Aggregator

期待！！！！

看雪论坛作者ID：git_21210wzzzh2025

可跨模型的自我进化型模型越狱框架

The Coldriver hacking group reportedly shifted its operation quickly after the May 2025 public disclosure of its LostKeys malware

Стихи от ChatGPT привели ФБР к администратору даркнета.

TL;DR

AI coding assistants can hallucinate package names, creating phantom dependencies that don't exist in official repositories. Attackers exploit this predictable behavior through slopsquatting, which involves registering malicious packages with names that AI models commonly suggest. This emerging supply chain attack requires new detection approaches focused on behavioral analysis to complement existing security tools.

The post Slopsquatting Attacks: How AI Phantom Dependencies Create Security Risks appeared first on Security Boulevard.

近日，绿盟科技CERT监测到微软发布安全更新，其中修复了Windows Server Update Service(WSUS) 远程代码执行漏洞（CVE-2025-59287）。CVSS评分9.8，目前漏洞PoC已公开，请相关用户尽快防护。

A critical security flaw has been found in the on-premise edition of LANSCOPE Endpoint Manager that could let attackers run malicious code on vulnerable machines. The issue, tracked as CVE-2025-61932, involves a remote code execution vulnerability in two core components: the Client Program (MR) and the Detection Agent (DA). Customers have already seen attempts to […]

The post LANSCOPE Endpoint Manager Flaw Allows Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

红蓝对抗的第二阶段实战已经打响，烽火正式点燃！我们也正式迎来了第二次“考试”！攻防演练期间本公众号会每日更新当天鲜活情报和热点漏洞，欢迎大家对我们进行收藏和关注！

Amazon Web Services experienced a significant service disruption in its US-EAST-1 region that lasted nearly 24 hours, affecting over 140 services and causing widespread issues for customers worldwide. The outage began late on October 19, 2025, and was fully resolved by the afternoon of October 20. Root Cause Identified as DNS Resolution Issue The incident […]

The post AWS Resolves Major Outage After Nearly 24 Hours of Service Disruption appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

清晰度、控制权与生命线构成应急响应铁三角。

Скрытые сети Telegram и RAT-трояны — новая карта кибермира по версии CrowdStrike.

根据发表在 PLoS Biology 期刊上的一项研究，被切断大脑区域的脑电图与深度睡眠脑电图相似。这一研究发现加深了对意识和无意识脑状态的理解。对于药物无效的严重癫痫患儿，医生会通过名为脑半球切除术（hemispherotomy）的手术切断引发癫痫的脑半球与大脑其余部分的连接，以阻止癫痫扩散。被切断的脑组织会被留在颅骨内，保留了完整的血液供应。被切断的脑区域是否具有某种形式的意识，或者是否能表现出意识？研究人员分析了十名儿童在手术前以及手术后六个月至三年期间的脑电图。他们发现，被切断脑区域的电活动在术后减缓，而其余大脑部分的电活动没有变化，其脑电图也与对照组儿童脑电图相似。被切断脑区域的脑电波主要是 δ波，脑电图与对照组儿童深度睡眠时的脑电图相似。

Welcome to Day One of Pwn2Own Ireland 2025! We have 17 attempts today with some exciting research on display. We’ll be posting results here as we have them, and follow us on Twitter, Mastodon, and Bluesky.

Day One has come to a close and we haven’t had a single failure! We awarded $522,500 for 34 unique bugs on the first day of the contest. Here’s how the Master of Pwn leader board currently sits:

Of course, there’s plenty of time left with some big exploits still to come. Stay tuned for the results from Day Two and Three!

SUCCESS - Team Neodyme used a stack based buffer overflow to exploit the HP DeskJet 2855e. They earn $20,000 and 2 Master of Pwn points.

Daniel Kilimnik of Team Neodyme shows off his successful exploitation

SUCCESS - Nguyen Hoang Thach (@hi_im_d4rkn3ss), Tan Ze Jian, Lin Ze Wei, Cherie-Anne Lee, Gerrard Tai of STARLabs (@starlabs_sg) used a heap based buffer overflow to exploit the @CanonUSA imageCLASS MF654Cdw. They earn themselves $20,000 and 2 Master of Pwn points.

A successful attempt against the Canon printer

SUCCESS - @Tek_7987 & @_Anyfun (@Synacktiv) used a stack overflow to achieve rootlevel code execution on the Synology BeeStation Plus. They earn $40,000 and 4 Master of Pwn points in the process.

Pwned by Synactiv

SUCCESS - Bongeun Koo (@kiddo_pwn) and Evangelos Daravigkas (@freddo_1337) of Team DDOS used a magnificent eight different bugs - including multiple injections - to complete their SOHO Smashup of the QNAP Qhora-322 + QNAP TS-453E. They earn $100,000 and 10 Master of Pwn points.

Demonstrating root level access

ZDI Analysts Neal Brown (left) and Mat Powell observe Bongeun Koo and Evangelos Daravigkas of Team DDOS

WITHDRAW - Bongeun Koo (@kiddo_pwn) and Evangelos Daravigkas (@freddo_1337) of Team DDOS was withdrawn their attempt of the Philips Hue Bridge.

SUCCESS - SHIMIZU Yutaro (@shift_crops) of GMO Cybersecurity by Ierae, Inc. used a stack based buffer overflow to exploit the Canon imageCLASS MF654Cdw. Their second round win earns them $10,000 and 2 Master of Pwn points.

Nyan cat makes an appearance courtesy of GMO Cybersecurity

SUCCESS - Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) used a pair of bugs to gain code execution on the Synology DiskStation DS925+. He earns himself $40,000 and 4 Master of Pwn points

The Summoning Team has root access on the Synology

ZDI Analysts Vincent Lee and Mat Powell observe the attempt from Sina Kheirkhah

SUCCESS - Stephen Fewer (@stephenfewer) of Rapid7 (@rapid7) used three bugs, including an SSRF and a command injection, to exploit the Home Assistant Green (which isn't actually green). He earns himself $40,000 and 4 Master of Pwn points.

Stephen Fewer has root on the Home Assistant Green

SUCCESS - Sang Nguyen Thien (@gnas0x0018) and mistsu of Team ANHTUD used four bugs - including multiple types overflows and an OOB Read - to exploit the Phillips Hue Bridge. Their outstanding work earns them $40,000 and 4 Master of Pwn points.

Team ANHTUD’s winning entry

SUCCESS/COLLISON - McCaulay Hudson (@_mccaulay) of Summoning Team (@SummoningTeam) successfully exploited the Home Assistant Green with four bugs - one unique SSRF and three bug collisions. They still earn $12,500 and 2.5 Master of Pwn points.

Summoning Team was here - again

SUCCESS - dmdung (@_piers2) of STAR Labs SG Pte. Ltd used a single OOB access bug to exploit the Sonos Era 300 smart speaker. In doing so, he earns $50,000 and 5 Master of Pwn points.

uid=0 means dmdung has root on the Sonos speaker

SUCCESS - Team PetoWorks [SungJun Park (@howrealsung), Wonbeen Im (@D0b6y), Dohyun Kim (@d0now_kim), and Juyeong Lee (@ju_cheda)] used a Release of Invalid Pointer or Reference bug to exploit the Canon printer at Pwn2Own. They $10,000 and two Master of Pwn points for their third round win.

Configuration issues couldn’t stop Team PetoWorks

SUCCESS - YingMuo (@YingMuo), HexRabbit (@h3xr4bb1t), LJP (@ljp_tw) from DEVCORE Research Team and nella17 (@nella17tw) from DEVCORE Intern Program used multiple injections and a format string bug(!) to exploit the QNAP TS-453E. Their unique bugs earn them $40,000 and 4 Master of Pwn points.

Who said format string bugs don’t exist anymore?

SUCCESS - Hank Chen (@hank0438) of InnoEdge Labs used an auth bypass and an OOB write to exploit the Phillips Hue Bridge. His second round win earns $20,000 and 4 Master of Pwn points.

Hank Chen provides an enlightening exploit

SUCCESS - Sina Kheirkhah (@SinSinology) and McCaulay Hudson (@_mccaulay) of Summoning Team (@SummoningTeam) used a pair of bugs to exploit of the Synology ActiveProtect Appliance DP320. That rounds their day off with another $50,000 and 5 more Master of Pwn points.

Fingerprints on the screen can’t hide root access

SUCCESS - Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller of Compass Security (@compasssecurity) combined an arbitrary file write and cleartext transmission of sensitive data to exploit the Home Assistant Green. The unique bugs in their third round win earns them $20,000 and four Master of Pwn points.

ZDI Analyst Bobby Gould (right) overlooks the work done by the Compass Team

SUCCESS - Nguyen Ba Nam Dung and Vu Chi Thanh from Team ANTHUD used a single heap based buffer overflow to exploit the Canon imageCLASS MF654Cdw on their third and final attempt. Their fourth round win earns them $10,000 and 2 Master of Pwn points.

Third time’s a charm

Currently trending CVE - Hype Score: 21 - A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

Currently trending CVE - Hype Score: 1 - Windows Disk Cleanup Tool Elevation of Privilege Vulnerability

随着数字化进程加速，芯片安全已成为信息产业发展的基石。本次研讨会聚焦芯片安全前沿技术与应用实践，汇聚行业权威机构与领先企业，共同探讨安全挑战与创新路径。

共筑安全新范式