Aggregator

当前，地缘政治博弈升级，颠覆性、交叉性技术密集迸发，全球产业体系深度重构，多重因素推动全球科技发展呈现变革与竞争深度交织的全新图景。我国“十五五”规划纲要把“加快高水平科技自立自强，引领发展新质生产力”摆在非常重要的位置……

Currently trending CVE - Hype Score: 9 - A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

Currently trending CVE - Hype Score: 4 - Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

Currently trending CVE - Hype Score: 1 - Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.

Currently trending CVE - Hype Score: 7 - An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to ...

Currently trending CVE - Hype Score: 4 - Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.

Currently trending CVE - Hype Score: 4 - Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

模型能力越来越强，美国开始决定谁能先用最强AI。

AWS DevOps Agent helps administrators inspect logs, review firewall rules and network paths, identify configuration changes that caused AWS Network Firewall to block traffic, and restore connectivity. The service is an AI-powered operations assistant for DevOps and SRE teams that investigates and troubleshoots application and infrastructure issues. It connects to monitoring tools, logs, code repositories, and deployment pipelines, analyses incidents, pinpoints likely root causes, and recommends fixes or preventive improvements. It works across AWS, multicloud, … More →

The post AWS gives DevOps teams an AI investigator for firewall incidents appeared first on Help Net Security.

抹香鲸是以竖立的方式在海面下睡眠的，它如何在睡眠中保持平衡？根据发表在《实验生物学杂志》上的一项研究，研究团队在挪威海域为野生抹香鲸安装了吸盘式记录仪。这种装置能够记录声音和三维运动数据。研究人员不仅捕捉到清晰的气泡释放声，还结合鲸体运动、组织密度、水中阻力以及体内气体体积等信息建立模拟模型，分析抹香鲸休息时的浮力变化。结果显示，抹香鲸在休息过程中释放气泡，可有效降低自身正浮力，使其能够持续停留在海面下方而不会缓慢上浮。这种调节极为重要，因为抹香鲸头部富含鲸脑油，天然具有较强的浮力。同时，作为闭气潜水动物，抹香鲸若在休息过程中缓慢上浮，肺内气体会随着环境压力降低而不断膨胀，进一步增加浮力。释放气泡则有助于抵消这一效应，使其保持接近中等的浮力。研究团队表示，抹香鲸能够在疑似睡眠状态下完成如此精细的浮力调节，展现出极高的生理控制能力。

上周关注度较高的产品安全漏洞(20260720-20260726)

国家信息安全漏洞共享平台（以下简称CNVD）本周共收集、整理信息安全漏洞578个，其中高危漏洞335个、中危漏洞184个、低危漏洞59个。

Submit #862537 / VDB-383396

Юристы, врачи и финансисты сдали свои аккаунты, просто заселившись в номер.

Cybersecurity researchers have flagged fresh malicious cyber activity by a threat actor with ties to East Asia targeting government entities in the Middle East. The intrusions have resulted in the deployment of previously unreported malware families dubbed TELESHIM, MIXEDKEY, and BINDCLOAK, according to Zscaler ThreatLabz. The cybersecurity firm said it detected the campaign earlier this month.

Submit #862536 / VDB-383395

Submit #862512 / VDB-383394

Iranian-affiliated advanced persistent threat (APT) actors are actively exploiting internet-connected programmable logic controllers (PLCs) from major industrial vendors, including Rockwell Automation, Schneider Electric, and Siemens, targeting U.S. critical infrastructure sectors. A joint cybersecurity advisory (AA26-097A) released by the FBI, CISA, NSA, DOE, EPA, Treasury, and U.S. Cyber Command highlights sustained exploitation activity against operational technology […]

The post Iranian Hackers Exploit Rockwell, Schneider and Siemens PLCs Across U.S. Critical Infrastructure appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.