[每日信息流] 2025-10-10

# 每日安全资讯（2025-10-10）

- SecWiki News
  - [ ] [SecWiki News 2025-10-09 Review](http://www.sec-wiki.com/?2025-10-09)
- 奇安信攻防社区
  - [ ] [某bip漏洞挖掘-从0day到1day的伤心之旅](https://forum.butian.net/share/4588)
- 安全客-有思想的安全新媒体
  - [ ] [空网络安全防护核心：管理平台安全体系构建与实践](https://www.anquanke.com/post/id/312227)
- Doonsec's feed
  - [ ] [RediShell漏洞检查软件（v1.0）](https://mp.weixin.qq.com/s?__biz=MzI3NjM2ODA2Mg==&mid=2247486276&idx=1&sn=aeeefc2136259106e6485722bf42d966)
  - [ ] [【高危漏洞预警】Redis Lua脚本远程代码执行漏洞CVE-2025-49844](https://mp.weixin.qq.com/s?__biz=MzI3NzMzNzE5Ng==&mid=2247490821&idx=1&sn=c0207f07beaca7ca916254aa0f7497b7)
  - [ ] [【高危漏洞预警】Oracle E-Business Suite 远程代码执行漏洞CVE-2025-61882](https://mp.weixin.qq.com/s?__biz=MzI3NzMzNzE5Ng==&mid=2247490821&idx=2&sn=59cfe49d6f8e09788dfb072309dfaf23)
  - [ ] [用友NC DocServlet接口存在任意文件读取漏洞 附POC](https://mp.weixin.qq.com/s?__biz=MzIxMjEzMDkyMA==&mid=2247489298&idx=1&sn=adddb0962bddd80474ff07325e9d5ab2)
  - [ ] [攻防实战思路-不靠0day组合拳拿下目标系统](https://mp.weixin.qq.com/s?__biz=Mzg2ODYxMzY3OQ==&mid=2247520000&idx=1&sn=54392e4ba5d06dd352762d11c5260887)
  - [ ] [活该你能挖到洞](https://mp.weixin.qq.com/s?__biz=Mzg2ODYxMzY3OQ==&mid=2247520000&idx=2&sn=29a22401a48b2b5165168926b393321b)
  - [ ] [【0day】某通用系统RCE漏洞挖掘](https://mp.weixin.qq.com/s?__biz=Mzk5MDYxODcwMA==&mid=2247484184&idx=1&sn=96009f6687cfd5e7c7157326110f48b3)
  - [ ] [【好文推荐】炫酷的工具，简单的校验：人工智能狂热如何为恶意MCP服务器打开大门](https://mp.weixin.qq.com/s?__biz=MzI2Mjk4NjgxMg==&mid=2247483769&idx=1&sn=b0a6f33ac35a6678e3aaff99f6d25fcf)
  - [ ] [基于人形机器人开展安全攻击](https://mp.weixin.qq.com/s?__biz=MzI5NTQ3NzIxMw==&mid=2247485701&idx=1&sn=fb99e0fc8968dc532b0b4b31cbf4acef)
  - [ ] [开发“恶意URL-AI检测系统”(二)](https://mp.weixin.qq.com/s?__biz=MjM5NDcxMDQzNA==&mid=2247489972&idx=1&sn=32504572a9b2db2edf5f58edceff0883)
  - [ ] [拿下一个新高地](https://mp.weixin.qq.com/s?__biz=MzkzMjIwMDY4Nw==&mid=2247486208&idx=1&sn=7d4bdfaff87ac6cd09606ba1b0e3f0ba)
  - [ ] [2025 Distinguished Paper Award(NDSS)-ReDAN](https://mp.weixin.qq.com/s?__biz=MzAwNTUzNjE3OQ==&mid=2649560045&idx=1&sn=e3230efc0a20f9503a9f26edda794e53)
  - [ ] [从智能测试到自主测试：理论与实践](https://mp.weixin.qq.com/s?__biz=Mzk0MzY1NDc2MA==&mid=2247484486&idx=1&sn=d065a26fd96c2e972804a39120bd0c5c)
  - [ ] [某CMS后台SQL注入漏洞](https://mp.weixin.qq.com/s?__biz=Mzg4MzU3MTcwNg==&mid=2247486196&idx=1&sn=de18a3e2d422d54ebb0227856dc17de6)
  - [ ] [2025年度网络空间安全技术国家地方联合工程实验室开放课题指南征集](https://mp.weixin.qq.com/s?__biz=MzU5MTM5MTQ2MA==&mid=2247493889&idx=1&sn=fd8b6a478431c7937f7ba039b60d2676)
  - [ ] [某CMS任意文件删除漏洞](https://mp.weixin.qq.com/s?__biz=Mzg4MzU3MTcwNg==&mid=2247486194&idx=1&sn=78f2dafd7bc04828e7e1f7c3c56cca41)
  - [ ] [新的 FileFix 攻击利用缓存走私来逃避安全软件](https://mp.weixin.qq.com/s?__biz=MzAxMjYyMzkwOA==&mid=2247533002&idx=1&sn=08f6153441c59395662dc3bdd0b0fa04)
  - [ ] [广告](https://mp.weixin.qq.com/s?__biz=MzkxNDYxMjM5OA==&mid=2247485867&idx=1&sn=c2aa7262db1acbdcb38b2898e1031217)
  - [ ] [G.O.S.S.I.P 阅读推荐 2025-10-09 WireTap窃听风暴](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247500784&idx=1&sn=5d901012fc220b6f854bca3e8fcadc6b)
  - [ ] [安天澜砥大模型登顶CyberSec-Eval评测榜](https://mp.weixin.qq.com/s?__biz=MjM5MTA3Nzk4MQ==&mid=2650212648&idx=1&sn=1a955959a190e9029f2ed27045ffe782)
  - [ ] [直播预告｜大模型与智能体时代，如何筑牢安全底座？10月15日腾讯安全视频号开讲！](https://mp.weixin.qq.com/s?__biz=Mzg5OTE4NTczMQ==&mid=2247528106&idx=1&sn=f43a90fb875960f9adbd6c4cbd4074ff)
  - [ ] [【漏洞分析】用友U8Cloud < 20250924补丁版本 NCCloudGatewayServlet 命令执行漏洞](https://mp.weixin.qq.com/s?__biz=MzkxOTYyMDk5Ng==&mid=2247483728&idx=1&sn=74622bae34cbcd125fa33eafd5e01bff)
  - [ ] [刚上大一打的CTF新生练习平台 week1 记录一天ak（](https://mp.weixin.qq.com/s?__biz=MzE5MTEzNzcwNg==&mid=2247483913&idx=1&sn=d27cfd01d5cdd3d25144438c3687d051)
  - [ ] [OSCP渗透实战（第二期）：Linux系统攻防与权限提升完全指南](https://mp.weixin.qq.com/s?__biz=Mzk1NzI5MTc0Nw==&mid=2247485451&idx=1&sn=6532c20ad4006c80da177fd5e78fadb8)
  - [ ] [0065. 从泄露的电子邮件到内部账户接管（P1）](https://mp.weixin.qq.com/s?__biz=MzA4NDQ5NTU0MA==&mid=2647691083&idx=1&sn=9390e53c6d3ec8df7c7f56e13a56efe3)
