# 每日安全资讯（2026-08-11） - SecWiki News - [ ] [SecWiki News 2026-08-10 Review](http://www.sec-wiki.com/?2026-08-10) - Sploitus.com Exploits RSS Feed - [ ] [Exploit for Use After Free in Linux Linux_Kernel](https://sploitus.com/exploit?id=CF991020-D4D1-545A-BB38-599DBE466897&utm_source=rss&utm_medium=rss) - [ ] [Exploit for CVE-2025-7771](https://sploitus.com/exploit?id=6D5BC7E6-C0A6-54A0-8116-47799C31DFA2&utm_source=rss&utm_medium=rss) - [ ] [pt-esign__Damn-vulnerable-sca exploit](https://sploitus.com/exploit?id=A280E910-66FD-5193-B5F6-9840B42148EF&utm_source=rss&utm_medium=rss) - [ ] [pt-platform__java-goof-1 exploit](https://sploitus.com/exploit?id=0B8C940D-49E0-561B-BFC8-CAC1A86226BF&utm_source=rss&utm_medium=rss) - [ ] [pt-identity__vulnerable-app exploit](https://sploitus.com/exploit?id=B9E6DF00-0F8D-57B5-A179-FC4F342DDDED&utm_source=rss&utm_medium=rss) - [ ] [dts-data__damn-vulnerable-tiny-web-server exploit](https://sploitus.com/exploit?id=1C1D4F08-19F5-5D9C-9902-B7C805C5003E&utm_source=rss&utm_medium=rss) - [ ] [dts-data__damn-vulnerable-web-server exploit](https://sploitus.com/exploit?id=801D956D-3A5C-50AD-BE09-8EE6BB44A926&utm_source=rss&utm_medium=rss) - [ ] [pt-platform__container-breaking-in-goof exploit](https://sploitus.com/exploit?id=ED65369B-9FD0-5DAA-A1EF-C6B9BC62568D&utm_source=rss&utm_medium=rss) - [ ] [dts-data__Linux-Damn-Vulnerable-Thick-Client exploit](https://sploitus.com/exploit?id=83B1CC27-0340-5B53-8B3B-5393E19006B3&utm_source=rss&utm_medium=rss) - [ ] [pt-identity__AWSGoat exploit](https://sploitus.com/exploit?id=2ECF1C7A-A813-5073-AA1F-ABC2F12AB18D&utm_source=rss&utm_medium=rss) - [ ] [pt-clm__php-goof exploit](https://sploitus.com/exploit?id=17559E29-546F-5641-ADBD-AC41961408A1&utm_source=rss&utm_medium=rss) - [ ] [pt-platform__DVWA exploit](https://sploitus.com/exploit?id=560347FB-993E-5AA2-A323-8A07D3A6377A&utm_source=rss&utm_medium=rss) - [ ] [Exploit for Code Injection in Pgadmin Pgadmin_4](https://sploitus.com/exploit?id=9F6331E5-5DA3-590D-8EF1-8E9CACCF837D&utm_source=rss&utm_medium=rss) - [ ] [Exploit for CVE-2021-47881](https://sploitus.com/exploit?id=1B72B217-1BAF-501E-B07D-65FA8911424D&utm_source=rss&utm_medium=rss) - [ ] [Exploit for Missing Authentication for Critical Function in Mcpjam Inspector](https://sploitus.com/exploit?id=0E7E8852-AAAF-5E3F-A958-936BC9637055&utm_source=rss&utm_medium=rss) - [ ] [web-pentesting exploit](https://sploitus.com/exploit?id=A49FCC9E-7A62-588B-9114-9CBF55803A4F&utm_source=rss&utm_medium=rss) - [ ] [Exploit for Protection Mechanism Failure in Microsoft](https://sploitus.com/exploit?id=6290A1B5-7211-5F59-A180-E43813D3ED81&utm_source=rss&utm_medium=rss) - [ ] [Exploit for Improper Input Validation in Widgetfactorylimited Jce](https://sploitus.com/exploit?id=7F2A4B72-DD31-5492-B340-9C9BF558759E&utm_source=rss&utm_medium=rss) - [ ] [cve_vulnerability_bot exploit](https://sploitus.com/exploit?id=B4E85D86-8841-56BB-A681-215D84AD8C7E&utm_source=rss&utm_medium=rss) - [ ] [react2shell-poc exploit](https://sploitus.com/exploit?id=02C28234-D3B6-5D57-823A-350E54212819&utm_source=rss&utm_medium=rss) - [ ] [Exploit for CVE-2026-64824](https://sploitus.com/exploit?id=D4C1A180-C36F-585C-A785-6CE3420ACF12&utm_source=rss&utm_medium=rss) - [ ] [SQLDemoCenter exploit](https://sploitus.com/exploit?id=EC2414BE-C4BA-5FB0-9187-02749D3A1FB3&utm_source=rss&utm_medium=rss) - [ ] [Exploit for CVE-2026-14802](https://sploitus.com/exploit?id=F3875A46-F7ED-5DA7-B172-5AB67AADD1FF&utm_source=rss&utm_medium=rss) - [ ] [Exploit for CVE-2026-15598](https://sploitus.com/exploit?id=AB77B3EB-FE5B-5724-B2E0-53D8182A9EF7&utm_source=rss&utm_medium=rss) - [ ] [Exploit for Expression Language Injection in N8N](https://sploitus.com/exploit?id=B3E39DC5-D089-5881-8643-611C001BE877&utm_source=rss&utm_medium=rss) - [ ] [PAYLAOD_SQLi_XSS