每日安全资讯（2026-09-20）

• SecWiki News
  • SecWiki News 2026-09-19 Review
• Doonsec's feed
  • 渗透工具包（ PEEP）将 Chrome 和 Edge 浏览器变成入侵后执行高危命令的后门
  • 当全网以为现在是2006年
  • 一文读懂FDE工程师的七大核心能力
  • 分享的图片、视频、链接
  • 开源PentAGI的 AI 驱动自动化渗透测试平台调研测评
  • Claude 打穿 OpenAI细节：一张 HEIC 图，撬开私有代码库
  • 美国炸伊朗小学、123名儿童遇难：旧情报+AI信任过载，两枚战斧炸出的战争罪
  • 一个Word文档，就能“远程控制”你的Microsoft Copilot
  • 27岁，不整虚的！
  • EDR攻击技术-进程与遥测欺骗
  • 华为全联接大会2026｜华为星河AI网络安全解决方案为企业在AI时代构筑一体化智能安全防护体系
  • 网安回忆录xa0-xa0一白板上那行"待确认"，答案不只在网络日志里
  • 攻防技战术动态一周更新 - 20260914
  • iOS 26.7 升不升？15、16、17 三个系列，三个不同答案
• 安全客-有思想的安全新媒体
  • 3000 美元、3 个人、72 小时：AI 把 OpenAI 的论坛打穿了
  • 一个月 68 个 CVE、91.8% 没有 OAuth：你的 AI 工具层正在裸奔
• Recent Commits to cve:main
  • Update Sat Sep 19 12:26:43 UTC 2026
• Sploitus.com Exploits RSS Feed
  • hash-identifier exploit
  • CyberStrikeAI exploit
  • BruteShark exploit
  • trivy exploit
  • CVE-Lib exploit
  • tcpdump exploit
  • malicious-pdf exploit
  • awesome-osint-arsenal exploit
  • redamon exploit
• Private Feed for M09Ic
  • bolucat released 202609192223 at bolucat/Archive
  • chainreactors released v1.0.0-rc4 at chainreactors/cyber-harness
  • esrrhs contributed to esrrhs/pingtunnel
  • esrrhs contributed to esrrhs/spp
  • Mr-xn forked Mr-xn/dsh2shell from ChaoMixian/dsh2shell
  • kpcyrd contributed to kpcyrd/repro-threshold
  • timwhitez starred QiantangCredit/heimdall-pentest
  • Mel0day forked Mel0day/wx-cli-again from jackwener/wx-cli-again
  • Mel0day starred jackwener/wx-cli-again
  • CHYbeta starred tamaratran/fast-jev-compaction
  • mgeeky starred purehate/herdr-plugin-picker
  • pydantic released v2.46.0 at pydantic/pydantic-ai
  • Mel0day starred Mel0day/retro2003
  • anthropics released v2.1.278 at anthropics/claude-code
  • Mr-xn starred xtaci/smux
  • Ridter starred xtaci/smux
  • esrrhs contributed to esrrhs/fakecc
  • esrrhs contributed to esrrhs/fakelua
• Kitploit — Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!
  • rustinel v1.8.0-rc.1
  • urx v0.11.0
  • lightkeeper v1.4.1
  • firefox-devtools-mcp v0.10.3
  • xalgorix v4.6.78
  • rspamd v4.2.0
  • Reversecore_MCP v3.0.4
  • vigolium v0.4.8
  • yakit v1.4.8-0919
  • red-teaming-auto-mode
  • ciso-assistant-community
  • agent-scan v0.6.4-snapshot-6e2d290-1638
  • maigret v0.6.6
  • wolfCOSE v2.0.0
  • OpenAM v16.1.3
  • bunkerweb v1.6.15-rc3
  • volatility3 v2.28.2
  • checkov v3.3.19
  • proxmark3 v4.23346
  • frida-ssl-bypass
  • Veridiff
  • js-x-ray @nodesecure/js-x-ray@16.1.0
  • evmbench-certora-agent-harness
  • sslscan v2.2.3
  • faraday v5.24.2
• Reverse Engineering
  • CVE-2026-77179: Docker's hypervisor for Mac compromised (Docker Desktop, Docker Sandboxes)
  • New weekly CTF challenge is now live. Ranking is based on solve order.
