每日安全资讯（2026-10-10）

• Private Feed for M09Ic
  • bolucat released 202610100029 at bolucat/Archive
  • timwhitez contributed to timwhitez/AutoRE-CLI
  • anthropics released v2.1.296 at anthropics/claude-code
  • pydantic released v2.55.0 at pydantic/pydantic-ai
  • timwhitez starred cursor/plugins
  • esrrhs contributed to esrrhs/fakelua
  • timwhitez starred yuka-friends/Windrecorder
  • esrrhs contributed to esrrhs/spp
  • Ascotbe starred tindy2013/subconverter
  • Mr-xn starred derv82/wifit3
  • Rvn0xsy starred mandiant/gopacket
  • 0xbug forked seeksec/rea from morluto/rea
  • safedv starred Kudaes/Puzzle
  • OpenAEV-Platform released 3.261009.0 at OpenAEV-Platform/openaev
  • bitsadmin starred bitsadmin/wesng
  • timwhitez starred mhtsec/ARTEX
  • Gaurav-Gosain released v0.9.2 at Gaurav-Gosain/tuios
  • Chuyu-Team released v1.2.3 at Chuyu-Team/YY-Thunks
• Doonsec's feed
  • 女友身体不好，程序员男友写出“抢号软件”帮挂专家号，一秒能点1000多下，后帮人收费抢号获利超1万元，还搞瘫医院挂号系统
  • 实测数据：AI 爬虫吃掉了近四分之一的网站流量
  • 第10届“强网杯”可以报名了！全国性网络安全挑战赛
  • 黑客AI入侵韩国多家银行
  • 我把一个目标丢给 AI 找洞，它给了我一个 RCE——也给了 27 个幻觉
  • 成人网91Porn 1400万中国用户数据疑泄露！暗网叫卖，或被勒索、敲诈
  • RSA常见题型
  • 鸿蒙系统跳过开屏广告神器
  • 百度Q3反腐通报：15人涉刑，41人被查
  • 李有田到死都没有踩断刹车
  • Atlassian Jira存在任意文件读取漏洞CVE-2026-21589 xa0附POC
  • 自主横向移动与权限提升
  • AI取证实战第23期：Qiko3.0取证智能体赋能电子数据取证初体验
  • 鲲鹏展翅，御风而行！2026“鲲鹏杯”网络安全大赛正式启航！
  • 特朗普移动设备完整泄露文件：3621条真实用户数据长啥样？连特朗普集团CIO都在里面
  • 湖南网信办约谈4家大模型企业：安全不是上线后的补丁
  • 「AI Agent安全」IronClaw拆解：WASM沙箱+凭证注入怎么防密钥泄露
  • 渗透测试环境配置2026：从裸机到AI增强攻击平台，一次讲清不踩坑
  • 复现Atlassian系统任意文件读取漏洞(CVE-2026-21589)
  • 一个分号接管账号：Telegram Desktop 的 IPC 注入链
  • G.O.S.S.I.P 阅读推荐 2026-10-09 Local Mess
• SecWiki News
  • SecWiki News 2026-10-09 Review
• obaby 𝐢‍𝐧⃝ void
  • Findu APP 4.0.5 — 好友定位 位置分享
  • 竹子庵
• 安全客-有思想的安全新媒体
  • 你让 AI 截个图，它顺手把你公司机密传上了公网
  • 鱼缸插排被黑，一缸鱼全死了：你家的"智能"正在替黑客开门
  • 从“翻得快”到“敢用”:太好译6S+1能成为AI翻译的行业标尺吗？
• ElcomSoft blog
  • Low-Level Extraction of the HomePod mini
• Recent Commits to cve:main
  • Update Fri Oct 9 12:45:08 UTC 2026
• 小刀志
  • 从 WinCrypt 到 OpenSSL：构建 PESignAnalyzer 跨平台版本
• Horizon3
  • AI Changed the Economics of Cyberattacks
• Kitploit — Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!