  - [ ] [七年七冠！奇安信稳坐中国云安全市场头把交椅](https://mp.weixin.qq.com/s?__biz=MzU0NDk0NTAwMw==&mid=2247629313&idx=1&sn=62177dea94eeef8727abb0405a87cdee)
  - [ ] [《生成式人工智能服务安全应急响应指南》发布 奇安信深度参编](https://mp.weixin.qq.com/s?__biz=MzU0NDk0NTAwMw==&mid=2247629313&idx=2&sn=1962e10bc4d3db1000c0f17edd5295b3)
  - [ ] [全栈爬虫系列-web爬虫开发与逆向实战视频教程更新到了104节啦](https://mp.weixin.qq.com/s?__biz=MzkwOTE5MDY5NA==&mid=2247507769&idx=1&sn=1e816edc5436c0015e2625bc56434d2c)
  - [ ] [用友U8Cloud < 20250924补丁版本 NCCloudGatewayServlet 命令执行漏洞](https://mp.weixin.qq.com/s?__biz=MzkxOTYyMDk5Ng==&mid=2247483701&idx=1&sn=5d4aef0747f6272ee4ba7e58725e85f1)
  - [ ] [xss中常见绕过思路](https://mp.weixin.qq.com/s?__biz=MzIzMTIzNTM0MA==&mid=2247498377&idx=1&sn=fac1c705d73f6bd024194cfdc2504f10)
  - [ ] [2025年“美亚杯”赛前培训，助您高效备赛！](https://mp.weixin.qq.com/s?__biz=MjM5NTU4NjgzMg==&mid=2651445894&idx=1&sn=2b7a9cd6530d6da797db566fde5ae3c9)
  - [ ] [Electron客户端漏洞学习与研究](https://mp.weixin.qq.com/s?__biz=MzkxMDU5MzY0NQ==&mid=2247485561&idx=1&sn=fea5a9d6f7fc7fb38e1af637ed6789ed)
  - [ ] [文件内容竟能直接搜？网友：告别“新建文档”噩梦！u200b别再Everything了！这个隐藏的搜索怪兽，10秒让你忘记原名](https://mp.weixin.qq.com/s?__biz=MzkyMzY0MTk2OA==&mid=2247486977&idx=1&sn=5d859f5b3fcb9bff17ff67721867a0b3)
  - [ ] [Linux Netcat (nc) 完全指南：网络工具中的\"瑞士军刀\"](https://mp.weixin.qq.com/s?__biz=MzI5MjY4MTMyMQ==&mid=2247492535&idx=1&sn=40b46cab89cb83cb0ecf1475c74c5e6f)
  - [ ] [可验证过程奖励在提升大模型推理效率中的探索与实践](https://mp.weixin.qq.com/s?__biz=MjM5NjQ5MTI5OA==&mid=2651781474&idx=1&sn=7282bee4c7608dc05de01477925ab8f6)
  - [ ] [MARS TALK 第06期｜走进香港理工大学，共话高动态环境下的智能机器人发展与应用](https://mp.weixin.qq.com/s?__biz=MjM5NjQ5MTI5OA==&mid=2651781474&idx=2&sn=b052043a9f15afbcb67559e2c9120ba4)
- Private Feed for M09Ic
  - [ ] [PrefectHQ released 3.4.23 at PrefectHQ/prefect](https://github.com/PrefectHQ/prefect/releases/tag/3.4.23)
  - [ ] [bolucat released 202510092033 at bolucat/Archive](https://github.com/bolucat/Archive/releases/tag/202510092033)
  - [ ] [joaoviictorti starred OpenDevicePartnership/patina](https://github.com/OpenDevicePartnership/patina)
  - [ ] [mgeeky starred exo-explore/exo](https://github.com/exo-explore/exo)
  - [ ] [pydantic released v1.0.17 at pydantic/pydantic-ai](https://github.com/pydantic/pydantic-ai/releases/tag/v1.0.17)
  - [ ] [xnl-h4ck3r released v6.2 at xnl-h4ck3r/waymore](https://github.com/xnl-h4ck3r/waymore/releases/tag/v6.2)
  - [ ] [FunnyWolf starred safety-research/petri](https://github.com/safety-research/petri)
  - [ ] [PrefectHQ released 3.4.23.dev3 at PrefectHQ/prefect](https://github.com/PrefectHQ/prefect/releases/tag/3.4.23.dev3)
  - [ ] [rabbitmask forked rabbitmask/Windows_Injector from ZacharyZcR/Windows_Injector](https://github.com/rabbitmask/Windows_Injector)
  - [ ] [rabbitmask starred ZacharyZcR/Windows_Injector](https://github.com/ZacharyZcR/Windows_Injector)
  - [ ] [FunnyWolf forked FunnyWolf/pure-drf-admin from immrk/pure-drf-admin](https://github.com/FunnyWolf/pure-drf-admin)
  - [ ] [rabbitmask starred Adaptix-Framework/AdaptixC2](https://github.com/Adaptix-Framework/AdaptixC2)
  - [ ] [kyxiaxiang starred werdhaihai/msi_lateral_mv](https://github.com/werdhaihai/msi_lateral_mv)
- Recent Commits to cve:main
  - [ ] [Update Thu Oct  9 11:20:31 UTC 2025](https://github.com/trickest/cve/commit/9cae02f1d79ba2229f5e9cf8328d87fd1d1cced7)
- Trustwave Blog
  - [ ] [Tackling the Modern WAF Challenge: Why Managed WAAP Is the Key to Effective Application Security](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/tackling-the-modern-waf-challenge-why-managed-waap-is-the-key-to-effective-application-security/)
- obaby@mars
  - [ ] [七月七日晴](https://h4ck.org.cn/2025/10/21754)
- 嘶吼 RoarTalk – 网络安全行业综合服务平台,4hou.com
  - [ ] [机器人出现“人传人”漏洞？宇树还能打好安全这张牌吗？](https://www.4hou.com/posts/om5z)
  - [ ] [RC²隐私保护联盟 | 东莞 网宇商检 • 高级隐私保护联合认证中心成立](https://www.4hou.com/posts/mk3p)
  - [ ] [黑客借虚假Microsoft Teams安装程序 植入Oyster后门入侵企业网络](https://www.4hou.com/posts/5MDx)
  - [ ] [新型工具EDR-Freeze曝光：借助Windows错误报告系统 从用户模式中实现安全软件规避](https://www.4hou.com/posts/MXrQ)
