Posts of last few hours

ZDI-CAN-33521: Microsoft
A CVSS score 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H severity vulnerability discovered by 'Lucas Miller of TrendAI Research' was reported to the affected vendor on: 2026-10-09, 5 days ago. The vendor is given until 2027-02-06 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.
http://www.zerodayinitiative.com/advisories/upcoming/
ZDI-CAN-33523: Microsoft
A CVSS score 7.7 AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H severity vulnerability discovered by 'Lucas Miller of TrendAI Research' was reported to the affected vendor on: 2026-10-09, 5 days ago. The vendor is given until 2027-02-06 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.
http://www.zerodayinitiative.com/advisories/upcoming/
ZDI-CAN-33830: Microsoft
A CVSS score 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H severity vulnerability discovered by 'Lucas Miller of TrendAI Research' was reported to the affected vendor on: 2026-10-09, 5 days ago. The vendor is given until 2027-02-06 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.
http://www.zerodayinitiative.com/advisories/upcoming/
ZDI-CAN-33446: Microsoft
A CVSS score 8.6 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H severity vulnerability discovered by 'Lucas Miller of TrendAI Research' was reported to the affected vendor on: 2026-10-09, 5 days ago. The vendor is given until 2027-02-06 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.
http://www.zerodayinitiative.com/advisories/upcoming/
Uranium 加密货币交易所黑客因窃取 5300 万美元被定罪
一名马里兰州男子在 2021 年 4 月两次入侵去中心化加密货币交易所 Uranium Finance 后，被判窃取超过 5300 万美元。 36 岁的 Jonathan Spalletta（网名 "Jspalletta" 和 "Cthulhon"）于 3 月 30 日向执法部门投案自首，并被控计算机欺诈和洗钱。 根据法庭文件，Spalletta 入侵了 Uranium（Binance 的 BNB...
http://0.0.0.0:8080/post/64758
Вдвое меньше памяти, больше событий: MaxPatrol SIEM 28.0 выжимает максимум из того же сервера
Организации смогут дольше наращивать нагрузку без обязательного расширения инфраструктуры.
https://www.securitylab.ru/news/578480.php
Companies want autonomous IT operations but hesitate to let AI act alone

Ninety percent of companies want to move toward autonomous IT operations over the next two years, with agentic AI, software that plans and carries out multi-step tasks on its own, doing the work. Yet 77 percent say their own organization hesitates to let AI make an operational decision without a human approving it. Most of those companies mean autonomy with a person at the approval step, and few have the groundwork for even that. Only … More →

The post Companies want autonomous IT operations but hesitate to let AI act alone appeared first on Help Net Security.

https://www.helpnetsecurity.com/2026/10/09/move-toward-autonomous-it-operations/
鱼缸插排被黑，一缸鱼全死了：你家的"智能"正在替黑客开门
攻克超声穿颅读脑，拿下 4 亿元新融资，他们要做脑科学的「英伟达」
他复刻了蝙蝠的本事，给 AI 的下个战场递了一把「铲子」。
https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2653114579&idx=1&sn=fb9f7e08309fdf223e9cee4ec6787156
В старом советском реактиве нашли ключ к терагерцовой памяти без паразитных полей
Перестройка решётки резко меняет движение электронов и усиливает эффект Холла.
https://www.securitylab.ru/news/578422.php
过程驾驭的系统复杂性天花板：冷静看待面向复杂软件开发的智能体工程进展
当智能体能够连续工作几百小时甚至更长，就可以实现“人在环外”的复杂软件开发吗？
https://mp.weixin.qq.com/s?__biz=MzU4NDU4OTM4OQ==&mid=2247517677&idx=1&sn=bb488ffd0d1d2c44e4f946614a22b827
FakeGit 恶意软件活动卷土重来，含 17,610 个恶意 GitHub 仓库
FakeGit 活动于本月初重新激活以推送 StealC 信息窃取软件，此后 GitHub 上超过 17,000 个虚假仓库正在分发 SmartLoader 恶意软件。 操作者主要使用一次性账户，但研究人员识别出至少 700 个看似属于合法开发者的账户。 这些恶意仓库使用令人信服的 README 说明，配有一个下载按钮，指向一个包含初始载荷 SmartLoader 的 ZIP 归档，SmartLo...
http://0.0.0.0:8080/post/64757
Нейросети научились взламывать банки? CrowdStrike обнаружила тревожный прецедент
Для масштабной операции не понадобились ни большая команда, ни сложная инфраструктура.
https://www.securitylab.ru/news/578483.php
UAC-0099 以 ASHVEIN RAT 攻击乌克兰政府人员，将命令隐藏在 HTML 中
被称为 UAC-0099 的亲俄威胁行为者被归因于一个此前未被记录的 .NET 信息窃取软件和远程访问木马（RAT），代号为 ASHVEIN。 据 TrendAI 称，该恶意软件已被用于针对乌克兰政府人员的攻击。这家网络安全公司将这一集群追踪为 Earth Sirrush（此前为 SHADOW-EARTH-065）。 ASHVEIN 的开发者内部将其称为 "TelemetryBrowser"，它集...
http://0.0.0.0:8080/post/64756
【原创发现】Handlebars.js validateAstNode 原型链绕过远程代码执行漏洞(CVE-2026-106446)安全风险通告
致力于第一时间为企业级用户提供权威漏洞情报和有效解决方案。
https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247507735&idx=1&sn=e787ab40315e5de9c1896b2c728791e9
Силикон, оптика и 300 датчиков: Китайская роборука закрыла главную дыру в производстве гибких схем
Пальцы OmniHand 3 Ultra удерживают нить, чувствуют проскальзывание и сами подбирают усилие.
https://www.securitylab.ru/news/578426.php
【深度研判】日本召开反间谍专家小组首次会议并拟推外国代理人登记，对我合法影响力渠道与在日人员活动空间收紧
日本此轮调整，真正值得关注的不是会不会出台一部单独法律而是外部影响登记、经济安全、投资审查、安全许可、科研管
https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650569831&idx=2&sn=78125f2fc1fe480aa5c295975e88f265
“子午线计划”！五角大楼把未来战争交给三位老板之后的十大真相
2026年9月30日，赫格塞思在弗吉尼亚州匡蒂科海军陆战队基地发表“部队状态”演说，宣布启动“子午线计划”（P
https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650569831&idx=1&sn=1bf234b90a6aa4ef6f6e90518af53e4e
从“翻得快”到“敢用”:太好译6S+1能成为AI翻译的行业标尺吗？
欢迎「路歌」入驻补天专属SRC！
https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247511225&idx=1&sn=ca6b2a96fcb0acc4d29e55fbfcb5eb03

Managed ad