  • ToBAC
  • kev-data
  • garble
  • GoBfuscator
  • kernel-research
  • msynth
  • p0tools
  • wolfssh
  • cyclepatrol
  • cloudflare-security-art
  • pqc-cost-of-delay
  • WebMirage
  • SLDR
  • NeuPerm
  • CKA-Agent
  • Awesome-RAG-Security
  • icicle-python
  • sleigh
  • striga
  • revng
  • MiniVisorPkg
  • TitanHide
  • MAccConc
  • PPLwindow
  • QuickAssist_UAC_Bypass
• Hexacorn
  • Solving practical problems with AI – Part 1 – Jpeg files renaming using EXIF data
• Malwarebytes
  • ASOS breach update: Hackers stole customer details and shopping searches
• Reverse Engineering
  • Apple Watch connector for Android, Linux, Windows... It seems to be a world first
  • Getting old Macromedia Director Games to run on modern Hardware
  • GitHub - gilnett/wstrace: Standalone zero-driver Windows system and API monitor in Rust
• HackerNews
  • MonsterCloud 所有者被控收取超 1900 万美元费用，同时秘密支付赎金以解密数据
  • 16 个恶意 Firefox 扩展伪装成 Rabby 和 OKX 钱包以窃取助记词
  • ARTEX AI 渗透测试工具被用于对韩国金融机构的数据窃取攻击
  • Uranium 加密货币交易所黑客因窃取 5300 万美元被定罪
  • FakeGit 恶意软件活动卷土重来，含 17,610 个恶意 GitHub 仓库
  • UAC-0099 以 ASHVEIN RAT 攻击乌克兰政府人员，将命令隐藏在 HTML 中
• Offensive Security Blog: Latest Trends in Hacking | Praetorian
  • Hunt, Triage, and Act on Guard Findings in Slack
• 奇客Solidot–传递最新科技情报
  • Let's Encrypt 从 2027 年起切换到有效期为 64 天的证书
  • 超强厄尔尼诺已经形成
  • 人类愿意向女性形象的 AI 智能体支付的报酬低于男性形象智能体
  • 诺贝尔和平奖授予了南非女法官 Navi Pillay
  • 为何大型犬衰老速度更快
  • 智能咖啡机 10 天内产生 1TB 数据流量
  • ARTEX 从 GitHub 下架
  • SpaceX 呼吁在轨卫星加强协调
  • 美光台工厂工会获得罢工权，支持率 99%
  • 亚马逊 Prime Video 将直播艾美奖颁奖典礼
  • 定义了软件工程的计算机科学家 Margaret Hamilton 去世，享年 90 岁
  • 微软被暂停参与允许外籍员工申请绿卡的项目
• 绿盟科技技术博客
  • 直播预告 | 数据悄悄流出，行为悄悄越界？企业里的智能体，该管起来了
• 腾讯玄武实验室
  • 每日安全动态推送(26/10/9)
• 黑鸟
  • 实测数据：AI 爬虫吃掉了近四分之一的网站流量
• 威努特安全网络
  • 汽车工厂里，管理平台“够不着”的终端怎么管？
• 腾讯安全应急响应中心
  • 开源，也能影响世界！
• 代码卫士
  • 思科：注意可导致 Nexus 交换机遭接管的多个严重漏洞
  • Citrix：这个严重的 NetScaler SAML 漏洞可导致 RCE
• 安全内参
  • 数百万用户手机收到黑客勒索通知，一上市公司股价闪崩逾10%
  • 国产鱼缸智能插排遭黑客攻击断电：观赏鱼或大量死亡 官方致歉
• 暗影安全
  • CZ：不要连Wi-Fi ，不要连Wi-Fi，不要连Wi-Fi
• 吾爱破解论坛
  • Binary Ninja 5.3.9434 Personal 授权逻辑分析
• 安全客
  • 鱼缸插排被黑，一缸鱼全死了：你家的"智能"正在替黑客开门
• 绿盟科技研究通讯
  • Trident：一种面向未知流量识别与模型持续更新的检测框架
• 安全研究GoSSIP
  • G.O.S.S.I.P 阅读推荐 2026-10-09 Local Mess
• 天御攻防实验室
  • 黑客 Halvar Flake
• 奇安信 CERT
  • 【原创发现】Handlebars.js validateAstNode 原型链绕过远程代码执行漏洞(CVE-2026-106446)安全风险通告
• 安全圈
  • 【安全圈】Let's Encrypt证书期砍至64天：明年2月生效，人工运维将失效
  • 【安全圈】号称自研解密骗千万：应急响应厂商当黑客中间商被起诉
  • 【安全圈】npm包tensorlake投毒：内置Bun蠕虫狂偷AI凭证
• 数世咨询
  • MFA、SSO 还不够：下一代身份安全必须盯住“权限”
  • Rein Security 获 2500 万美元融资，AI Agent 运行时安全正在成为新赛道
• 小米安全中心
  • 「极智守护·智启新程」第二届小米汽车守护活动正式启动！
• 电子物证
  • 【我国刑事电子数据鉴真规则研究】
  • 【区块链存证，法院认不认？】
• 补天平台
  • 欢迎「路歌」入驻补天专属SRC！
• 云鼎实验室
  • 人类铸剑，AI 争王！第三届智能攻防挑战赛报名开启
• 极客公园
  • 记录生生不息的创新力量｜2026 年度「InnoForce 50」启动
  • 好产品就是与时代和生活共振｜2026 年度极客最爱好物启动
  • 攻克超声穿颅读脑，拿下 4 亿元新融资，他们要做脑科学的「英伟达」
  • 谷歌云发布 Gemini Agent；Manus 官宣五亿美元融资；小鹏上线 Robotaxi 打车小程序 | 极客早知道
• 安全分析与研究
  • 自主横向移动与权限提升
• 安全牛
  • AI吹得再响也没用！评估Agentic SOC的10大维度，一线SOC分析师亲测指南
  • 2027年2月10日起默认 TLS 证书有效期将缩短至 64 天；Google 为 Gemini 引入 Agentic AI，企业端率先落地通用工作智能体| 牛览
• 看雪学苑
