Repository navigation
[每日信息流] 2026-05-20 #1245
Description
每日安全资讯（2026-05-20）
- SecWiki News
- 安全客-有思想的安全新媒体
- No Headback
- Hacking Articles
- CXSECURITY Database RSS Feed - CXSecurity.com
- Tenable Blog
- Recent Commits to cve:main
- Verne in GitHub
- Private Feed for M09Ic
- kpcyrd contributed to kpcyrd/repro-threshold
- kpcyrd contributed to kpcyrd/what-the-src
- anthropics released v2.1.145 at anthropics/claude-code
- bolucat released 202605192158 at bolucat/Archive
- joaoviictorti starred microsoft/azurelinux
- mgeeky starred reddelexc/hackerone-reports
- spf13 starred zakirullin/files.md
- niudaii starred nextai-translator/bob-plugin-openai-translator
- INotGreen starred Dimillian/CodexMonitor
- PrefectHQ released 3.7.2.dev2 at PrefectHQ/prefect
- safedv starred Hamid-K/nginx-rift-private-lab
- Ridter forked Ridter/VMkatz from nikaiw/VMkatz
- Ridter starred nikaiw/VMkatz
- LoRexxar contributed to LoRexxar/Kunlun-M
- liamg contributed to infracost/proto
- LoRexxar starred nexu-io/html-anything
- OpenAEV-Platform released 2.4.0 at OpenAEV-Platform/openaev
- mgeeky starred evilsocket/audit
- pydantic released v1.98.0 at pydantic/pydantic-ai
- anthropics released v2.1.144 at anthropics/claude-code
- Microsoft Security Blog
- Doonsec's feed
- Android Pixel 10 零点击漏洞利用链
- 从“概率回答”到“证据解题”：一种面向生物题的可追溯 AI 解题系统
- ShiroExploit：一款Shiro反序列化漏洞一站式综合测试工具
- 别测主站了！2026年SRC捡漏刷分实战：把别人漏掉的资产变成你的赏金
- 聊真东西的地方，今天终于敢开门了
- 又一BYOVD驱动问世，可终结任意进程
- 【AI安全】直面越狱风险！大模型安全防御体系综述
- 【提权漏洞】MiniPlasma-SYSTEM
- 答读者来信
- 给阿嬷（mà）还是阿嬷（mó）的情书？一个字的读音里，藏着你回不去的故乡
- 【课程】图片拍摄地点分析方法与技术1-3（含视频）
- 【重磅推荐】AI + Webpack 全自动挖洞：外部 JS 扒干净，隐藏接口一键现形
- 个人微信接入 CyberStrikeAI（扫码绑定）
- 邮件钓鱼免杀完全指南（2026 实战版）五、ClickFix 与 HTML Smuggling
- 2026HW薪资大跳水，网安人真的被“惯坏”了？
- 2026“工赋砺网” | 专项领域安全赋能培训正式启动
- 2026“工赋砺网”xa0|xa0AI驱动，安全先行——工业数字化转型的AI安全风险与防护体系建设专场培训启动报名
- 2026“工赋砺网”xa0|xa0AI赋能常态化安全运营技术实践专场培训启动报名
- CNNVD | 人工智能重要漏洞通报（2026年第七期）
- CNNVD | 最新OpenClaw多个安全漏洞通报
- 强迫症狂喜：日志审计采集转发客户端 WinLogAgent 升级至 1.0.3：目录只有1个exe啦！
- 2026年中国网络文明大会在南宁举行
- 我自制的8位电脑的PCB板
- AI时代，人类的核心竞争力是什么
- 用豆包P假收据，上海交大一学生私吞5000元竞赛奖金！校方通报来了
- G.O.S.S.I.P 阅读推荐 2026-05-19 NvidiaASLR
- DeepSeek 被营销号逼得下场辟谣了
- Windows服务器如何免费防篡改
- 正版 5 月惠来了！桌面神器 + 效率工具 5 折起，不用苦等 618
- 随波逐流学AI：Claude Code 常用命令
- ShellcodeLoader
- NGINX惊爆18年老洞，野外攻击已开始
- 2026“天枢杯”青少年人工智能安全创新大赛决赛圆满收官
- 面向AI智能体的红队测试实战：基于OWASP ASI 2026的金融场景攻防实践
- 在B站默默耕耘，终于迎来了一千位粉丝的里程碑！
- isCC 非武部分Wp
- Gentlemen勒索软件攻击Windows、Linux、NAS、BSD和ESXi系统
- 给程序员送什么，会让他炫耀三天三夜？
- Kimsuky利用LNK和JSE的诱饵来锁定招聘人员、加密货币用户和国防官员
- GitHub 5.6万星，HackingTool V2.0：一站式渗透工具箱，185+神器一键配齐
- Linux 本地提权工具 支持多个Linux 内核和 Polkit 漏洞 | AnolisOS、openEuler、统信UOS、openKylin、Ubuntu、CentOS 7
- 鲁比奥的“白宫生存哲学”
- 美国能源部投入9400万美元支持小型核反应堆，服务AI与数据中心电力需求
- 最新公开 | 利用RPC添加计划任务Bypass核晶（有时效性）
- 人工智能重要漏洞通报（2026年第七期）
- 人工智能重要安全漏洞的通报-OpenClaw多个安全漏洞
- 信息安全漏洞周报（2026年第20期）
- 供应链安全 | 深入解析 npm 投毒机制、构建流劫持与跨会话持久化控制
- Windows“MiniPlasma”零日漏洞可使攻击者获得SYSTEM权限——概念验证代码已发布
- WordPress插件严重漏洞使网站面临身份验证绕过攻击风险
- CVE-2020-17103 显然未修复或补丁已被撤销，无论如何，这是 cldflt.sys 中 LPE 的 PoC
- 针对 Nginx CVE-2026-42945 的 PoC
- API接口渗透测试工具 ApiHunter
- 实力上榜！众安天下跻身工信部首批网络产品安全漏洞收集备案平台
- 网安必知：防火墙里的“黑话”大全，搞懂这些才算真正入门网络安全！
- 多地加油站监测系统遭入侵后数据被篡改，美官员称无法溯源攻击者
- 从有效载荷到硬目标：美国网络司令部持续推进进攻性网络能力建设
- FBI技术情报网升级：构建全美车辆轨迹识别体系