- CXSECURITY Database RSS Feed - CXSecurity.com
  - [ ] [DirectAdmin v1.680 DOM Injection via return-to Parameter](https://cxsecurity.com/issue/WLB-2025100007)
- Der Flounder
  - [ ] [Slides from the “MDM and DDM 101” session at Jamf Nation User Conference 2025](https://derflounder.wordpress.com/2025/10/09/slides-from-the-mdm-and-ddm-101-session-at-jamf-nation-user-conference-2025/)
- Sucuri Blog
  - [ ] [Introducing Sucuri Academy: Your New Destination for Website Security Education](https://blog.sucuri.net/2025/10/introducing-sucuri-academy-your-new-destination-for-website-security-education.html)
- Cerbero Blog
  - [ ] [Memory Challenge 2: MEM Challenge](https://blog.cerbero.io/memory-challenge-2-mem-challenge/)
- ElcomSoft blog
  - [ ] [Evidence Preservation: Why iPhone Data Can Expire](https://blog.elcomsoft.com/2025/10/evidence-preservation-why-iphone-data-can-expire/)
- Bug Bounty in InfoSec Write-ups on Medium
  - [ ] [Imagery HTB WriteUp: Season 9 Machine 2](https://infosecwriteups.com/imagery-htb-writeup-season-9-machine-2-6e09f640a993?source=rss----7b722bfd1b8d--bug_bounty)
  - [ ] [How I found Multiple Bugs on CHESS.COM & they refused](https://infosecwriteups.com/how-i-found-multiple-bugs-on-chess-com-they-refused-1fa6e308ed1f?source=rss----7b722bfd1b8d--bug_bounty)
- GuidePoint Security
  - [ ] [Cybersecurity Awareness Month: Ransomware’s New Normal](https://www.guidepointsecurity.com/blog/cam-grit-q3-2025-ransomwares-new-normal/)
- VMRay
  - [ ] [From Reactive Defense to Proactive Threat Understanding, from Cloud to on-Prem, from Fiction to Facts](https://www.vmray.com/from-reactive-defense-to-proactive-threat-understanding-from-cloud-to-on-prem-from-fiction-to-facts/)
- Malware-Traffic-Analysis.net - Blog Entries
  - [ ] [2025-10-08: Infection from Kongtuke campaign's ClickFix page](https://www.malware-traffic-analysis.net/2025/10/08/index.html)
- Horizon3.ai
  - [ ] [CVE-2025-20362 · CVE-2025-20333 · CVE-2025-20363](https://horizon3.ai/attack-research/vulnerabilities/cve-2025-20362-cve-2025-20333-cve-2025-20363/)
  - [ ] [CVE-2025-49844](https://horizon3.ai/attack-research/vulnerabilities/cve-2025-49844/)
  - [ ] [What is ITDR and Why Active Directory (AD) Tripwires Make It Real](https://horizon3.ai/intelligence/blogs/what-is-itdr-and-why-active-directory-ad-tripwires-make-it-real/)
- Malwarebytes
  - [ ] [Fake VPN and streaming app drops malware that drains your bank account](https://www.malwarebytes.com/blog/news/2025/10/fake-vpn-and-streaming-app-drops-malware-that-drains-your-bank-account)
  - [ ] [California just put people back in control of their data](https://www.malwarebytes.com/blog/news/2025/10/california-just-put-people-back-in-control-of-their-data)
  - [ ] [One stolen iPhone uncovered a network smuggling thousands of devices to China](https://www.malwarebytes.com/blog/news/2025/10/one-stolen-iphone-uncovered-a-network-smuggling-thousands-of-devices-to-china)
- Sandfly Security Blog RSS Feed
  - [ ] [Linux Stealth Rootkit Hunting Presentation](https://sandflysecurity.com/blog/linux-stealth-rootkit-hunting-presentation)
- PortSwigger Blog
  - [ ] [HTTP/1.1 must die: Dafydd Stuttard on what this means for enterprise security](https://portswigger.net/blog/http-1-1-must-die-dafydd-stuttard-on-what-this-means-for-enterprise-security)
- Wallarm
  - [ ] [API Attack Awareness: Injection Attacks in APIs – Old Threat, New Surface](https://lab.wallarm.com/api-attack-awareness-injection-attacks-apis-old-threat-new-surface/)
- NVISO Labs
  - [ ] [Vulnerability Management – Requirements, Scoping & Target Setting](https://blog.nviso.eu/2025/10/09/vulnerability-management-requirements-scoping-target-setting/)
- rtl-sdr.com
  - [ ] [Two YouTube Reviews of the new PortaRF – A New HackRF Portapack Combo](https://www.rtl-sdr.com/two-youtube-reviews-of-the-new-portarf-a-new-hackrf-portapack-combo/)
- HackerNews
  - [ ] [黑客利用 WordPress 网站发起新一代 ClickFix 钓鱼攻击](https://hackernews.cc/archives/61024)
