Aggregator

从 23 年 5 月到 26 年 5 月，历经 3 年时光，虽然软装还没有买，但也算是大致完成了新房的装修，回想期间种种，感慨万分。装修这 3 年，并非一直是高强度推进，而是断断续续，如同钝刀子割肉般

欢迎订阅《中国信息安全》杂志！

当前，个人信息是数智时代新型生产要素的重要基石。海量个人信息的有序流动与高效运用，正持续释放澎湃数字动能，深刻重塑社会运行肌理和时代发展格局。但过度采集、非法滥用、信息倒卖、精准诈骗等风险隐患亦相伴而生，个人信息保护面临前所未有的严峻考验。

A vulnerability was found in Netty up to 4.1.132.Final/4.2.12.Final. It has been classified as problematic. This affects the function setUri of the component HTTP Request Handler. Performing a manipulation results in crlf injection. This vulnerability is reported as CVE-2026-41417. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

A vulnerability classified as critical has been found in AcademySoftwareFoundation OpenEXR up to 3.2.8/3.3.10/3.4.10. Impacted is the function ImageChannel::resize of the component EXR File Handler. Performing a manipulation results in integer overflow. This vulnerability was named CVE-2026-41142. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability marked as problematic has been reported in Tor up to 0.4.9.7. The affected element is an unknown function. Performing a manipulation results in incorrect resource transfer. This vulnerability is known as CVE-2026-44599. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability was found in Tor up to 0.4.9.7 and classified as problematic. Impacted is an unknown function. The manipulation results in null pointer dereference. This vulnerability is identified as CVE-2026-44602. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability has been found in xmldom and classified as critical. This impacts an unknown function of the component DOMParser/XMLSerializer. This manipulation causes xml injection. This vulnerability is tracked as CVE-2026-41675. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

A vulnerability was found in Tor up to 0.4.9.7. It has been classified as problematic. The affected element is an unknown function. This manipulation causes off-by-one. This vulnerability is tracked as CVE-2026-44603. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

A vulnerability has been found in Tor up to 0.4.9.7 and classified as problematic. This issue affects some unknown processing. The manipulation leads to improper enforcement of a single, unique action. This vulnerability is referenced as CVE-2026-44601. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

核心概念：如何实现“编排”翻译常见相关命令速查表在 Linux 下， gettext 是类 Unix 系统中实现国际化（i18n）和本地化（l10n）的标准库与工

思科已修复其企业产品中的多个高危漏洞，其中包括 Unity Connection 中的服务器端请求伪造（SSRF）漏洞，这些漏洞可能导致代码执行或服务中断。   思科针对影响其企业产品的多个高危漏洞发布了补丁。若这些漏洞被成功利用，可能导致代码执行、服务器端请求伪造（SSRF）或拒绝服务攻击。两个值得关注的漏洞，CVE - 2026 - 20034 和 CVE - 2026 - 2003...

error code: 1003

AI公司OpenAI周四表示，其 API现在将包括一系列新的语音智能功能，旨在帮助开发者创建能够与用户进行对话、转录以及翻译对话的应用。该公司的新款GPT‑Realtime‑2是另一个语音模型，旨在创

Vercel has released an extensive set of security advisories for Next.js, addressing more than a dozen vulnerabilities, including denial-of-service, middleware bypass, server-side request forgery, and cross-site scripting. The flaws affect Next.js versions 13.x through 16.x using the App Router, as well as React Server Components packages for versions 19.x. CVE-2026-23870: Denial of Service via React […]

The post Multiple Critical Vulnerabilities Patched in Next.js and React Server Components appeared first on Cyber Security News.

AI-Driven Attacks Compress Breakout Times, Forcing Defenders to Rely on Context Now
AI has lowered the cost and speed of cyberattacks, enabling adversaries to exploit vulnerabilities within minutes. As breakout times collapse, security teams must respond faster by using context-driven intelligence and automation to detect, prioritize and stop threats in real time.

Artificial intelligence that is embedded in newer editions of software and other technology tools but is not explicitly revealed by vendors is a substantial risk on par with shadow AI, said regulatory attorney Elizabeth Hodge with the law firm Akerman LLP.

Also, Taiwan Rail Hack, Massive DDoS Attack and Karakurt Jail Sentence
This week, Microsoft Edge exposed passwords, Taiwan police make arrests in high-speed rail hack and a 2.45 billion-request DDoS attack. A Karakurt negotiator jailed, North Korean IT worker scams led to prison terms and France detained a teen over a government data breach. Another Ivanti zero-day.

WatchGuard Aims to Reduce Alert Fatigue Through Telemetry Correlation
WatchGuard acquired SaaS security startup Perimeters to strengthen cloud detection and response capabilities spanning identity threat detection, cloud posture management and shadow IT discovery as enterprises face escalating attacks targeting cloud applications and distributed environments.