- 亚数TrustAsia受邀参加Matter技术应用工程师培训沙龙，共探智能家居物联新发展
- 实力认证！亚数TrustAsia入选《嘶吼2026网络安全产业图谱》
- 盛邦安全实力入选嘶吼《2026网络安全产业图谱》5大领域24个细分领域
- 调了十年酒，却调不出自己的"止盈配方
- 聚焦 | 2026年中国网络文明大会在南宁举行
- 国安部提醒：低空安全，不容忽视！
- 发布 | 网安标委发布《人工智能应用伦理安全指引 1.0》（附全文）
- 专家解读 | 刘博：推动人工智能创新发展行稳致远筑牢伦理安全治理屏障
- 关注 | 网聚文明力量 共筑清朗家园——我国网络文明建设取得积极成效
- 计算机专业高含金量的三种证书
- 没规划真不建议学网络安全！
- 真相来了丨警惕AI谣言！“张家界大峡谷玻璃桥断裂垮塌”视频系伪造
- 一张表看懂：AI for Security vs Security for AI
- 当AI替你“打工”,谁在替黑客“开门”?
- 新手必看，激活、汉化，BP启动
- 【免费领】智能设备安全技术干货：路由器0day漏洞挖掘指南
- 一图读懂 | 数据产权制度
- TC260-005《人工智能应用伦理安全指引 1.0》发布
- Insinuator.net
- gynvael.coldwind//vx.log (pl)
- Bug Bounty in InfoSec Write-ups on Medium
- Malwarebytes
- Cerbero Blog
- SentinelOne
- rtl-sdr.com
- 绿盟科技技术博客
- Shostack & Friends Blog
- 黑海洋Wiki | AI机器人硬件开发 | 网络安全攻防实战 | 区块链技术文档教程 - 免费资源平台
- 奇安信 CERT
- 安全客
- 黑鸟
- 威努特安全网络
- 安全内参
- 微步在线研究响应中心
- 奇安信威胁情报中心
- 代码卫士
- 奇客Solidot–传递最新科技情报
- 丁爸 情报分析师的工具箱
- 看雪学苑
- 安全牛
- 补天平台
- 微步在线
- 青藤云安全
- 极客公园
- 数世咨询
- 中国信息安全
- 安全研究GoSSIP
- 字节跳动安全中心
- 恒脑与AI
- 火绒安全
- 字节跳动技术团队
- XCTF联赛
- 安全圈
- 国家互联网应急中心CNCERT
- 情报分析师
- 安全行者老霍
- Qualys Security Blog
- Over Security
- Max-severity flaw in ChromaDB for AI apps allows server hijacking
- Cybercrime service disrupted for abusing Microsoft platform to sign malware
- AI Threat Report: How Artificial Intelligence Is Used Across Illicit Communities
- Discord rolls out end-to-end encryption on voice, video calls
- Posizione dei dati: la lezione dell’11 settembre e la regola 3-2-1 per un corretto backup
- FBI: Americans lost over $388 million to scams using crypto ATMs in 2025
- Microsoft Self-Service Password Reset abused in Azure data theft attacks
- Huawei zero-day attack behind last year’s crash of Luxembourg's entire telecoms network
- Massive npm Supply Chain Attack Hits AntV Ecosystem; Hundreds of JavaScript Packages Compromised
- UK regulator to require tech firms to tackle deepfakes, non-consensual intimate images
- Microsoft disrupts Fox Tempest malware-signing-as-a-service platform tied to ransomware gangs
- Microsoft plans to improve Windows 11 driver quality in 2026
- Hackers have compromised dozens of popular open source packages in an ongoing supply chain attack
- OpenAI co-founder Andrej Karpathy joins Anthropic’s pre-training team
- Microsoft blames undismissible Teams location prompts on macOS update
- TP-Link, Photoshop, OpenVPN, Norton VPN vulnerabilities
- JobStealer colpisce macOS e Windows e ruba dati personali con falsi colloqui di lavoro online
- Ecco come Microsoft ha smantellato il gruppo Fox Tempest
- New Shai-Hulud malware wave compromises 600 npm packages
- Critical Microsoft Vulnerabilities Doubled: From Exposure to Escalation
- 7-Eleven confirms data breach claimed by the ShinyHunters gang
- Guida ai migliori browser con VPN 2026: soluzioni integrate Vs. estensioni Premium
- Guida ai browser con VPN 2026: soluzioni integrate Vs. estensioni Premium
- Cyble Named a Challenger in the Inaugural 2026 Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies
- Microsoft’s MSHTA Legacy Tool Still Powers Malware Campaigns on Windows
- Webinar: The hidden bottlenecks in network incident response
- Microsoft confirms patching issues in restricted Windows networks