  - [ ] [Figma MCP 严重漏洞允许黑客远程执行代码](https://hackernews.cc/archives/61022)
  - [ ] [黑客声称 Discord 数据泄露，550 万用户信息遭曝光](https://hackernews.cc/archives/61019)
  - [ ] [CISA 将 Synacor Zimbra 纳入已知被利用漏洞目录](https://hackernews.cc/archives/61016)
  - [ ] [Steam、Riot Games 疑遭大规模 DDoS 攻击](https://hackernews.cc/archives/61013)
  - [ ] [俄罗斯限制外国 SIM 卡接入移动网络](https://hackernews.cc/archives/61011)
- 奇客Solidot–传递最新科技情报
  - [ ] [Ubuntu 25.10 'Questing Quokka' 释出](https://www.solidot.org/story?sid=82503)
  - [ ] [黄金价格首次突破每盎司 4000 美元](https://www.solidot.org/story?sid=82502)
  - [ ] [Fedora 43 将 /boot 分区容量从 1GB 增加到 2GB](https://www.solidot.org/story?sid=82501)
  - [ ] [Starlink 每天有 1-2 颗重返大气层](https://www.solidot.org/story?sid=82500)
  - [ ] [Salesforce 拒绝为被盗的客户数据支付赎金](https://www.solidot.org/story?sid=82499)
  - [ ] [研究认为 BMI 指数不能反映一个人是否健康](https://www.solidot.org/story?sid=82498)
  - [ ] [8 月赴美留学生同比下降 19%](https://www.solidot.org/story?sid=82497)
  - [ ] [OpenAI 今年内签署的 AI 计算交易已高达 1 万亿美元](https://www.solidot.org/story?sid=82496)
- 黑海洋 - Wiki
  - [ ] [Platypus：将命令行脚本一键打包为原生 macOS 应用的开发者神器](https://blog.upx8.com/4870)
  - [ ] [Edit0：对话式 AI 图片编辑器，5 秒出图与无限画布（可商用、永久免费额度）](https://blog.upx8.com/4869)
  - [ ] [TikTok最简单挣美金方式，1万播放挣8刀（带教程）](https://blog.upx8.com/4868)
  - [ ] [LuoGen-agent：一键生成爆款视频的全自动AI数字人口播工具](https://blog.upx8.com/4867)
- 安全分析与研究
  - [ ] [伪装成Google浏览器安装程序银狐最新攻击样本分析](https://mp.weixin.qq.com/s?__biz=MzA4ODEyODA3MQ==&mid=2247493650&idx=1&sn=d78246d0bc8adb5022a309106427dab0)
- 安全内参
  - [ ] [知名车企被黑后停产超37天，逾3万辆汽车生产延误，影响国家经济安全](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247515057&idx=1&sn=9ba1927ab59e698b3cc19637de4ee318)
  - [ ] [美国高校研发无人机飞行中防御黑客攻击技术](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247515057&idx=2&sn=43e1a27eabc7d910530b194ac52986cf)
- 威努特安全网络
  - [ ] [从安全网络到融合计算，威努特全面赋能智慧粮库建设](https://mp.weixin.qq.com/s?__biz=MzAwNTgyODU3NQ==&mid=2651136242&idx=1&sn=e7c54286f097310163c152e4f377164b)
- 腾讯安全应急响应中心
  - [ ] [单洞最高12万！百万奖池等你来拿！｜微信、腾讯云、混元联合TSRC众测开启](https://mp.weixin.qq.com/s?__biz=MjM5NzE1NjA0MQ==&mid=2651207485&idx=1&sn=3fe5feb93300b4b84e9e0b50965cf381)
- 微步在线研究响应中心
  - [ ] [漏洞通告 | Redis Lua 远程代码执行漏洞](https://mp.weixin.qq.com/s?__biz=Mzg5MTc3ODY4Mw==&mid=2247507938&idx=1&sn=304a4919dbe33568519db4c72f191943)
- 绿盟科技CERT
  - [ ] [【漏洞通告】Oracle E-Business Suite远程代码执行漏洞(CVE-2025-61882)](https://mp.weixin.qq.com/s?__biz=Mzk0MjE3ODkxNg==&mid=2247489357&idx=1&sn=98e2a59686ec91e2d8e8296b0e2c2fe9)
  - [ ] [【漏洞通告】Redis Lua代码执行漏洞（CVE-2025-49844）](https://mp.weixin.qq.com/s?__biz=Mzk0MjE3ODkxNg==&mid=2247489357&idx=2&sn=09b6dba5bda13b24f9390a9e258169c8)
- 代码卫士
  - [ ] [谷歌推出新AI漏洞奖励计划，最高赏金可达3万美元](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247524136&idx=1&sn=544051e9483bc925f11c0f9ce0b6d467)
  - [ ] [Zeroday Cloud 黑客大赛专注开源云和AI工具，赏金池450万美元](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247524136&idx=2&sn=1ab345272edbec98f4aedbfa52607ee0)
- 看雪学苑
  - [ ] [Frida自编译以及去特征](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458601685&idx=1&sn=bfcb75dafc7ac077bbbd408600151247)
  - [ ] [AI安全新范式：京东JoySafety开源项目深度解析](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458601685&idx=2&sn=06145b6e4c28292852cb7a0414a1ada2)
  - [ ] [勒索60万英镑、暗网发儿童照！Kido 托儿所攻击案两名17岁嫌疑人被英国警方逮捕](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458601685&idx=3&sn=5add2428fb79c23780200d61db85b72b)
  - [ ] [Frida编译调试与Hook技术实战：赠 android rat源码供学习](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458601685&idx=4&sn=b05231696f0e4a9c0f97c80a839cb104)
- 奇安信 CERT
  - [ ] [【已复现】Oracle E-Business Suite 远程代码执行漏洞(CVE-2025-61882)安全风险通告](https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247503984&idx=1&sn=d2a61919ec6319bb86febfc82438f0de)
- 长亭安全应急响应中心
  - [ ] [【已复现】Oracle E-Business Suite 远程代码执行漏洞安全通告(CVE-2025-61882)](https://mp.weixin.qq.com/s?__biz=MzIwMDk1MjMyMg==&mid=2247492964&idx=1&sn=e59c4e934ae95d74b1ca53b50431d310)
- 安全圈
