PoC 公开后，攻击者开始利用 SharePoint 认证绕过漏洞
CVE-2026-55040，CVSS 9.1，SharePoint 认证绕过漏洞在 PoC 代码公开后已被威胁行为者利用。微软已在 2026 年 7 月补丁日修复，但尚未部署的实例仍面临风险。
The Hacker News
最受信任、被广泛阅读的独立网络安全新闻来源；由黑客和 IT 专业人士支持——线索请发至 admin@thehackernews.com
评论
点赞
收藏Lazarus组织利用Windows零日漏洞获取SYSTEM权限并部署后门
朝鲜Lazarus组织利用Windows零日漏洞获取SYSTEM权限，向法、德、巴西、印度四国国防和航空航天公司部署新型后门。该活动名为"Operation Dream Job"，属长期网络间谍行动，由Check Point Research归因。漏洞已被微软修补。
737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
A massive set of 737 free VPN and proxy extensions have been found to mainly target Russian-speaking users seeking access to blocked services with an aim to intercept browser traffic and route them th...
OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning
A newly disclosed flaw in the way OpenAI, Anthropic, and Google carried hidden AI reasoning between API calls let researchers recover internal reasoning and secrets from session logs, including API ke...
Enterprise Defenses Recovered at the Edge and Collapsed Inside
Enterprise defenses are tuned to catch the attacks that make noise. This year's data shows attackers winning by making none. According to Picus Labs' new Blue Report 2026, which measured more than 338...
Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
Adobe has shipped updates to address multiple critical security vulnerabilities impacting ColdFusion, Commerce, and Campaign Classic that, if successfully exploited, could result in arbitrary code exe...
Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
Threat actors have begun to actively exploit a recently patched critical security flaw in Broadcom VMware vCenter, according to new findings from QUIRSO. The vulnerability in question is CVE-2026-5931...
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
Two malicious LiteLLM releases sat on PyPI for about 40 minutes in March carrying credential-stealing code capable of harvesting cloud keys, SSH keys, Kubernetes tokens, database passwords, and other ...
SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code
SAP has released patches to address a maximum-severity security flaw impacting Commerce Cloud (Data Hub Adapter) that could result in arbitrary code execution. The vulnerability, assigned the CVE iden...
ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access
The security researcher going by the name Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has released a proof-of-concept (PoC) for a new Microsoft zero-day called ShieldB...
Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS
Cisco has warned that a new vulnerability impacting Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software has been exploited in the wild. The hig...
Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack
Microsoft released its monthly security updates on Tuesday, and one of the flaws it closed is already being used in attacks. The bug sits in a core Windows kernel driver that handles network socket op...
Kimwolf v7 Android 僵尸网络利用 HTTP/2 将 DDoS 流量伪装成正常浏览
Palo Alto Networks Unit 42 在2026年2月发现 Kimwolf v7 僵尸网络新变种，针对 Android 和 IoT 设备。该版本新增基于 HTTP/2 的 DDoS 攻击能力，使恶意流量伪装成正常浏览行为，提升对抗检测的生存能力。
Zoom 标注功能漏洞：参会者可在零交互情况下劫持他人电脑
Zoom 标注功能存在安全漏洞，屏幕共享时参会者可无需任何交互劫持观看者或演示者的电脑。漏洞无需点击、下载或弹窗提示，受害者只需在会议中即受影响。攻击向量是双向的：共享屏幕的人可控制观看者，观看者也可控制演示者。
Sandworm关联组织UAC-0145利用虚假招聘推送恶意VPN
乌克兰CERT披露俄罗斯国家支持的黑客组织Sandworm（UAC-0145子群）正针对乌克兰IT从业者发起社交工程攻击，攻击者伪装成招聘人员诱导受害者安装可远程执行命令的恶意VPN。这是典型的招聘场景钓鱼变种，将恶意软件伪装成职场入职工具。
AI辅助发现的SharePoint漏洞可实现未授权远程代码执行
安全研究人员利用AI代理发现SharePoint未授权远程代码执行漏洞（CVE-2026-55040，CVSS 9.1），无需有效账户即可以任意用户身份（含管理员）进入SharePoint服务器。受影响版本包括SharePoint Server订阅版、2019版和2016版。AI在漏洞挖掘中的实际作用再次得到验证。
DeadLock勒索软件用Polygon智能合约构建难以打击的勒索基础设施
DeadLock勒索软件组织利用Polygon智能合约和Session消息网络搭建去中心化勒索基础设施，使执法机构更难阻断其运营。微软威胁情报部门披露，该团伙将恢复生态与区块链服务结合，用于存储和分发勒索流程中的资源。这种去中心化策略让传统的域名查封和服务器关停手段失效。
OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development
OpenAI on Monday unveiled a new cybersecurity-focused model called GPT‑5.6‑Cyber that it said is focused on vulnerability research, penetration testing, and incident response. "Built on GPT‑5.6 Sol, i...
A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices
A malicious SIM card can order the device it sits in to run commands of the attacker's choosing. On the cellular modules built into electric-vehicle chargers, industrial routers, and car telematics un...
Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo
Mozilla has scrapped the cryptographic key behind Firefox and Thunderbird downloads for Linux after an unencrypted copy of it was committed by mistake to one of the company's own private code reposito...
Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers
Security researchers invented a cryptocurrency startup, advertised developer jobs, and hired three people they believe were North Korean operatives. Every virtual machine the company issued was record...
Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11
Windows Plug and Play can be abused to fetch signed vendor software for an emulated USB device and execute privileged installation components that researchers chained to SYSTEM access on a fully updat...