exploit](https://sploitus.com/exploit?id=F588C593-F8E3-55E8-AB1E-CB97237E4A98&utm_source=rss&utm_medium=rss) - Der Flounder - [ ] [Validating FileVault recovery keys using a plist file to provide recovery key information on macOS Tahoe](https://derflounder.wordpress.com/2026/08/10/validating-filevault-recovery-keys-using-a-plist-file-to-provide-recovery-key-information-on-macos-tahoe/) - Private Feed for M09Ic - [ ] [anthropics released v2.1.227 at anthropics/claude-code](https://github.com/anthropics/claude-code/releases/tag/v2.1.227) - [ ] [bolucat released 202608102104 at bolucat/Archive](https://github.com/bolucat/Archive/releases/tag/202608102104) - [ ] [usestrix released v1.5.3 at usestrix/strix](https://github.com/usestrix/strix/releases/tag/v1.5.3) - [ ] [joaoviictorti starred Wenzel/libmicrovmi](https://github.com/Wenzel/libmicrovmi) - [ ] [wh0amitz starred cckuailong/JNDI-Injection-Exploit-Plus](https://github.com/cckuailong/JNDI-Injection-Exploit-Plus) - [ ] [Rvn0xsy starred firecrawl/anydoc](https://github.com/firecrawl/anydoc) - [ ] [chainreactors released v0.0.0-nightly.20260810 at chainreactors/aiscan](https://github.com/chainreactors/aiscan/releases/tag/v0.0.0-nightly.20260810) - [ ] [esrrhs contributed to esrrhs/fakelua](https://github.com/esrrhs/fakelua/pull/343) - [ ] [Rvn0xsy starred usestrix/strix](https://github.com/usestrix/strix) - [ ] [huoji120 starred aoe2control/AoE2Control](https://github.com/aoe2control/AoE2Control) - [ ] [CHYbeta starred berabuddies/redis-poc](https://github.com/berabuddies/redis-poc) - [ ] [ZeddYu starred mokshablr/gander](https://github.com/mokshablr/gander) - [ ] [yuligesec starred earendil-works/pi](https://github.com/earendil-works/pi) - [ ] [safedv starred DoctorEww/EvilFontTool](https://github.com/DoctorEww/EvilFontTool) - [ ] [WAY29 starred lightpanda-io/browser](https://github.com/lightpanda-io/browser) - [ ] [CHYbeta starred darkmentorllc/bt-re-mad-skillz](https://github.com/darkmentorllc/bt-re-mad-skillz) - Microsoft Security Blog - [ ] [Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise](https://www.microsoft.com/en-us/security/blog/2026/08/10/microsoft-named-a-leader-in-the-2026-idc-marketscape-for-mdr-mxdr-for-the-enterprise/) - [ ] [DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure](https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/) - Recent Commits to cve:main - [ ] [Update Mon Aug 10 12:02:20 UTC 2026](https://github.com/trickest/cve/commit/457ae328acc35c3df1c1ac3bc3111bc2a2c169c0) - Bug Bounty in InfoSec Write-ups on Medium - [ ] [The Bug That Almost Wasn’t: How a “Dead End” Led to 500+ Leaked Customer Records](https://infosecwriteups.com/the-bug-that-almost-wasnt-how-a-dead-end-led-to-500-leaked-customer-records-18db26e53705?source=rss----7b722bfd1b8d--bug_bounty) - [ ] [Bypassing Enterprise SSO via a Forgotten Source Map: A Bug Bounty Story](https://infosecwriteups.com/bypassing-enterprise-sso-via-a-forgotten-source-map-a-bug-bounty-story-a43ab0973146?source=rss----7b722bfd1b8d--bug_bounty) - [ ] [They Gave Me $1,000 After I Found Their Entire Student Database Exposed!](https://infosecwriteups.com/they-gave-me-1-000-after-i-found-their-entire-student-database-exposed-f127e4bc91f3?source=rss----7b722bfd1b8d--bug_bounty) - [ ] [Why Bug Hunters Skip Role-Based API Testing And How I Turned a Writer Token Into an SSRF](https://infosecwriteups.com/why-bug-hunters-skip-role-based-api-testing-and-how-i-turned-a-writer-token-into-an-ssrf-55397afe9848?source=rss----7b722bfd1b8d--bug_bounty) - Securelist - [ ] [IT threat evolution in Q2 2026. Non-mobile statistics](https://securelist.com/malware-report-q2-2026-pc-iot-statistics/120960/) - [ ] [IT threat evolution in Q2 2026. Mobile statistics](https://securelist.com/malware-report-q2-2026-mobile-statistics/120948/) - Hacking Dream - [ ] [MCP Penetration Testing