  - [ ] [【安全圈】《王者荣耀》崩上热搜](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652072136&idx=1&sn=7f2d55d4b55b197f6d621273480d303c)
  - [ ] [【安全圈】微软365全球服务中断：Teams、Exchange Online及管理平台集体瘫痪](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652072136&idx=2&sn=4256e4be2b347656ab2a574d97e244c4)
  - [ ] [【安全圈】黑客借虚假 Microsoft Teams 安装程序 植入 Oyster 后门入侵企业网络](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652072136&idx=3&sn=987cfb62a80e720793ba056bbd583ed3)
- 数世咨询
  - [ ] [AI开发助手=大规模风险自动化？](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247540452&idx=1&sn=89ac290030841efeca8587cd1f229e35)
- 极客公园
  - [ ] [这款 AI 调研神器，让我一键产生 1000 个「种子用户」｜AI 上新](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2653088065&idx=1&sn=bfdc05ec814995cf5c127ea44487d323)
  - [ ] [新一代短剧人，涌向郑州「淘金」](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2653088063&idx=1&sn=d0dedb70d827b4b6e778c9f7f711438a)
  - [ ] [英伟达将投资马斯克的 xAI；低价版Model 3/Y 「阉割」智驾功能；微信推出批量撤回信息功能 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2653088054&idx=1&sn=62afadeb21ccbde17a0aeec2aea41632)
- dotNet安全矩阵
  - [ ] [剖析 .NET 5 + 版本中 ShellCode 运行失效的深层原因与解决方案](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247500770&idx=1&sn=6b29ad9ffc97b0210d387b4c05c56f55)
  - [ ] [「.NET 安全交流社区」构建完整攻防体系的知识宝库](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247500770&idx=2&sn=01be6978e36fb6e848f6c0ab71608fef)
  - [ ] [.NET 中使用 Windows runas 提升进程权限](https://mp.weixin.qq.com/s?__biz=MzUyOTc3NTQ5MA==&mid=2247500770&idx=3&sn=aa017ce333f18eb10369e5dd89a53128)
- 默安科技
  - [ ] [国家级认证再添重磅！默安科技跻身重点 “小巨人”，彰显硬核科创实力](https://mp.weixin.qq.com/s?__biz=MzIzODQxMjM2NQ==&mid=2247501373&idx=1&sn=6547d3630469cb92db13191b65d0e0fa)
- 安全研究GoSSIP
  - [ ] [G.O.S.S.I.P 阅读推荐 2025-10-09 WireTap窃听风暴](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247500784&idx=1&sn=5d901012fc220b6f854bca3e8fcadc6b)
- 安全学术圈
  - [ ] [2025年度网络空间安全技术国家地方联合工程实验室开放课题指南征集](https://mp.weixin.qq.com/s?__biz=MzU5MTM5MTQ2MA==&mid=2247493889&idx=1&sn=fd8b6a478431c7937f7ba039b60d2676)
- 深信服千里目安全技术中心
  - [ ] [【漏洞通告】Redis Lua脚本远程代码执行漏洞(CVE-2025-49844)](https://mp.weixin.qq.com/s?__biz=Mzg2NjgzNjA5NQ==&mid=2247524718&idx=1&sn=8146b8fd7ef6dbe6382d5a3fa8e168ca)
  - [ ] [网络安全信息与动态周报2025年第39期（9月22日-9月28日）](https://mp.weixin.qq.com/s?__biz=Mzg2NjgzNjA5NQ==&mid=2247524718&idx=2&sn=d7941953dc276ed5e0f8d072d628e952)
- 嘶吼专业版
  - [ ] [新型工具EDR-Freeze曝光：借助Windows错误报告系统 从用户模式中实现安全软件规避](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247584820&idx=1&sn=da434f3425b5eeb869ca175a28f07ec4)
  - [ ] [黑客借虚假Microsoft Teams安装程序植入Oyster后门入侵企业网络](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247584820&idx=2&sn=2e766e9848df09fbf6a84608cf734e8c)
- 安全牛
  - [ ] [AI赋能实战网络靶场：你的防御体系，准备好迎接“智能对手”了吗？](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651138894&idx=1&sn=af7595ae8cb3a5ebbeffc6d96b99d48c)
  - [ ] [2025年10月起多项政策法规及标准开始施行；为“给领导添堵”竟当“内鬼”！国安部披露 | 牛览](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651138894&idx=2&sn=838495d6d3eb699e99291820b13deaab)
- 国家互联网应急中心CNCERT
  - [ ] [网络安全信息与动态周报2025年第39期（9月22日-9月28日）](https://mp.weixin.qq.com/s?__biz=MzIwNDk0MDgxMw==&mid=2247500695&idx=1&sn=e84cdd2049765e18bda5d1a3daf639fb)
- 美团技术团队
  - [ ] [可验证过程奖励在提升大模型推理效率中的探索与实践](https://mp.weixin.qq.com/s?__biz=MjM5NjQ5MTI5OA==&mid=2651781474&idx=1&sn=7282bee4c7608dc05de01477925ab8f6)
  - [ ] [MARS TALK 第06期｜走进香港理工大学，共话高动态环境下的智能机器人发展与应用](https://mp.weixin.qq.com/s?__biz=MjM5NjQ5MTI5OA==&mid=2651781474&idx=2&sn=b052043a9f15afbcb67559e2c9120ba4)
- 补天平台
  - [ ] [湘江论 “安” 缺你不可！补天长沙站议题征集倒计时9天！速来投稿！](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247509404&idx=1&sn=ad1cac820bdfb45518e495916e302cdb)
- huasec
  - [ ] [安全运营中的挖矿行为分析](https://mp.weixin.qq.com/s?__biz=MzIyOTY1NDE5Mg==&mid=2247485290&idx=1&sn=077596bf6b51a9b85884943ac13d54ca)
- Qualys Security Blog
  - [ ] [Qualys Recognized as a Leader in the 2025 GigaOM Radar for Patch Management Solutions](https://blog.qualys.com/category/product-tech)
  - [ ] [Ensuring Safe and Reliable Updates with Qualys TruRisk™ Manifest Version Control](https://blog.qualys.com/category/product-tech)
