Posts of last 24 hours
是一个出现在 GStreamer `gst-plugins-bad` DTLS 连接实现中的栈缓冲区溢出漏洞。它的问题并不藏在复杂的协议状态机里，也不在某个冷门编解码器分支上，说穿了就是一次非常典型、也非常危险的内存安全失误: 开发者把攻击者可影响的长度值，直接交给了一个固定大小的栈缓冲区
https://xz.aliyun.com/news/92679
人看到的安全文档，对 RAG 来说不一定安全。那么当知识在 Parser、Chunk、Retrieval 之间不断被重新解释和组织时，它原本的语义和安全属性还能不能完整保留下来？
https://xz.aliyun.com/news/92691
本文基于公开的学术研究成果（arXiv:2608.09867，Stealing Reasoning Traces from Proprietary LLM APIs）与笔者对 OpenAI / Anthropic / Google 三家厂商推理模型的协议层分析，拆解"加密推理块（Encrypted Reasoning Blob）"这一新型攻击面。文章还原了跨会话、跨模型重放攻击的完整技术链路，同时
https://xz.aliyun.com/news/92694
一次攻防对抗项目中对某医院 HIS 系统的渗透，目标是验证登录用户权限边界并扩大战果。整个链路走下来很有意思：看似处处有鉴权，实则令牌签名可逆向，最终用一个低权限账号拿到了全量用户数据。
https://xz.aliyun.com/news/92669
API 参数发现通常依赖字典爆破或前端 JS 爬取，前者命中率低，后者在 SPA 应用中效果有限。本文提出一种新思路：利用后端 API 自身的错误反馈来发现参数——发送故意缺参数的请求，从 "parameter[user_code] is missing"
▎ 这类错误信息中提取参数名，迭代填充后继续请求直到获取完整参数表。整个过程无需字典、不依赖前端代码，让目标的输入校验逻辑替你做参数枚举。
https://xz.aliyun.com/news/92561
上一篇讲了怎么把子域名枚举的假阳性从 85% 干到 0，核心是验证。这篇接着聊更实操的：怎么把枚举流程本身工程化。
内容包括五块硬货：一是预筛先行，30 秒判断域名值不值得跑，别盲目开炮；二是环境铁律，Kali 的 UDP 53 出站被限制，dig 必须加 +tcp，否则结果随机丢失；三是多轮枚举的核心逻辑，subfinder 被动挖内部名 + 分层爆破补通用名；四是候选爆炸控制，实测 53 个
https://xz.aliyun.com/news/92677
A vulnerability, which was classified as problematic, has been found in Apple macOS up to 14.8.4/15.7.4/26.3. This affects an unknown function. Performing a manipulation results in improper input validation.
This vulnerability is reported as CVE-2026-20679. The attack is possible to be carried out remotely. No exploit exists.
It is advisable to upgrade the affected component.
https://vuldb.com/vuln/394018
A vulnerability classified as critical was found in droundy arrayref 0.3.10. The impacted element is an unknown function. Such manipulation leads to os command injection.
This vulnerability is documented as CVE-2026-77651. The attack can be executed remotely. There is not any exploit available.
https://vuldb.com/vuln/394017
A vulnerability classified as critical has been found in droundy append-only-vec 0.1.9. The affected element is an unknown function. This manipulation causes inclusion of functionality from untrusted control sphere.
This vulnerability is registered as CVE-2026-77650. Remote exploitation of the attack is possible. No exploit is available.
https://vuldb.com/vuln/394016