  • SDC2026议题预告 | 大语言模型驱动的移动软件安全分析实践
  • 木马的密文里，出现了我的窗口标题：从主机取证、内存逆向到 C2 协议与渗透尝试复盘
  • Citrix NetScaler 曝出 9.5 分严重漏洞，SAML 部署存在远程代码执行风险
• 奇安信威胁情报中心
  • 每周高级威胁情报解读(2026.09.25~10.08)
• 网络空间安全科学学报
  • 倒计时7天！2026年网络空间安全学术会议即将召开
• 火绒安全
  • 免费资源不“免费” | 荐片播放器静默安装劫持主页
  • 火绒小问答——「企业版」软件禁用
  • 【火绒安全周报】日经新闻再曝安全事件/OpenAI全面上线GPT-6
  • 诚邀渠道合作伙伴共启新征程
• 中国信息安全
  • 专题·原创 | Mythos类模型对网络安全的系统性冲击与防御范式重构
  • 专家解读 | 王天广：激活数据产权制度效能 共建全国一体化数据市场
  • CNCERT | 关于内置后门功能的恶意软件“荐片播放器”大规模传播的风险提示
  • 观点 | 法治护航低空经济高质量发展
• 字节跳动技术团队
  • 三篇重磅论文，拆解 OpenViking 核心技术
  • Codex 额度用完之后，如何用 OpenViking 接着把活干完
• 安全行者老霍
  • 企业应对“影子 AI”的 9 大检测工具
• 情报分析师
  • “子午线计划”！五角大楼把未来战争交给三位老板之后的十大真相
  • 【深度研判】日本召开反间谍专家小组首次会议并拟推外国代理人登记，对我合法影响力渠道与在日人员活动空间收紧
• 360数字安全
  • 15家同台，360再拿第一！获IDC大模型安全最高评级
• 青藤智库
  • 深度报告 | NIST CSF 2.0，给 AI 一把安全标尺
• IntelTechniques by Michael Bazzell
  • Gear Review: XTEINK X4 Pro
  • Gear Review: OLYVUE V78 Dash Cam
• 安全419
  • 176号令正式生效：一份写给单位合规负责人的"体检清单"
• Over Security
  • Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
  • Japan confirms arrest of Russian Qilin operative, extradition to Germany
  • FBI arrests another suspected ShinyHunters hacker after agency breach
  • Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto
  • Leader of vast money mule operation that laundered cybercriminal proceeds pleads guilty
  • Hundreds of thousands impacted by data breach at biosensor firm iRhythm
  • Guerra cyber e AI agentica: quando anche gli attaccanti perdono il controllo
  • FBI touts another ShinyHunters arrest in response to data breach
  • Germany arrests alleged core Qilin ransomware member after extradition
  • Sintesi riepilogativa delle campagne malevole nella settimana del 3 – 9 ottobre
  • Caso Publica, la Svizzera colpita attraverso un fornitore: la lezione sulla supply chain per l’Italia
  • Belarusian hacktivists admit to 2023 breach of Russian state healthcare network
  • Videosorveglianza comunale, il regolamento conta, ma non basta: bocciate le finalità “tuttofare”
  • How to keep AI agents within their permissions
  • OpenAI says it disrupted Russian and Iranian influence ops that used ChatGPT
  • The Cyber Express Weekly Roundup: US Puts $10 Million Bounty on Chinese Hacker, Japan Moves to Hunt Hidden Attackers and More
  • Midnight Mimosa, il malware preinstallato nel firmware degli smartphone Android
  • Max severity SonicWall SMA1000 flaw now exploited in attacks
  • AI And Cybersecurity: An Interview With Cyril Simonnet
  • Man admits to running network of 15,000 money mules for cybercriminals
  • Microsoft: Outdated Windows devices will stop receiving security updates
  • Privacy su scala globale: come ExpressVPN integra protezione post-quantistica, server RAM e offuscamento del traffico
  • Midnight Mimosa, ancora malware Android installato prima dell’acquisto
  • Ray-Ban Meta alla prova del GDPR: il dilemma della contitolarità
  • Videosorveglianza urbana: il nuovo Patto per la sicurezza chiarisce le responsabilità privacy
  • Chi protegge i nostri pagamenti?
