[每日信息流] 2025-11-05 #1041
Description
每日安全资讯（2025-11-05）
- SecWiki News
- Der Flounder
- Trustwave Blog
- 嘶吼 RoarTalk – 网络安全行业综合服务平台,4hou.com
- CXSECURITY Database RSS Feed - CXSecurity.com
- Private Feed for M09Ic
- spf13 starred codykociemba/NoLongerEvil-Thermostat
- bolucat released 202511041935 at bolucat/Archive
- bitsadmin starred bitsadmin/nopowershell
- bitsadmin contributed to bitsadmin/nopowershell
- whwlsfb forked whwlsfb/woodpecker-requests from woodpecker-framework/woodpecker-requests
- joaoviictorti starred Cobalt-Strike/Malleable-C2-Profiles
- future-architect released v0.36.2 at future-architect/vuls
- chainreactors released v0.1.2 at chainreactors/malefic
- uknowsec starred ycccccccy/wx_key
- OpenAEV-Platform released 2.0.2 at OpenAEV-Platform/openaev
- oiweiwei released v1.2.11 at oiweiwei/go-msrpc
- gh0stkey starred warpdotdev/Warp
- PrefectHQ released 3.5.1.dev1 at PrefectHQ/prefect
- timwhitez forked timwhitez/shangma_auto_sign from angyyang/shangma_auto_sign
- timwhitez starred loosehose/SilentButDeadly
- lz520520 starred safedv/RustPotato
- future-architect released v0.36.0 at future-architect/vuls
- pydantic released v1.10.0 at pydantic/pydantic-ai
- uknowsec starred loosehose/SilentButDeadly
- gh0stkey starred FreeRDP/Remmina
- DVKunion starred alibaba/Helios
- 奇安信攻防社区
- 安全客-有思想的安全新媒体
- paper - Last paper
- Recent Commits to cve:main
- obaby@mars
- Tenable Blog
- Doonsec's feed
- 【高危漏洞预警】React Native CLI 远程命令执行漏洞CVE-2025-11953
- 论文研读与思考|CTINEXUS：基于大型语言模型的自动网络威胁情报知识图谱构建
- 论文研读与思考|从新手到专家：通过逐步强化学习优化LLM代理策略
- 中成科信票务管理系统OrderManager.ashx接口存在任意文件读取漏洞 附POC
- Vulnhub靶场之DC-3
- 更新系统！安卓13-16存在零点击远程代码执行漏洞
- iOS 26.1 安全更新详解：为什么立即更新至关重要
- 重要通知丨第九届“强网杯”全国网络安全挑战赛线上赛获奖名单及线下赛入围名单公布
- 重要通知丨第九届“强网杯”行业领域专项赛天基互联网安全赛道线上赛排名及线下赛拟入围名单公布
- 重要通知丨第九届“强网杯”强网征文活动截止时间延期
- WEB视角下的客户端安全测试
- 这才是新一代网络安全架构：AI 大模型驱动，90 秒拦截零日威胁，告别 “事后救火”
- 【SRC实战】通过FUZZ挖掘高危漏洞
- 宣传一下
- 2025第十八届中国密码学会年会 （ChinaCrypt 2025）即将召开
- 护网-2025 | 离职前故意删除公司数据是民事纠纷还是违法行为？网警来解惑！
- 专家解读 | 王春晖：维护网络数据流通安全的法治基石
- 关基威胁真实案例！英国供水行业近两年至少遭受了5起网攻事件
- 拿到 Shell 才是开局：25 条“后渗透”神命令一口气学会
- 实验：利用路径分隔符进行 Web 缓存欺骗
- 银狐最新反沙箱内存免杀样本分析
- 取证干货| iPhone “失窃设备保护” 功能解析：特性、取证影响与应对策略
- 赠！第10th美亚杯题解新鲜出炉，填问卷免费送
- 印度航空母舰与舰上战机通信细节在暗网曝光
- 建行探索“AI辅助+专家决策”人机耦合智能化授信审批
- AI快讯：上海银行首创沪语交互AI应用，全球首个AI投资大赛结果出炉，五部门新政策指向AI+医疗
- 中金公司AI中台建设项目招标，采购AI训推一体化软件及相关配套服务
- 谁掌控未来算力？2025全球AI算力主权争夺战全景分析
- 47个冰站遭入侵——普京秘密北极情报网络
- 快领！CCSP试学课&模拟题免费开放
- 省钱考证书！11月8日 CISP 周六即将开课，双11特惠报名最后机会！
- 网安行业如何0成本创业——百分百挣钱
- src-歪门邪道分享+支付漏洞挖掘
- 我和大家聊聊：一个独立安全讲师的接近两年经历
- 双 11 超值神器！这款工具只要 5.6 元起，却能让你的账单明明白白！
- 2024华为漏洞管理白皮书
- 车联网安全自动化漏洞利用方法研究
- 智能网联汽车 SOME/IP 在线实战培训课程 2025
- 深度：未来网络战演进趋势及需构建的三大能力要素
- 135元，IoT 嵌入式大佬带你DIY基于STM32热敏打印机，涵盖覆盖硬件、3D打印结构、App，便于物联网爱好者二次开发
- APT组织利用LNK漏洞和OpenSSH后门攻击白俄罗斯军方始末
- 研究人员披露Windows SMB服务器权限提升漏洞（CVE-2025-58726）
- Android AI反诈系统月均拦截百亿次威胁，较iOS高58%
- 朝鲜APT组织Kimsuky和Lazarus升级攻击武器库
- 《南华早报》专访CertiK创始人顾荣辉：香港吸引Web3企业迁入，优势持续显现