- IT Service Management News
  - [ ] [Professionisti e dichiarazione dei sistemi di IA usati](http://blog.cesaregallotti.it/2025/10/professionisti-e-dichiarazione-dei.html)
  - [ ] [NIS2: Referente CSIRT e nuova registrazione per i soggetti NIS](http://blog.cesaregallotti.it/2025/10/nis2-referente-csirt-e-nuova.html)
- DEF CON Announcements!
  - [ ] [Call for CTF Organizers!](https://defcon.org/html/links/dc-ctf-cfo.html)
- Over Security - Cybersecurity news aggregator
  - [ ] [New Android spyware ClayRat imitates WhatsApp, TikTok, YouTube](https://www.bleepingcomputer.com/news/security/new-android-spyware-clayrat-imitates-whatsapp-tiktok-youtube/)
  - [ ] [Hackers now use Velociraptor DFIR tool in ransomware attacks](https://www.bleepingcomputer.com/news/security/hackers-now-use-velociraptor-dfir-tool-in-ransomware-attacks/)
  - [ ] [Microsoft: Hackers target universities in “payroll pirate” attacks](https://www.bleepingcomputer.com/news/security/hackers-target-university-hr-employees-in-payroll-pirate-attacks/)
  - [ ] [Introducing Sucuri Academy: Your New Destination for Website Security Education](https://blog.sucuri.net/2025/10/introducing-sucuri-academy-your-new-destination-for-website-security-education.html)
  - [ ] [Microsoft Defender mistakenly flags SQL Server as end-of-life](https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-mistakenly-flags-sql-server-as-end-of-life/)
  - [ ] [Italian businessman’s phone reportedly targeted with Paragon spyware](https://techcrunch.com/2025/10/09/italian-businessmans-phone-reportedly-targeted-with-paragon-spyware/)
  - [ ] [Why don’t we sit around this computer console and have a sing-along?](https://blog.talosintelligence.com/newsletter-computer-console-sing-along/)
  - [ ] ['Payroll pirate' hackers diverting salary payments from university employees, Microsoft says](https://therecord.media/universities-phishing-payroll-pirates)
  - [ ] [RondoDox botnet targets 56 n-day flaws in worldwide attacks](https://www.bleepingcomputer.com/news/security/rondodox-botnet-targets-56-n-day-flaws-in-worldwide-attacks/)
  - [ ] [Renewal of cyber information-sharing law must mind the gap, senator says](https://therecord.media/cisa-2015-renewal-peters-bill-gap-in-liability-protections)
  - [ ] [Discord says 70,000 users had government IDs exposed in third-party breach](https://therecord.media/discord-government-docs-exposed-breach)
  - [ ] [Sorgenia e Dolomiti Energia, attacco coordinato alla supply chain digitale: le ipotesi](https://www.cybersecurity360.it/nuove-minacce/sorgenia-e-dolomiti-energia-attacco-coordinato-alla-supply-chain-digitale-le-ipotesi/)
  - [ ] [Microsoft: Windows Backup now available for enterprise users](https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-backup-now-available-for-enterprise-users/)
  - [ ] [CometJacking: quando un clic trasforma il browser Comet AI di Perplexity in un ladro di dati](https://www.cybersecurity360.it/nuove-minacce/cometjacking-quando-un-clic-trasforma-il-browser-comet-ai-di-perplexity-in-un-ladro-di-dati/)
  - [ ] [From infostealer to full RAT: dissecting the PureRAT attack chain](https://www.bleepingcomputer.com/news/security/from-infostealer-to-full-rat-dissecting-the-purerat-attack-chain/)
  - [ ] [SonicWall: Firewall configs stolen for all cloud backup customers](https://www.bleepingcomputer.com/news/security/sonicwall-firewall-configs-stolen-for-all-cloud-backup-customers/)
  - [ ] [Notification Protection, da Kaspersky un sistema anti-phishing per Android](https://www.securityinfo.it/2025/10/09/notification-protection-da-kaspersky-un-sistema-anti-phishing-per-android/)
  - [ ] [Accesso al dossier sanitario: cosa impariamo dalla sanzione privacy alla AOU Careggi](https://www.cybersecurity360.it/legal/privacy-dati-personali/accesso-al-dossier-sanitario-cosa-impariamo-dalla-sanzione-privacy-alla-aou-careggi/)