Cheatsheet - All Possible Attack Patterns](https://www.hackingdream.net/2026/08/mcp-penetration-testing-cheatsheet-all.html) - Malwarebytes - [ ] [How to fake a data trail (and maybe lower prices) (Lock and Code S07E16)](https://www.malwarebytes.com/blog/podcast/2026/08/how-to-fake-a-data-trail-and-maybe-lower-prices-lock-and-code-s07e16) - [ ] [New turnkey kit makes it easy for anyone to become a scammer](https://www.malwarebytes.com/blog/scams/2026/08/new-turnkey-kit-makes-it-easy-for-anyone-to-become-a-scammer) - [ ] [Edge is dropping older extensions, affecting popular privacy tools](https://www.malwarebytes.com/blog/news/2026/08/edge-is-dropping-older-extensions-affecting-popular-privacy-tools) - [ ] [A week in security (August 3 – August 9)](https://www.malwarebytes.com/blog/news/2026/08/a-week-in-security-august-3-august-9) - Payatu - [ ] [What Drives the Price and Duration of a VAPT in India?](https://payatu.com/blog/what-drives-the-price-and-duration-of-a-vapt-in-india/) - VMRay - [ ] [Every agent needs an oracle: How to trust AI-drafted detection rules](https://www.vmray.com/every-agent-needs-an-oracle-how-to-trust-ai-drafted-detection-rules/) - Mozilla Security Blog - [ ] [Updated GPG key for signing Firefox and Thunderbird Releases](https://blog.mozilla.org/security/2026/08/10/updated-gpg-key-for-signing-firefox-and-thunderbird-releases/) - Exploit-DB.com RSS Feed - [ ] [[webapps] OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution](https://www.exploit-db.com/exploits/52633) - [ ] [[local] Microsoft Edge 150.0.4078.48 - RCE](https://www.exploit-db.com/exploits/52632) - [ ] [[webapps] CorgetGpsDget 2_3.2 - OS Command Injection](https://www.exploit-db.com/exploits/52631) - [ ] [[webapps] Joomla 2.9.99.4 - Unauthenticated Remote Code Execution](https://www.exploit-db.com/exploits/52630) - Intigriti - [ ] [CrowdRecon is coming: turning hacker reconnaissance into security intelligence](https://www.intigriti.com/blog/news/introducing-crowdrecon) - GuidePoint Security - [ ] [Your AI Security Strategy Has a Layer Nobody Owns](https://www.guidepointsecurity.com/blog/ai-security-strategy-layer-nobody-owns/) - 奇客Solidot–传递最新科技情报 - [ ] [对磁星的测量或证实了真空双折射理论](https://www.solidot.org/story?sid=85055) - [ ] [Meta 推出 300 亿参数的开放权重模型 Muse Glimmer](https://www.solidot.org/story?sid=85054) - [ ] [审稿人人数跟不上大幅增长的新论文数量](https://www.solidot.org/story?sid=85053) - [ ] [为什么出租车和救护车司机很少死于阿尔茨海默](https://www.solidot.org/story?sid=85052) - [ ] [中国人形机器人出货量占全球的逾 97%](https://www.solidot.org/story?sid=85051) - [ ] [苹果测试长鑫内存](https://www.solidot.org/story?sid=85050) - [ ] [中国企业与大学研发经费超过美国](https://www.solidot.org/story?sid=85049) - [ ] [果糖会帮助癌细胞扩散](https://www.solidot.org/story?sid=85048) - [ ] [五分之一美国人在财务建议上咨询 AI，七成美国人不信任 AI](https://www.solidot.org/story?sid=85047) - [ ] [微软回应悄悄在 Windows 11 上安装新照片应用 OneDrive Photos](https://www.solidot.org/story?sid=85046) - 黑海洋Wiki | AI机器人硬件开发 | 网络安全攻防实战 | 区块链技术文档教程 - 免费资源平台 - [ ] [扎克伯格发表6,500字长文阐述新AI愿景](https://blog.upx8.com/%E6%89%8E%E5%85%8B%E4%BC%AF%E6%A0%BC%E5%8F%91%E8%A1%A86-500%E5%AD%97%E9%95%BF%E6%96%87%E9%98%90%E8%BF%B0%E6%96%B0AI%E6%84%BF%E6%99%AF) - [ ] [台湾因军事演习下调网速 但民众反应淡定](https://blog.upx8.com/%E5%8F%B0%E6%B9%BE%E5%9B%A0%E5%86%9B%E4%BA%8B%E6%BC%94%E4%B9%A0%E4%B8%8B%E8%B0%83%E7%BD%91%E9%80%9F-%E4%BD%86%E6%B0%91%E4%BC%97%E5%8F%8D%E5%BA%94%E6%B7%A1%E5%AE%9A) - [ ] [Steam硬件发货方数据泄露暴露客户数据](https://blog.upx8.com/Steam%E7%A1%AC%E4%BB%B6%E5%8F%91%E8%B4%A7%E6%96%B9%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E6%9A%B4%E9%9C%B2%E5%AE%A2%E6%88%B7%E6%95%B0%E6%8D%AE) - [ ] [苹果探索Apple Watch圆形表盘或无屏设备](https://blog.upx8.com/%E8%8B%B9%E6%9E%9C%E6%8E%A2%E7%B4%A2Apple-Watch%E5%9C%86%E5%BD%A2%E8%A1%A8%E7%9B%98%E6%88%96%E6%97%A0%E5%B1%8F%E8%AE%BE%E5%A4%87) - 黑鸟 - [ ] [朝鲜黑客组织全面接入AI：从钓鱼文档到自建本地大模型](https://mp.weixin.qq.com/s?