- Struts2全版本漏洞检测工具 — Struts2VulsScanTools
- 手把手教会你白加黑无敌免杀（附工具和源码）
- 【安全圈】Windows 11终于解决"更新并关机"后自动重启的问题
- 【安全圈】黑客大规模扫描 TCP 端口 8530/8531疑似利用 WSUS 远程执行漏洞
- 【安全圈】Dante间谍软件再现前Hacking Team影子
- 【安全圈】美国检方起诉三名前网络安全从业者 涉嫌参与 BlackCat 勒索攻击
- Spring框架的漏洞扫描及漏洞利用图形化工具 - YYBaby-Spring_Scan
- XXE漏洞狩猎指南：从原理到实战，斩获高额赏金
- 网络设备运维完全指南：交换机、路由器、防火墙深度解析
- 利用幽灵SPN和Kerberos反射提升SMB服务器权限
- 伪造的 Solidity VSCode 扩展程序，针对 Open VSX 后门开发者
- 谷歌为两个 Chrome 漏洞各支付5万美元赏金
- Elastic Cloud Enterprise 中存在高危提权漏洞
- 【漏洞通告】JumpServer连接令牌验证不当漏洞（CVE-2025-62712）
- 网安原创文章推荐【2025/11/3】
- 绿盟科技第一份额中标2025年中国联通WAF产品集中采购项目
- 《网络安全法》迎来重磅修订，2026年实施！这些变化与企业息息相关
- 简讯丨信安珞珈承办湖北省商用密码协会 2025 年密码技术一期培训
- 调研显示：40%企业支付勒索软件攻击赎金仍无法恢复数据
- 官宣! ADConf 2025「智变·暗涌」全议程上线
- 奇安信与内蒙古工业大学签署战略合作，共筑数智时代北疆能源算力安全新防线
- 美军B-1B进入南海东海？前沿部署背后的「动态兵力运用」
- ACL 2025 杰出论文 | 小红书 AI 搜索和北理工提出“容量差距法则”
- 免费亦强大：不可错过的四大开源情报卫星影像工具
- 360SRC助力 | ADConf 2025「智变·暗涌」全议程上线！
- 实战派第四期—诚邀专家共话办公流量安全（11.15/周六、北京）
- 告别被动等待：Phalcon Security 如何将 Web3 安全带入“主动防御”时代
- Microsoft Security Blog
- Cerbero Blog
- GuidePoint Security
- SpiderLabs Blog
- Hexacorn
- Horizon3.ai
- Malwarebytes
- daniel.haxx.se
- CCC Event Blog
- 奇客Solidot–传递最新科技情报
- 安全分析与研究
- 黑海洋 - Wiki
- 看雪学苑
- 奇安信 CERT
- 绿盟科技CERT
- 虎符智库
- 代码卫士
- 吾爱破解论坛
- 威努特安全网络
- 二道情报贩子
- RedTeaming
- 奇安信威胁情报中心
- 网安杂谈
- 安全内参
- 数世咨询
- 微步在线研究响应中心
- 极客公园
- 网络空间安全科学学报
- DataCon大数据安全分析竞赛
- 嘶吼专业版
- 安全圈
- 微步在线
- 中国信息安全
- 补天平台
- 国家互联网应急中心CNCERT
- 吴鲁加
- 字节跳动技术团队
- 迪哥讲事
- 黑鸟
- 360数字安全
- ICT Security Magazine
- Over Security - Cybersecurity news aggregator
- Hackers exploit WordPress plugin Post SMTP to hijack admin accounts
- Apache OpenOffice disputes data breach claims by ransomware gang
- gitlab-runner-research – PoC for abusing self-hosted GitLab runners
- Malicious Android apps on Google Play downloaded 42 million times
- Polish loan platform hacked; mobile payment system and other businesses disrupted
- Microsoft removing Defender Application Guard from Office
- Data brokers selling location info that can be used to track EU officials, report finds
- Treasury sanctions 8 for laundering North Korea earnings from cybercrime, IT worker scheme
- 9 arrested in Europe in operation against fake platforms for crypto investments
- Data breach at major Swedish software supplier impacts 1.5 million
- Health privacy bill seeks protections for data collected by apps, smartwatches
- Media giant Nikkei reports data breach impacting 17,000 people
- Anziani truffati online e paradosso privacy, scudo per i criminali: ecco la soluzione canadese
- European Media Freedom Act, il regolamento UE sulla libertà dei media: i legami con la privacy
- The Top 3 Browser Sandbox Threats That Slip Past Modern Security Tools
- Police arrests suspects linked to €600 million crypto fraud ring
- Furto al Louvre, password imbarazzante e Windows XP: il problema è il fattore umano
- TruffleHog, Fade In and BSAFE Crypto-C vulnerabilities