  - [ ] [Azure outage blocks access to Microsoft 365 services, admin portals](https://www.bleepingcomputer.com/news/microsoft/azure-outage-blocks-access-to-microsoft-365-services-admin-portals/)
  - [ ] [Hacktivists target critical infrastructure, hit decoy plant](https://www.bleepingcomputer.com/news/security/hacktivists-target-critical-infrastructure-hit-decoy-plant/)
  - [ ] [Velociraptor leveraged in ransomware attacks](https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks/)
  - [ ] [Google ripulisce il Play Store da 224 app usate per frodi online: cosa impariamo](https://www.cybersecurity360.it/news/google-ha-rimosso-224-app/)
  - [ ] [Cisco automation series](https://www.adainese.it/blog/2025/01/01/cisco-automation-series/)
  - [ ] [DORA e Ict: le sfide tecnologiche, i processi e la resilienza continua](https://www.cybersecurity360.it/legal/dora-e-ict-le-sfide-tecnologiche-i-processi-e-la-resilienza-continua/)
  - [ ] [Australian Data Breaches Are Up 48% So Far This Year. What’s Behind The Eye-Popping Surge?](https://cyble.com/blog/australian-data-breaches-2025-surge/)
  - [ ] [Hackers claim Discord breach exposed data of 5.5 million users](https://www.bleepingcomputer.com/news/security/hackers-claim-discord-breach-exposed-data-of-55-million-users/)
- 迪哥讲事
  - [ ] [xss中常见绕过思路](https://mp.weixin.qq.com/s?__biz=MzIzMTIzNTM0MA==&mid=2247498377&idx=1&sn=fac1c705d73f6bd024194cfdc2504f10)
- DARKNAVY
  - [ ] [机器人出现“人传人”漏洞？宇树还能打好安全这张牌吗？](https://mp.weixin.qq.com/s?__biz=MzkyMjM5MTk3NQ==&mid=2247492142&idx=1&sn=b7f7bfc523e669b81bf838d1018a069f)
- TrustedSec
  - [ ] [Skimming Credentials with Azure's Front Door WAF](https://trustedsec.com/blog/skimming-credentials-with-azures-front-door-waf)
- ICT Security Magazine
  - [ ] [Innovazione a difesa delle infrastrutture critiche](https://www.ictsecuritymagazine.com/articoli/difesa-infrastrutture-critiche/)
  - [ ] [TikTok ti spia per il governo cinese?](https://www.ictsecuritymagazine.com/notizie/tiktok-ti-spia/)
- SANS Internet Storm Center, InfoCON: green
  - [ ] [&#x5b;Guest Diary&#x5d; Building Better Defenses: RedTail Observations from a Honeypot, (Thu, Oct 9th)](https://isc.sans.edu/diary/rss/32312)
  - [ ] [ISC Stormcast For Thursday, October 9th, 2025 https://isc.sans.edu/podcastdetail/9648, (Thu, Oct 9th)](https://isc.sans.edu/diary/rss/32356)
- Microsoft Security Blog
  - [ ] [Securing agentic AI: Your guide to the Microsoft Ignite sessions catalog](https://www.microsoft.com/en-us/security/blog/2025/10/09/securing-agentic-ai-your-guide-to-the-microsoft-ignite-sessions-catalog/)
  - [ ] [Investigating targeted “payroll pirate” attacks affecting US universities](https://www.microsoft.com/en-us/security/blog/2025/10/09/investigating-targeted-payroll-pirate-attacks-affecting-us-universities/)
- Securityinfo.it
  - [ ] [Notification Protection, da Kaspersky un sistema anti-phishing per Android](https://www.securityinfo.it/2025/10/09/notification-protection-da-kaspersky-un-sistema-anti-phishing-per-android/?utm_source=rss&utm_medium=rss&utm_campaign=notification-protection-da-kaspersky-un-sistema-anti-phishing-per-android)
- Troy Hunt's Blog
  - [ ] [Court Injunctions are the Thoughts and Prayers of Data Breach Response](https://www.troyhunt.com/court-injunctions-are-the-thoughts-and-prayers-of-data-breach-response/)
- Arturo Di Corinto
  - [ ] [ACN e la sovranità digitale al DisclAImer Tour del Corsera](https://dicorinto.it/formazione/acn-e-la-sovranita-digitale-al-disclaimer-tour-del-corsera/)
- Full Disclosure
  - [ ] [CVE-2025-59397 - Open Web Analytics SQL Injection](https://seclists.org/fulldisclosure/2025/Oct/5)
- Instapaper: Unread
  - [ ] [Cross-Platform DFIR Tools MalChelaGUI on Windows](https://bakerstreetforensics.com/2025/10/07/cross-platform-dfir-tools-malchelagui-on-windows/)
  - [ ] [I 10 controlli tecnici per verificare se una mail è originale o falsa ed evitare truffe e phishing](https://www.cybersecurity360.it/cultura-cyber/i-10-controlli-tecnici-per-verificare-se-una-mail-e-originale-o-falsa/)