__biz=MzAxOTM1MDQ1NA==&mid=2451188038&idx=1&sn=7c77f2260a954df74affb1196963eec9) - 安全分析与研究 - [ ] [第7篇-勒索软件检测与威胁狩猎](https://mp.weixin.qq.com/s?__biz=MzA4ODEyODA3MQ==&mid=2247496999&idx=1&sn=df826add1e8efdd7b537d8244c40c95e) - 代码卫士 - [ ] [XSS2Shell：WordPress Core 漏洞利用预认证登录XSS实现 PHP RCE](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247526848&idx=1&sn=b29b6dc57efb2687f969776b26ce49fe) - 威努特安全网络 - [ ] [WinClaw灵犀文脉重磅发布：零操作，即刻拥有自己的本地知识库](https://mp.weixin.qq.com/s?__biz=MzAwNTgyODU3NQ==&mid=2651143444&idx=1&sn=83dfa6f3b6660d4cd3f7232318e23b7d) - 看雪学苑 - [ ] [Kali 下 Android Studio 无法输入中文的问题排查与解决](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458618459&idx=1&sn=b445b8909b73c5c33e80ec7bbf7d351f) - [ ] [Claude Code被利用，Mac设备生成反向隧道实现持久驻留](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458618459&idx=2&sn=1a15df2f9713527cd2be82b3455bf7f8) - [ ] [2026 KCTF 赛况 | 破晓开战：『逆向初学团队』4分24秒拿下签到题“一血”](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458618459&idx=3&sn=173cb50d784326c34a95364701fdc138) - 信息安全国家工程研究中心 - [ ] [《生成式人工智能系统密码应用指引》正式发布](https://mp.weixin.qq.com/s?__biz=MzU5OTQ0NzY3Ng==&mid=2247504634&idx=1&sn=bfc38267b8257f2188df36d0b730a2c2) - 安全客 - [ ] [你的代码里，藏着黑客埋的"毒"：1300个 npm 包遭供应链投毒](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649790347&idx=1&sn=5960492d4880ee788feed0583b6c90eb) - 奇安信 CERT - [ ] [【已复现】JetBrains TeamCity 远程代码执行漏洞(CVE-2026-63077)安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247507002&idx=1&sn=97e9f830d318a051a7e4e4acda250c68) - 中国信息安全 - [ ] [专题·量子安全 | 量子计算威胁下的密码安全治理：国际态势与中国路径](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664265522&idx=1&sn=6e5ff5af78763cd65d16460752e1df4d) - [ ] [专家解读｜申卫星：为小型个人信息处理者合理松绑减负 推进个人信息处理活动包容审慎监管](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664265522&idx=2&sn=440330619986d22a6f0cfaf2db803ed2) - [ ] [关注 | 公安机关持续严厉打击编造传播涉汛等涉灾网络谣言，公布15起典型案例](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664265522&idx=3&sn=66f20edbd1acce9974e36162d791c5c8) - [ ] [前沿 | 全球人工智能治理体系的时代之问及未来之路](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664265522&idx=4&sn=9ad732f6e7257cd6daa7203208ca86b0) - [ ] [发布 | 7月全国网络举报1778.5万件](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664265522&idx=5&sn=20271b159c061f70f43b86bc62bcec87) - 电子物证 - [ ] [汽车取证：从车机、EDR到电子证据的实务指南](https://mp.weixin.qq.com/s?__biz=MzAwNDcwMDgzMA==&mid=2651049104&idx=1&sn=8c051e2c00ede77e3053c7a20530785a) - [ ] [【bitlocker是什么？】](https://mp.weixin.qq.com/s?__biz=MzAwNDcwMDgzMA==&mid=2651049104&idx=2&sn=7c2a333e3fe8291cbcb1b0411215fd67) - DataCon大数据安全分析竞赛 - [ ] [逐梦盛夏，以实战驭AI｜南开大学2026 DataCon AI安全夏令营正式起航](https://mp.weixin.qq.com/s?__biz=MzU5Njg1NzMyNw==&mid=2247489640&idx=1&sn=8626b072805191613f2f511bfa71d6bf) - 安全内参 - [ ] [网络攻击迫使多个港口运营中断，美军启动调查](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247516383&idx=1&sn=f038b812bd89dff04d40550780bd002b) - [ ] [从“护网”转向“护器”：日本防卫省拟2027年将网络防御直接嵌入武器装备](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247516383&idx=2&sn=056d0d6bbeeded8175d0a5d01e785877) - 腾讯安全威胁情报中心 - [ ] [腾讯云安全威胁情报新增 AI 中转站资产情报覆盖](https://mp.weixin.qq.com/s?__biz=MzI5ODk3OTM1Ng==&mid=2247512053&idx=1&sn=087baf856ae19173f403b0fe1f12971b) - 安全牛 - [ ] [AI攻击AI：OpenAI内部红队GPT-Red工作原理拆解——四步攻击循环，人工红队已被超越](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651142269&idx=1&sn=c873ab03b63644eeb5ebd1ba1b94dfa8) - [ ] [公安部发布新版网安监督检查办法，23 条新规 10 月 1 日落地；头部 AI 模型频繁逃出沙盒引发跨企业攻击，行业安全风险凸显| 牛览](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651142269&idx=2&sn=15dd825486ca90f74af3c58d4fe888e8) - 极客公园 - [ ] [对话影溯章国锋：互联网数据才是空间智能最需要的「太阳能」](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2653111787&idx=1&sn=098fcd191e0f13de2671f2c866d0385c) - [ ] [Seedance 2.5 上线后，LibTV 先帮创作者「学会」了新模型](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2653111786&idx=1&sn=caa1627311bd02df582cc15c662d807a) - [ ] [宇树科技今日申购，中一签或赚 20 