- Top 5 Phishing-Driven Social Engineering Attacks on Companies in 2026
- When Filenames Become Attack Surfaces: Weaponizing NASA's CFITSIO Extended Filename Syntax
- From PDB strings to MaaS: Tracking a commodity BadIIS ecosystem used by Chinese-speaking threat
- L’Iran minaccia dazi sui cavi sottomarini: a rischio la connettività digitale mondiale
- Is Fraud Distorting Your iGaming Growth Numbers?
- Austria Blocks Eurovision Cyberattack During Contest Week
- Global Banks Scramble After AI Tool Exposes Cyber Weaknesses
- Critical NGINX Vulnerability CVE-2026-42945 Now Under Active Attack
- FAQ ACN NIS2 sui fornitori rilevanti: cosa cambia con le nuove FRN.8 e FRN.9
- 7-Eleven Confirms Hack After Appearing on ShinyHunters Leak List
- Dal vincolo alla discrezionalità: come procedure e linee guida indirizzano l’azione aziendale
- Microsoft Details Storm-2949 Cloud Attack on Azure and Microsoft 365
- INTERPOL Busts Massive Cybercrime Network Across MENA, 201 Arrested
- CTT - 468,124 breached accounts
- DEF CON Announcements!
- OnionSec
- 迪哥讲事
- Schneier on Security
- Krypt3ia
- SANS Internet Storm Center, InfoCON: green
- Have I Been Pwned latest breaches
- 360数字安全
- Deeplinks
- ICT Security Magazine
- Sicurezza delle reti 5G private: opportunità industriali e rischi sottovalutati
- La geopolitica dell’acquisizione della prova elettronica: la cooperazione internazionale richiede più del solo diritto
- 6.000 campagne phishing contro lo “Stato”: cosa abbiamo imparato
- Adempimenti DORA 2026: guida completa per il settore finanziario
- www.theregister.com - Articles
- Microsoft shuts down illegal code-signing operation used by ransomware crims to mask their malware
- America's top cyber-defense agency left a GitHub repo open with with passwords, keys, tokens – and incredibly obvious filenames
- Clear your calendar, Drupal user: You have a critically urgent patch to install
- TrustedSec
- Trend Micro Research, News and Perspectives
- Lenny Zeltser
- 0x727开源安全团队
- Tor Project blog
- The Hacker News
- Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid Requests Using 455 Apps
- DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability
- The New Phishing Click: How OAuth Consent Bypasses MFA
- Drupal to Release Urgent Core Security Updates on May 20, Sites Told to Prepare
- SEPPMail Secure E-Mail Gateway Vulnerabilities Enable RCE and Mail Traffic Access
- Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer
- Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials
- Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account
- Security Affairs
- Drupal is rolling out an emergency security update on May 20. You cannot miss it
- Microsoft dismantled malware-signing network Fox Tempest
- Poland shifts away from Signal following cyberattacks on officials’ accounts
- Massive MENA cybercrime Operation Ramz disrupts infrastructure and arrests 201 suspects
- Shai-Hulud worm copycats emerge after source code leak
- Instapaper: Unread
- TorrentFreak
- Security Weekly Podcast Network (Audio)
- 网安寻路人
Activity
MichisGitIsKing commentedon May 20, 2026
/attempt #1245
I'd like to work on this bounty. Starting implementation now.