Posts of last few hours

Please support the site operations by clicking ads.

Ninja Forms plugin flaw exploited to hack WordPress sites

Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts. [...]

https://www.bleepingcomputer.com/news/security/ninja-forms-plugin-flaw-exploited-to-hack-wordpress-sites/

Wed, 10/07/2026 - 05:00

Hackers exploit 32 zero-days on first day of Pwn2Own Ireland

On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned $388,500 after exploiting 32 zero-days. [...]

https://www.bleepingcomputer.com/news/security/hackers-exploit-32-zero-days-on-first-day-of-pwn2own-ireland/

Wed, 10/07/2026 - 03:21

Atlassian warns of critical file-access flaw in Jira, Confluence

Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket. [...]

https://www.bleepingcomputer.com/news/security/atlassian-warns-of-critical-file-access-flaw-in-jira-confluence/

Wed, 10/07/2026 - 01:34

ASOS confirms data breach after “HACKED” in-app notifications

UK fashion retailer ASOS confirmed a data breach Tuesday after hackers sent unauthorized push notifications through its mobile app while claiming to have stolen customer data from the company's Snowflake environment. [...]

https://www.bleepingcomputer.com/news/security/asos-confirms-data-breach-after-hacked-in-app-notifications/

Wed, 10/07/2026 - 00:33

Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes

A new campaign targeting ad account managers uses fake ChatGPT, Gemini, Claude, and Perplexity sites that steal login credentials and multi-factor authentication (MFA) codes through browser-in-browser attacks. [...]

https://www.bleepingcomputer.com/news/security/fake-chatgpt-gemini-sites-steal-advertising-accounts-mfa-codes/

Tue, 10/06/2026 - 23:16

CIS Benchmarks October 2026 Update

The following CIS Benchmarks were updated during the past month. We've highlighted the major updates below. Each Benchmark includes a full changelog.

https://www.cisecurity.org/insights/blog/cis-benchmarks-october-2026-update

Tue, 10/06/2026 - 22:10

CVE-2026-96940: Microsoft Fixes Exchange Server Flaw For Which Exploitation Is More Likely

Microsoft released emergency updates for Exchange Server to fix CVE-2026-96940, a high-severity flaw that can let attackers gain higher privileges. Microsoft has released out-of-band security updates for Exchange Server to fix a high-severity vulnerability tracked as CVE-2026-96940 (CVSS score of 8.8). The flaw is caused by weak authorization and can allow an authenticated attacker to […]

https://securityaffairs.com/200476/security/cve-2026-96940-microsoft-fixes-high-severity-exchange-server-flaw.html

Tue, 10/06/2026 - 22:09

How to secure RMM software: 8 controls MSPs should test

RMM platforms give MSPs privileged access across customer environments, making their security controls critical to limiting risk. Acronis outlines eight controls MSPs should test when evaluating RMM software, from patching and privileged access to recovery and tenant isolation. [...]

https://www.bleepingcomputer.com/news/security/how-to-secure-rmm-software-8-controls-msps-should-test/

Tue, 10/06/2026 - 22:00

自主漏洞发现与利用生成

https://mp.weixin.qq.com/s?__biz=MzA4ODEyODA3MQ==&mid=2247497246&idx=1&sn=c4c0d6bb4764198995a717bbf5bc1cef

Tue, 10/06/2026 - 22:00

看我如何使用Trae全程用AI开发了Dota游戏

从一句"做个网页版 Dota"开始，地图、英雄、技能、AI、渲染、联机——全是 AI 写的。这篇记录真实过程，共消耗2500积分，8个小时，全程0人工编码投入。

https://mp.weixin.qq.com/s?__biz=MzAwMzAwOTQ5Nw==&mid=2650942092&idx=1&sn=00d6ca3834148cc43f14020a86115af3

Tue, 10/06/2026 - 21:29

原域名已变更且将在2024年彻底废弃，请访问 https://govuln.com/news/ 查看新的RSS订阅

https://govuln.com/news/url/x8dB

Tue, 10/06/2026 - 21:10

Vector Search Can’t Tell “Yes” From “No”

Learn why vector search can rank contradictory statements as similar, and how hybrid retrieval can help RAG systems identify conflicting information.

https://www.akamai.com/blog/ai/2026/oct/vector-search-cant-tell-yes-from-no

Tue, 10/06/2026 - 21:00

94% 到 6%：Rust 内存缺陷的可利用性断层

Rust 承诺在编译期消除内存安全问题。本文把 Rust 官方漏洞公告库 RustSec advisory-db 全库拉下来数了一遍：1246 条公告中，346 条（27.8%）带内存类标签。但按年拆开，会看到一个结构性转折 —— 内存类公告里带 CVE 编号的比例，2020 年是 94%（77/82），2025–2026 年只有 6% 和 10%，同期「自称 unsound」的条数升到 35 和

https://xz.aliyun.com/news/92874

Tue, 10/06/2026 - 20:15

Web Fuzz的艺术

web fuzz的意义，以及我为什么要开发fastfuzz的初衷。

https://xz.aliyun.com/news/92876

Tue, 10/06/2026 - 20:15

游戏逆向基础-通过ce及dbg进行的基础功能call查找教学

本文系统介绍了游戏逆向中查找功能 call 的基本方法，围绕“经过发包函数”和“不经过发包函数”两大类场景，分别讲解了堆栈回溯、虚函数表查找、特征对象访问断点、写入断点回溯等实用技巧，并通过背包使用物品、NPC 服务、自动寻路三个实例进行演示。

https://xz.aliyun.com/news/92875

Tue, 10/06/2026 - 20:14

ciscn决赛内核

很基础的利用