万元；钟睒睒：电商平台把零售商杀光了；原字节跳动机器人一号位加入小米｜极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2653111760&idx=1&sn=0a8d52d576a81d8725621ba6b35c5e34) - M01N Team - [ ] [AI安全案例分析 | AISI披露AI Agent在安全测试中自主攻击真实人员与系统](https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247495395&idx=1&sn=d6f7f1584e6d7bc3205c95bfd70b863b) - 数世咨询 - [ ] [AI生成的补丁有一半是失败的](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247543655&idx=1&sn=928fb839977f5577c4a35c71409b97a0) - [ ] [“漏洞清零” 从数量合规到结果合规](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247543655&idx=2&sn=29b9e8f3b3d428dd37fe8276ec51cf41) - 天黑说嘿话 - [ ] [自从进了这个京东捡漏群，拿了很多低价商品！](https://mp.weixin.qq.com/s?__biz=MzI5NTQ5MTAzMA==&mid=2247486349&idx=1&sn=06c6dec3bc3f70bf80b55b67aa879e8b) - 君哥的体历 - [ ] [从“测漏洞”走向“管业务”：企业安全建设、资产测绘与零信任接入｜总第317周](https://mp.weixin.qq.com/s?__biz=MzI2MjQ1NTA4MA==&mid=2247492511&idx=1&sn=1bdecc94bbd6bb2a0781509e819180f6) - 凌晨一点零三分 - [ ] [跟党走_政策板块日报2026-08-10](https://mp.weixin.qq.com/s?__biz=MzIxMjI0Mzk0OQ==&mid=2247485687&idx=1&sn=46aa2abae602ff4c8ac5a0f04abffb76) - 安全圈 - [ ] [【安全圈】OpenAI紧急暂停！新AI模型竟会自学"黑客技术"](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652078224&idx=1&sn=cc5cca1ffdaf71baba9728066f84d777) - [ ] [【安全圈】200万人身份告急！比利时电子身份证曝致命漏洞](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652078224&idx=2&sn=cdb595c396ed85c7d7cbec78a2e74951) - [ ] [【安全圈】开发者小心！VS Code扩展暗中窃取加密钱包](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652078224&idx=3&sn=27ac74789ce072180bb82f5b25e79d15) - 奇安信威胁情报中心 - [ ] [48小时投毒700+包：WEL1DROPPER用"AI幻觉包名"给npm开发者送上一份跨平台RAT](https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247519773&idx=1&sn=6d2005d14c8d8e08c57fe63922ecda52) - OPPO安全中心 - [ ] [【OSRC助力】全网诚邀AI高手应战！"Agent+"攻防挑战赛正式开启！](https://mp.weixin.qq.com/s?__biz=MzUyNzc4Mzk3MQ==&mid=2247495013&idx=1&sn=e6637929e5fe8fdfc922cca56ed05f85) - 安全行者老霍 - [ ] [OpenAI 和 Anthropic AI Agents 逃离测试环境并入侵现实世界](https://mp.weixin.qq.com/s?__biz=Mzg3NjU4MDI4NQ==&mid=2247486886&idx=1&sn=26f46931e127255b8427cbbb6d11f083) - 360数字安全 - [ ] [“中国版Mythos”图龙锋开放试用首月：近500家企业申请接入，累计发现近9000漏洞](https://mp.weixin.qq.com/s?__biz=MzA4MTg0MDQ4Nw==&mid=2247586720&idx=1&sn=457cc957fec98fdf1b310cd955da0783) - 情报分析师 - [ ] [CIA不藏了，我盯了它一整年的X账号，发现每条帖子都不简单](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650569009&idx=1&sn=6d3769d6cf503e1058a159a91913e465) - [ ] [【深度研判】美国参议院确认杰伊·克莱顿为新任美国情报总监，特朗普政府情报政策转向对我风险评估](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650569009&idx=2&sn=7fa3eb988fdbaebc29595a893f8b7f5b) - Over Security - [ ] [Hackers breached a small Polish energy plant via private APN last year](https://www.bleepingcomputer.com/news/security/hackers-breached-a-small-polish-energy-plant-via-private-apn-last-year/) - [ ] [BdThemes plugins supply-chain hack creates rogue WordPress admins](https://www.bleepingcomputer.com/news/security/bdthemes-plugins-supply-chain-hack-creates-rogue-wordpress-admins/) - [ ] [FBI, South Korea warn of Gunra ransomware gang targeting critical infrastructure](https://therecord.media/ransomware-south-korea-fbi-gunra) - [ ] [OpenAI releases ChatGPT 5.6 Cyber, but it's only for approved users](https://www.bleepingcomputer.com/news/security/openai-releases-chatgpt-56-cyber-but-its-only-for-approved-users/) - [ ] [Data Center Physical Security: Mitigating FPV Drone Threats](https://flashpoint.io/blog/data-center-physical-security-mitigating-fpv-drone-threats/) - [ ] [New StormEncryptor ransomware used by former Medusa affiliate](https://www.bleepingcomputer.com/news/security/new-stormencryptor-ransomware-used-by-former-medusa-affiliate/) - [ ] [Senate Democrats introduce bill to distribute $300 million annually to shore up water system cybersecurity](https://therecord.media/senate-water-cybersecurity-legislation) - [ ] [Poland uncovers second heat plant cyberattack that went hidden for months](https://therecord.media/poland-uncovers-critical-infrastructure-attack-hidden) - [ ] [Russian