- TorrentFreak
  - [ ] [DAZN Letters to IPTV Pirates Demand €500, Compliance in 7 Days – Or Else](https://torrentfreak.com/dazn-letters-to-iptv-pirates-demand-e500-and-full-compliance-in-7-days-or-else-251009/)
- Security Affairs
  - [ ] [ClayRat campaign uses Telegram and phishing sites to distribute Android spyware](https://securityaffairs.com/183169/malware/clayrat-campaign-uses-telegram-and-phishing-sites-to-distribute-android-spyware.html)
  - [ ] [CVE-2025-5947: WordPress Plugin flaw lets hackers access Admin accounts](https://securityaffairs.com/183162/hacking/cve-2025-5947-wordpress-plugin-flaw-lets-hackers-access-admin-accounts.html)
  - [ ] [Threat actors steal firewall configs, impacting all SonicWall Cloud Backup users](https://securityaffairs.com/183154/security/threat-actors-steal-firewall-configs-impacting-all-sonicwall-cloud-backup-users.html)
  - [ ] [Discord denies massive breach, confirms limited exposure of 70K ID photos](https://securityaffairs.com/183143/cyber-crime/discord-denies-massive-breach-confirms-limited-exposure-of-70k-id-photos.html)
- Trend Micro Research, News and Perspectives
  - [ ] [RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits](https://www.trendmicro.com/en_us/research/25/j/rondodox.html)
  - [ ] [Weaponized AI Assistants & Credential Thieves](https://www.trendmicro.com/en_us/research/25/j/weaponized-ai-assistants.html)
- Active Directory & Azure AD/Entra ID Security
  - [ ] [Active Directory Security Tip #13: Reviewing Foreign Security Principals (FSPs)](https://adsecurity.org/?p=4784)
- The Hacker News
  - [ ] [From HealthKick to GOVERSHELL: The Evolution of UTA0388's Espionage Malware](https://thehackernews.com/2025/10/from-healthkick-to-govershell-evolution.html)
  - [ ] [New ClayRat Spyware Targets Android Users via Fake WhatsApp and TikTok Apps](https://thehackernews.com/2025/10/new-clayrat-spyware-targets-android.html)
  - [ ] [Hackers Access SonicWall Cloud Firewall Backups, Spark Urgent Security Checks](https://thehackernews.com/2025/10/hackers-access-sonicwall-cloud-firewall.html)
  - [ ] [ThreatsDay Bulletin: MS Teams Hack, MFA Hijacking, $2B Crypto Heist, Apple Siri Probe & More](https://thehackernews.com/2025/10/threatsday-bulletin-ms-teams-hack-mfa.html)
  - [ ] [SaaS Breaches Start with Tokens - What Security Teams Must Watch](https://thehackernews.com/2025/10/saas-breaches-start-with-tokens-what.html)
  - [ ] [From Phishing to Malware: AI Becomes Russia's New Cyber Weapon in War on Ukraine](https://thehackernews.com/2025/10/from-phishing-to-malware-ai-becomes.html)
  - [ ] [Critical Exploit Lets Hackers Bypass Authentication in WordPress Service Finder Theme](https://thehackernews.com/2025/10/critical-exploit-lets-hackers-bypass.html)
- The Register - Security
  - [ ] [It's trivially easy to poison LLMs into spitting out gibberish, says Anthropic](https://go.theregister.com/feed/www.theregister.com/2025/10/09/its_trivially_easy_to_poison/)
  - [ ] [SonicWall breach hits every cloud backup customer after 5% claim goes up in smoke](https://go.theregister.com/feed/www.theregister.com/2025/10/09/sonicwall_breach_hits_every_cloud/)
- Deeplinks
  - [ ] [PERA Remains a Serious Threat to Efforts Against Bad Patents](https://www.eff.org/deeplinks/2025/10/pera-remains-serious-threat-efforts-against-bad-patents)
  - [ ] [Opt Out October: Daily Tips to Protect Your Privacy and Security](https://www.eff.org/deeplinks/2025/09/opt-out-october-daily-tips-protect-your-privacy-and-security)
- Security Weekly Podcast Network (Audio)
  - [ ] [IoT Hacks Galore - Kieran Human - PSW #895](http://sites.libsyn.com/18678/iot-hacks-galore-kieran-human-psw-895)


Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[每日信息流] 2025-10-10 #1010

每日安全资讯（2025-10-10）

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[每日信息流] 2025-10-10 #1010

Description

每日安全资讯（2025-10-10）

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions