes cross site scripting. This vulnerability is registered as CVE-2026-25688. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

​比AI泡沫更值得关注的，是泡沫里的人。

A vulnerability described as problematic has been identified in Huawei HarmonyOS 6.0.0/6.1.0. This impacts an unknown function of the component File Preview Module. The manipulation results in information disclosure. This vulnerability is cataloged as CVE-2026-41980. The attack must be initiated from a local position. There is no exploit available.

A vulnerability marked as problematic has been reported in Huawei HarmonyOS 6.0.0/6.1.0. This affects an unknown function of the component Print Module. The manipulation leads to an unknown weakness. This vulnerability is listed as CVE-2026-41979. The attack must be carried out locally. There is no available exploit.

A vulnerability labeled as critical has been found in Huawei HarmonyOS 6.0.0/6.1.0. The impacted element is an unknown function of the component Clone Module. Executing a manipulation can lead to permission issues. This vulnerability is tracked as CVE-2026-41978. The attack is restricted to local execution. No exploit exists.