military hackers pose as recruiters to target Ukrainian IT workers](https://therecord.media/russian-military-hackers-pose-as-recruiters-ukraine-it-workers) - [ ] [AI, ora controlli preventivi sui modelli: il blocco di Astra, le regole di Trump](https://www.cybersecurity360.it/cybersecurity-nazionale/ai-ora-controlli-preventivi-sui-modelli-il-blocco-di-astra-le-regole-di-trump/) - [ ] [CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs](https://www.bleepingcomputer.com/news/security/cisa-sonicwall-sma1000-flaws-now-exploited-by-ransomware-gangs/) - [ ] [When Credentials Are No Longer Enough: Device Trust in the AI Era](https://www.bleepingcomputer.com/news/security/when-credentials-are-no-longer-enough-device-trust-in-the-ai-era/) - [ ] [British ‘Com’ member who abused more than 100 girls worldwide jailed for two years](https://therecord.media/british-com-member-abuse-jailed-two-years) - [ ] [China-linked hackers turning popular cybersecurity tool into ransomware launchpad, Microsoft warns](https://therecord.media/china-hackers-ransomware-microsoft) - [ ] [Ransomware Now Shows Up in Nearly Half of All Breaches: A Survival Playbook for Lean Security Teams](https://cyble.com/blog/ransomware-incident-response-plan/) - [ ] [Member of The Com sent to prison for blackmail, sextortion](https://www.bleepingcomputer.com/news/security/member-of-the-com-sent-to-prison-for-blackmail-sextortion/) - [ ] [Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup](https://any.run/cybersecurity-blog/lazarus-group-it-workers-investigation-part-two/) - [ ] [New Zealand sanctions Russian hackers, propaganda groups over Ukraine war](https://therecord.media/new-zealand-russian-hackers-sanctions) - [ ] [LexisNexis shuts down services after suspicious activity on servers](https://www.bleepingcomputer.com/news/security/lexisnexis-shuts-down-services-after-suspicious-activity-on-servers/) - [ ] [Valve notifies Steam hardware customers of a data breach](https://www.bleepingcomputer.com/news/security/valve-notifies-steam-hardware-customers-of-a-data-breach/) - [ ] [InPost, mancano dati per la consegna. Ma è phishing!](https://www.d3lab.net/inpost-mancano-dati-per-la-consegna-ma-e-phishing/) - [ ] [IT threat evolution in Q2 2026. Mobile statistics](https://securelist.com/malware-report-q2-2026-mobile-statistics/120948/) - [ ] [IT threat evolution in Q2 2026. Non-mobile statistics](https://securelist.com/malware-report-q2-2026-pc-iot-statistics/120960/) - [ ] [Critical Progress LoadMaster flaw now actively exploited in attacks](https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-progress-loadmaster-flaw-exploited-in-attacks/) - [ ] [Suisun City Declares Emergency After Cyberattack Disrupts Systems](https://thecyberexpress.com/suisun-city-emergency-cyberattack/) - [ ] [NIS2 e gestione incidenti: dall’impatto operativo al costo del fermo e alle decisioni di business](https://www.cybersecurity360.it/legal/nis2-e-gestione-incidenti-dallimpatto-operativo-al-costo-del-fermo-e-alle-decisioni-di-business/) - [ ] [Cifratura dei dati e reti VPN: le architetture avanzate per la protezione dei flussi](https://www.cybersecurity360.it/cultura-cyber/sicurezza-vpn-proton-vpn-2-99-euro-al-mese/) - [ ] [ATED // Cyber Security Day 2026](https://roccosicilia.com/2026/08/10/ated-cyber-security-day-2026/) - [ ] [Ransomware Kingpin Gets 16 Years for Global Cyberattacks](https://thecyberexpress.com/ransom-cartel-ransomware/) - [ ] [AI Agent Exploits Gym System Vulnerability, Cancels Waitlist Booking in Australia](https://thecyberexpress.com/ai-agent-gym-system-vulnerability/) - [ ] [Gestione delle password aziendali: gli standard per azzerare i rischi di intrusione](https://www.cybersecurity360.it/cultura-cyber/gestione-password-aziendali-nordpass-sconto-50-per-cento/) - [ ] [Hotel nel mirino: perché il settore alberghiero è un cyber-bersaglio facile](https://www.cybersecurity360.it/outlook/hotel-nel-mirino-perche-il-settore-alberghiero-e-un-cyber-bersaglio-facile/) - [ ] [Levi Strauss Hit by Cyberattack, Corporate Files Accessed](https://thecyberexpress.com/levi-strauss-cyberattack/) - Qualys Security Blog - [ ] [Audit Fix: Audit Readiness for the Post-Mythos Era](https://blog.qualys.com/category/product-tech) - 安全419 - [ ] [安全419 | 7月安全厂商动态：AI渗透测试等AI安全产品密集发布](https://mp.weixin.qq.com/s?