  • Citrix warns admins to patch new NetScaler RCE flaw immediately
  • Andover Confirms Cyberattack Reached Its Systems, Investigation Continues
  • How Fake Journalists Got Iranian Articles Into Real Outlets
  • Splunk Patches 22 Vulnerabilities, Including Critical Flaw With CVSS 9.8
  • Agentic AI In Cybersecurity: What Changes When The System Chooses The Next Step
  • Neogen - 435,963 breached accounts
  • FBI Takes Down China-Linked Tools That Scanned US Utilities
  • Hackers get $1,262,000 for 98 zero-days at Pwn2Own Ireland
  • Co-creator of Empire Market dark web marketplace given 40-year sentence
• SANS Internet Storm Center, InfoCON: green
  • ISC Stormcast For Friday, October 9th, 2026 https://isc.sans.edu/podcastdetail/10130, (Fri, Oct 9th)
• Schneier on Security
  • Friday Squid Blogging: I Caught a Squid
• 丁爸 情报分析师的工具箱
  • 【开源报告】以色列内战、崩溃与解体风险研判
  • 情报分析师培训课程（三）安全威胁类
• Have I Been Pwned latest breaches
  • Neogen - 435,963 breached accounts
• Tor Project blog
  • A statement on the Tor Project's relationship with Mullvad
• ICT Security Magazine
  • Phishing aziendale: perché i dipendenti formati cliccano comunque?
• LastKnight.com Feed
  • Non fate male a Claude o altrimenti…
• The Hacker News
  • Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
  • FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack
  • P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
  • TP-Link Sued by Four More U.S. States Over Router Security and China Ties
  • Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access
  • Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects
  • Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge
  • Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
  • The AI Velocity Paradox: Why Security Is Decades Behind AI Ambition
  • GoBalance Flaw Lets Attackers Hijack .onion Addresses by Recovering Tor-Format Keys
  • Three Teams Demonstrate Remote Hacks of Fully Patched Google Pixel 10 at Pwn2Own
  • Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments
  • FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions
• Daniel Miessler
  • My Thoughts on Renaming AI to Super Intelligence
  • Harness Gardens
• www.theregister.com - Articles
  • AWS AgentCore security undone by prompt requesting credentials
  • Citrix gives NetScaler admins another critical reason to patch
• Deeplinks
  • Resisting the Menace of Federal Data Consolidation
  • Organizing in the Town at Oakland Tech Week
  • Turkish Crackdown On LGBTQ+ Organizations Threatens Freedom of Expression and Association
• GRAHAM CLULEY
  • $10 million bounty offered for Chinese Hafnium hacker accused of Microsoft Exchange Server mega-attack
• TorrentFreak
  • Pirate Streaming Portal Series.ly Has Domain Suspended, Rebrand Surfaces (Updated)
• Securityinfo.it
  • Midnight Mimosa, ancora malware Android installato prima dell’acquisto
• Instapaper: Unread
  • Ghostmaxxing
  • Low-Level Extraction of the HomePod mini
  • Caso Revolut, l’azienda si farà carico dei costi per il recupero dei documenti hackerati
  • Italy’s Foreign Ministry Under Cyberattack as Embassy Sites Come Under Review
• Security Affairs
  • Germany Arrests Suspected Qilin Ransomware Leader After Japan Detention
  • Claude Helps Secure Open Source as Anthropic Offers Free Vulnerability Scanning
  • US Disrupts China-Linked Integrity Tech ‘s Cyber Espionage Tools
  • CVE-2026-107406: Citrix Fixes Critical NetScaler ADC and Gateway Vulnerability
  • AI-Driven tool ARTEX used in attacks against South Korean Banks
• KitPloit - PenTest Tools!
  • ToBAC
  • kev-data
  • garble
  • GoBfuscator
  • kernel-research
  • msynth
  • p0tools
  • wolfssh
  • cyclepatrol
  • cloudflare-security-art
  • pqc-cost-of-delay
  • WebMirage
  • SLDR
  • NeuPerm
  • CKA-Agent
  • Awesome-RAG-Security
  • icicle-python
  • sleigh
  • striga
  • revng
  • MiniVisorPkg
  • TitanHide
  • MAccConc
  • PPLwindow
  • QuickAssist_UAC_Bypass