- Russian hackers abuse Hyper-V to hide malware in Linux VMs
- Phishing via Phish Sim tools
- Executive vs Non-Executive CISO: chi decide cosa nella catena di responsabilità
- Windows 10 update bug triggers incorrect end-of-support alerts
- In aumento gli attacchi alle applicazioni pubbliche, calano i ransomware: il report di Cisco Talos
- Software Supply Chain Attacks Surge to Record High in October 2025
- In corso una campagna di phishing ai danni di Banca d’Italia
- Un’indagine Crowdstrike dimostra che le aziende sottostimano le cyber minacce
- Costruire sistemi di asset management resilienti: modelli e processi
- Hackers exploit critical auth bypass flaw in JobMonster WordPress theme
- Securityinfo.it
- SANS Internet Storm Center, InfoCON: green
- Instapaper: Unread
- Un’indagine Crowdstrike dimostra che le aziende sottostimano le cyber minacce
- Getting Started with The DFiR Galaxy Workstation
- Mac forensics best practices guide
- prosch88ALEX Extract files from ADB devices on Windows, Linux and MacOS. Mostly a wrapper for adbutils.
- Metropolitan Police hails facial recognition tech after record year for arrests
- AN0M, the backdoored ‘secure’ messaging app for criminals, is still producing arrests after four years
- Analysis Playbooks USB
- ChaMd5安全团队
- TG Soft Software House - News
- The Hacker News
- A Cybercrime Merger Like No Other — Scattered Spider, LAPSUS$, and ShinyHunters Join Forces
- Europol and Eurojust Dismantle €600 Million Crypto Fraud Network in Global Sweep
- Critical React Native CLI Flaw Exposed Millions of Developers to Remote Attacks
- Microsoft Teams Bugs Let Attackers Impersonate Colleagues and Edit Messages Unnoticed
- Ransomware Defense Using the Wazuh Open Source Platform
- Operation SkyCloak Deploys Tor-Enabled OpenSSH Backdoor Targeting Defense Sectors
- Google’s AI ‘Big Sleep’ Finds 5 New Vulnerabilities in Apple’s Safari WebKit
- U.S. Prosecutors Indict Cybersecurity Insiders Accused of BlackCat Ransomware Attacks
- Microsoft Detects "SesameOp" Backdoor Using OpenAI's API as a Stealth Command Channel
- TorrentFreak
- Security Affairs
- NetSPI
- The Register - Security
- Uncle Sam wants to scan your iris and collect your DNA, citizen or not
- Russian spies pack custom malware into hidden VMs on Windows machines
- Consumer Financial Protection Bureau's security falls apart amid layoffs
- Invasion of the message body snatchers! Teams flaw allowed crims to impersonate the boss
- Cybercrooks getting violent more often to secure big payouts in Europe
- OpenAI API moonlights as malware HQ in Microsoft’s latest discovery
- China's president Xi Jinping jokes about backdoors in Xiaomi smartphones
- AN0M, the backdoored ‘secure’ messaging app for criminals, is still producing arrests after four years
- TaoSecurity Blog
- Tor Project blog
- Schneier on Security
- 安全419
- Security Weekly Podcast Network (Audio)