__biz=MzUyMDQ4OTkyMg==&mid=2247554411&idx=1&sn=fe2fd15b0ba9c2acaaee30d3ed065727) - 字节跳动技术团队 - [ ] [火山引擎 SenseFlow 重磅发布：突破存储边界，洞见数据价值](https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247521212&idx=1&sn=819993bfc75955779785e4aaad7dcd89) - DEF CON Announcements! - [ ] [Thanks for Another Great DEF CON!](https://defcon.org/html/defcon-34/dc-34-news.html#dc34wrap) - CNVD漏洞平台 - [ ] [CNVD漏洞周报2026年第31期](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247497175&idx=1&sn=240955573c2f01ac589a40ab5594978a) - [ ] [上周关注度较高的产品安全漏洞(20260803-20260809)](https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247497175&idx=2&sn=20743fdb244c980dc4318b626b4c8440) - ChaMd5安全团队 - [ ] [第二届CCF智能汽车大赛 Writeup by Mini-Venom](https://mp.weixin.qq.com/s?__biz=MzIzMTc1MjExOQ==&mid=2247514357&idx=1&sn=1011e14745c14a80af2d4b9b4421b4d9) - ICT Security Magazine - [ ] [Firma elettronica qualificata esposta: le falle dell’eID belga e il perimetro che eIDAS non copre](https://www.ictsecuritymagazine.com/digital-id-security/firma-elettronica-qualificata-esposta-le-falle-delleid-belga-e-il-perimetro-che-eidas-non-copre/) - Arturo Di Corinto - [ ] [Presentazione di Guerra Profonda a Castronno (Varese)](https://dicorinto.it/temi/cybersecurity-temi/presentazione-di-guerra-profonda-a-castronno-varese/) - D3Lab - [ ] [InPost, mancano dati per la consegna. Ma è phishing!](https://www.d3lab.net/inpost-mancano-dati-per-la-consegna-ma-e-phishing/) - Schneier on Security - [ ] [Python Now Has a Post-Quantum Encryption Library](https://www.schneier.com/blog/archives/2026/08/python-now-has-a-post-quantum-encryption-library.html) - The Hacker News - [ ] [Shipping 10–50× More Code? Watch This Webinar on Securing AI-Speed Development](https://thehackernews.com/2026/08/shipping-1050-more-code-watch-this.html) - [ ] [China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw](https://thehackernews.com/2026/08/china-linked-hackers-deploy-new.html) - [ ] [⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors](https://thehackernews.com/2026/08/weekly-recap-ai-goes-rogue-metabase-0.html) - [ ] [Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development](https://thehackernews.com/2026/08/kimsuky-builds-offline-ai-stack-that.html) - [ ] [New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA](https://thehackernews.com/2026/08/new-passkey-attacks-can-recover-synced.html) - [ ] [TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore](https://thehackernews.com/2026/08/head-mare-exploits-trueconf-flaws-to.html) - [ ] [Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials](https://thehackernews.com/2026/08/solidity-pro-vs-code-extensions-steal.html) - [ ] [OpenAI's Next AI Model Astra Shows Cyber Performance Strong Enough to Trigger Pause](https://thehackernews.com/2026/08/openais-next-ai-model-astra-shows-cyber.html) - Security Affairs - [ ] [Gym Booking Task Turns Into Real-World AI Cyberattack](https://securityaffairs.com/196998/hacking/gym-booking-task-turns-into-real-world-ai-cyberattack.html) - [ ] [Hackers Cross From IT to OT Through a Private APN in Poland](https://securityaffairs.com/196955/security/hackers-cross-from-it-to-ot-through-a-private-apn-in-poland.html) - [ ] [9.2 Million Israeli Records Sold as a New Breach Are 20 Years Old](https://securityaffairs.com/196942/cyber-crime/9-2-million-israeli-records-sold-as-a-new-breach-are-20-years-old.html) - [ ] [OpenAI Pauses Astra Model Over Critical Cybersecurity Risk Concerns](https://securityaffairs.com/196931/ai/openai-pauses-astra-model-over-critical-cybersecurity-risk-concerns.html) - [ ] [A GitHub Misconfiguration Let Kimi K3 Cheat a Cybersecurity Benchmark](https://securityaffairs.com/196923/ai/a-github-misconfiguration-let-kimi-k3-cheat-a-cybersecurity-benchmark.html) - www.theregister.com - Articles - [ ] [DEF CON hackers add new muscle to water utility protection](https://www.theregister.com/security/2026/08/10/def-con-hackers-add-new-muscle-to-water-utility-protection/5285715) - [ ] [North Korean spies are running local LLMs to cause AI mischief](https://www.theregister.com/security/2026/08/10/north-korean-spies-are-running-local-llms-to-cause-ai-mischief/5285632) - [ ] [Gym rat asks AI agent to book him a class, it hacks a waitlist API to bump him up the list](https://www.theregister.com/ai-and-ml/2026/08/10/gym-rat-asks-ai-agent-to-book-him-a-class-it-hacks-a-waitlist-api-to-bump-him-up-the-list/5285591) - [ ] [Attackers pick Levi's pockets in social engineering attack](https://www.theregister.com/security/2026/08/10/attackers-pick-levis-pockets-in-social-engineering-attack/5285401) - [ ] [Wetherspoons bars smart glasses from filming customers](https://www.theregister.com/personal-tech/2026/08/10/wetherspoons-bars-smart-glasses-from-filming-customers/5285357) - [ ] [Cyber vulnerability sweep picks up Royal Navy drones sending data to China](https://www.theregister.com/edge-and-iot/2026/08/10/cyber-vulnerability-sweep-picks-up-royal-navy-drones-sending-data-to-china/5285430) - [ ] [Framework loses customer data in Metabase zero-day attack](https://www.theregister.com/personal-tech/2026/08/10/framework-loses-customer-data-in-metabase-zero-day-attack/5285302) - [ ] [Claude Code puts auto mode in the driver's seat](https://www.theregister.com/ai-and-ml/2026/08/10/claude-code-puts-auto-mode-in-the-drivers-seat/5285326) - [ ] [Advertisers are trying to influence AI bots with secret ads](https://www.theregister.com/ai-and-ml/2026/08/10/advertisers-are-trying-to-influence-ai-bots-with-secret-ads/5285093) - Deeplinks - [ ] [Meta Must Stop Silencing Reproductive Health Information](https://www.eff.org/deeplinks/2026/08/meta-must-stop-silencing-reproductive-health-information) - Instapaper: Unread - [ ] [A researcher bought noreply.net. Companies started sending him secrets.](https://www.wired.com/story/sensitive-info-goes-into-no-reply-emails-constantly-this-guy-sees-it-all/) - [ ] [Hotel nel mirino perché il settore alberghiero è un cyber-bersaglio facile](https://www.cybersecurity360.it/outlook/hotel-nel-mirino-perche-il-settore-alberghiero-e-un-cyber-bersaglio-facile/) - [ ] [Podcast RSI – Innocente, ma condannato da un trattino di troppo la storia di Brandon Klayme](https://attivissimo.me/podcast-rsi-innocente-ma-condannato-da-un-trattino-di-troppo-la-storia-di-brandon-klayme/) - SANS Internet Storm Center, InfoCON: green - [ ] [Scans for Solana (Surfpool?) Endpoints, (Mon, Aug 10th)](https://isc.sans.edu/diary/rss/33230) - [ ] [ISC Stormcast For Monday, August 10th, 2026 https://isc.sans.edu/podcastdetail/10044, (Mon, Aug 10th)](https://isc.sans.edu/diary/rss/33228) - TorrentFreak - [ ] [EU Study: Block Live Sports Piracy in 30 Minutes, Across DNS Resolvers, VPNs and CDNs](https://torrentfreak.com/eu-study-block-live-sports-piracy-in-30-minutes-across-dns-resolvers-vpns-and-cdns/) - Security Weekly Podcast Network (Audio) - [ ] [Three interviews: system fragility, operational clarity, and Identity for AI agents - Todd Thiemann, Robin Macfarlane, Kyle Sandy - ESW #471](http://sites.libsyn.com/18678/three-interviews-system-fragility-operational-clarity-and-identity-for-ai-agents-todd-thiemann-robin-macfarlane-kyle-sandy-esw-471)
每日安全资讯（2026-08-11）