Aggregator

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Bongeun Koo (@kiddo_pwn)' was reported to the affected vendor on: 2026-03-04, 38 days ago. The vendor is given until 2026-07-02 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Anonymous' was reported to the affected vendor on: 2026-03-04, 38 days ago. The vendor is given until 2026-07-02 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Anonymous' was reported to the affected vendor on: 2026-03-04, 38 days ago. The vendor is given until 2026-07-02 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Anonymous' was reported to the affected vendor on: 2026-03-04, 38 days ago. The vendor is given until 2026-07-02 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Anonymous' was reported to the affected vendor on: 2026-03-04, 38 days ago. The vendor is given until 2026-07-02 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

Cloudflare One now incorporates dynamic User Risk Scores into Access policies to enable automated, adaptive security responses. This update allows teams to move beyond binary "allow/deny" rules by evaluating continuous behavior signals from both internal and third-party sources.

Cloudflare’s Gateway Authorization Proxy adds support for identity-aware policies for clientless devices, securing virtual desktops, and guest networks without a device client.

Cloudflare One is partnering with Nametag to combat laptop farms and AI-enhanced identity fraud by requiring identity verification during employee onboarding and via continuous authentication.

该标准于2021年4月正式立项，2026年2月正式发布。

本文将拆解AI如何驱动网络安全技术迭代，从被动防御走向智能博弈，为商业价值的实现筑牢技术根基，也为后续产业变革铺垫核心路径。

摩托罗拉本周一宣布与 Android 安全加固社区发行版项目 GrapheneOS 展开合作。GrapheneOS 项目通过其 Mastodon 社媒账号表示，摩托罗拉未来的手机设备将正式支持 GrapheneOS，而根据双方达成的硬件要求，这些设备的引导程序（bootloader）是允许解锁和重新锁定的，支持安装其它移动操作系统。过去几年 Android 厂商越来越多的禁止解锁引导程序，日益向苹果看齐。

A critical vulnerability affecting VMware Aria Operations has been added to the Known Exploited Vulnerabilities (KEV) catalog. Broadcom recently issued a security advisory detailing a flaw that allows unauthenticated attackers to execute arbitrary commands. Organizations are urged to implement mitigations or discontinue use of the product if a fix is not possible. VMware Aria Operations […]

The post CISA Warns of VMware Aria Operations Vulnerability Exploited in Attacks appeared first on Cyber Security News.

好的，我现在需要帮用户总结一篇关于华为在MWC2026展会上展示AI超节点产品的文章。用户的要求是用中文总结，控制在100字以内，并且不需要特定的开头。 首先，我得通读整篇文章，抓住关键点。文章提到华为在巴塞罗那的MWC2026展出了Atlas 950 SuperPoD，这是他们的AI超节点产品，首次在海外亮相。产品使用了自主研发的昇腾950DT半导体，搭载了HBM高带宽内存。性能方面，训练和推理都有显著提升，分别提高了17倍和26.5倍。此外，华为计划从2026年10月开始向客户交付，并且已经在韩国市场有所动作。 接下来，我需要把这些信息浓缩到100字以内。要确保涵盖主要信息：展会名称、产品名称、技术亮点、性能提升、市场计划等。 可能的结构是：展会名称+产品名称+技术特点+性能提升+市场计划。这样既全面又简洁。 最后，检查字数是否符合要求，并确保语言流畅自然。 华为在MWC2026展会上首次展出AI超节点Atlas 950 SuperPoD，搭载自研昇腾950DT半导体及HBM内存，训练和推理性能大幅提升。该产品将面向欧洲等海外市场销售，并于2026年10月起向客户提供。

A supply chain attack targeting the PHP developer community has surfaced through Packagist, the official package repository for PHP and Laravel projects. Threat actor nhattuanbl published several packages that disguised a fully functional remote access trojan (RAT) inside what looked like standard Laravel utility libraries, giving attackers silent and persistent control over any system that installed them. […]

The post Malicious Packages Disguised as Laravel Utilities Deploy PHP RAT and Enables Remote Access appeared first on Cyber Security News.

Найден способ делать мощнейшие процессоры без лишней головной боли.

Такой дерзкий вызов экспертному сообществу не бросали уже несколько лет.

Industrial organizations are accelerating AI deployment across manufacturing, utilities, and transportation and running straight into a security problem. Cisco’s 2026 State of Industrial AI Report, based on responses from more than 1,000 decision-makers across 19 countries, finds that cybersecurity has become the single largest obstacle to AI adoption, outranking skills gaps, integration challenges, and budget constraints. The shift is notable. In 2024, cybersecurity ranked third among external growth obstacles. By 2026, 40% of respondents cite … More →

The post Cybersecurity is now the price of admission for industrial AI appeared first on Help Net Security.

好的，我现在需要帮用户总结这篇文章的内容。用户的要求是用中文，控制在100字以内，而且不需要特定的开头，直接写描述。首先，我得仔细阅读文章内容，抓住关键点。 文章主要讲的是美国TikTok用户遇到了问题，导致应用中断。TikTok将原因归咎于甲骨文数据中心的问题。问题开始于美国东部时间上午九点左右，并且持续了一段时间。甲骨文作为投资者团体的一部分，持有TikTokUSDS合资企业80%的股份，这是为了遵守国家安全法，要求字节跳动剥离美国业务。 接下来，我需要把这些信息浓缩到100字以内。要确保包含事件、原因、时间和相关背景。可能的结构是：事件发生的时间、问题原因、影响以及背景情况。 比如：“美国TikTok用户因甲骨文数据中心问题出现服务中断，导致内容发布延迟。问题自美东时间上午九点起持续至今。甲骨文持有TikTokUSDS合资企业80%股份，该企业为遵守美国国家安全法而成立。” 这样既涵盖了事件、原因、时间和背景，又符合字数限制。 检查一下是否遗漏了重要信息：甲骨文的数据中心问题导致中断，时间点明确，以及合资企业的背景都包括了。看起来没问题。 美国TikTok用户因甲骨文数据中心问题出现服务中断，导致内容发布延迟。问题自美东时间上午九点起持续至今。甲骨文持有TikTokUSDS合资企业80%股份，该企业为遵守美国国家安全法而成立。

好的，用户让我用中文总结一篇文章，控制在100字以内，不需要特定的开头。首先，我需要仔细阅读文章内容，理解其主要观点。 文章主要讲的是Intent-Based Access Control（IBAC），这是一种新的防御prompt注入攻击的方法。传统的防御措施如输入过滤、LLM判断和输出分类器都是试图让AI更聪明地检测攻击。而IBAC则不同，它通过解析用户的意图生成权限元组，在每次工具调用前检查这些权限，从而阻止未经授权的操作。 接下来，文章提到IBAC的实现步骤：解析用户意图为FGA元组，并在每次工具调用前进行检查。整个过程只需要额外一次LLM调用和大约9毫秒的授权检查，不需要复杂的架构改动。 总结时，我需要抓住关键点：IBAC的作用、与传统方法的区别、实现步骤以及优势。控制在100字以内，确保信息准确且简洁。 最后，组织语言时要避免使用“这篇文章”或“内容总结”这样的开头，直接描述文章内容。 文章介绍了一种名为意图基访问控制（IBAC）的新方法，用于防御提示注入攻击。与传统方法不同，IBAC通过解析用户意图生成权限元组，并在每次工具调用前进行检查以阻止未经授权的操作。该方法只需额外一次LLM调用和约9毫秒的授权检查即可实现。

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a recently disclosed security flaw impacting Broadcom VMware Aria Operations to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild. The high-severity vulnerability, CVE-2026-22719 (CVSS score: 8.1), has been described as a case of command injection that could allow an