• 奇客Solidot–传递最新科技情报
  • 大脑由两个不同的器官构成
  • Android 17 QPR1 引入了 Pixel 暂时独占的新 API
  • 海豚 Bubbles 被发现会强迫饱腹鱼吐出食物然后自己将其吞下
• 安全客
  • 国家信息安全漏洞共享平台认证！360揽获三项漏洞治理核心殊荣
• 黑鸟
  • 当全网以为现在是2006年
• 我的安全视界观
  • AI在企业级漏洞预警中的应用
• 安全分析与研究
  • EDR攻击技术-进程与遥测欺骗
• XCTF联赛
  • 第九届“强网”拟态防御国际精英挑战赛设计安全大赛报名启动！
• 看雪学苑
  • OLLVM学姐攻略手册
  • 基于CVD的云手机定制与风控分析
• ChaMd5安全团队
  • 喜报 | ChaMd5荣获第六届“长城杯”网络安全大赛决赛“二等奖”
• 极客公园
  • 不可逆的人类衰老，快被 AI 破解了
  • 折叠屏iPhone维修费传8000元，苹果称尚未定价；腾讯Chatterfly输入法内测；微软高管称AI训练是「史上最大规模劳动盗窃」｜极客早知道
• OnionSec
  • 从春天走到秋天
• T00ls安全
  • 十八而志，与子同袍 - tormail
• IT Service Management News
  • ISO 9001:2026
• bellingcat
  • Christy Kinahan’s UAE Residence Visa Cancelled
• Over Security
  • Viral AI actress' hotline face-scans every caller, watches their mood
  • BragJack attacks hijack AI browser agents through malicious extensions
  • North Korean WaterPlum hackers infected 30,000 devices worldwide
  • ShinyHunters hacks Clop leak site, threatens to extort ransomware gang
  • Calling viral AI actress Tilly Norwood? Agree to a face scan first
• SANS Internet Storm Center, InfoCON: green
  • HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th)
• 技术猫屋
  • 现代 Web 框架共享原生图片处理链的攻击面拆解
• www.theregister.com - Articles
  • Agentic security is the billion-dollar challenge for some clever startup to solve
• Daniel Miessler
  • My Early Thoughts on Jev
• KitPloit - PenTest Tools!
  • rustinel v1.8.0-rc.1
  • urx v0.11.0
  • lightkeeper v1.4.1
  • firefox-devtools-mcp v0.10.3
  • xalgorix v4.6.78
  • rspamd v4.2.0
  • Reversecore_MCP v3.0.4
  • vigolium v0.4.8
  • yakit v1.4.8-0919
  • red-teaming-auto-mode
  • ciso-assistant-community
  • agent-scan v0.6.4-snapshot-6e2d290-1638
  • maigret v0.6.6
  • wolfCOSE v2.0.0
  • OpenAM v16.1.3
  • bunkerweb v1.6.15-rc3
  • volatility3 v2.28.2
  • checkov v3.3.19
  • proxmark3 v4.23346
  • frida-ssl-bypass
  • Veridiff
  • js-x-ray @nodesecure/js-x-ray@16.1.0
  • evmbench-certora-agent-harness
  • sslscan v2.2.3
  • faraday v5.24.2
• TorrentFreak
  • South African Minister Tells Film Summit It Has a Double Standard on Piracy
• Security Affairs
  • Google Gemini also Broke Out of Its Test Environment
  • AI Helps Hackers Hijack OpenAI Staff Accounts Through a Forum
• The Hacker News
  • Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws
  • Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar
  • Identity Visibility in 2026: The Foundation of Identity Security
  • SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE
  • Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild
  • Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up
  • CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
  • CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild
• Blackhat Library: Hacking techniques and research
  • Back when you could just freely login to hundreds of active servers a day