每日安全资讯（2026-10-22）

• SecWiki News
  • SecWiki News 2026-10-21 Review
• Cybernews News
  • 10 hour Orange outage strikes riot-hit France days after social media blackout calls
  • Trump briefed on secret UFO program, Ross Coulthart claims
  • Proton puts most detailed Flock map on Swiss servers following takedown attempt
  • Pink Panther and other agents of chaos
  • The US Army is building AI agents that can hack enemy networks on their own
  • Hackers claim they breached Disney: here’s what we found
  • Musk and Trump point fingers as Starlink slowdown hurts Ukraine
  • Spotify pulls a Netflix, asks Family plan members to verify their address
  • WordPress websites at risk from severe PHP flaws: emergency patch issued
  • Microsoft will block some USB drives from Windows
  • DHS lied about why it searched activist’s GrapheneOS phone
  • Siemens software, used by Nvidia and Amazon, under active exploitation: Is your PC safe?
  • How AI Video Generators Are Reshaping Social Media Content Creation
  • Makera Connects AI Design With Desktop CNC Making
  • OpenAI bugging suspect reportedly in contact with Saudi royal
  • US bans DeepSeek AI products from federal agencies
  • Hackers take control of school cameras, locks, and HVAC, shutting down entire Idaho school district
• Tenable Blog
  • How Tenable brought multi-language support to security detectors with agentic translation
  • php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities
• Private Feed for M09Ic
  • Ridter starred agalwood/Motrix
  • Rvn0xsy starred RaiderWang/pidesk
  • esrrhs contributed to esrrhs/spp
  • anthropics released v2.1.307 at anthropics/claude-code
  • strands-agents released typescript/v1.22.0 at strands-agents/harness-sdk
  • xgo-dev released v1.0.8 at xgo-dev/llgo
  • strands-agents released python/v1.62.0 at strands-agents/harness-sdk
  • mgeeky starred sudolulo/winnow
  • pydantic released v1.3.0 at pydantic/monty
  • liamg contributed to infracost/config
  • liamg contributed to infracost/proto
• Microsoft Security Blog
  • AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
• Sucuri Blog
  • Critical PHP Security Update: Two RCE Flaws (CVE-2026-109618, CVE-2026-109619)
• Horizon3
  • Audit-Ready Isn’t Attack-Ready.
  • CVE-2026-109618 / CVE-2026-109619 | PHP Core Remote Code Execution Vulnerabilities (PHP2Shell)
• Securelist
  • Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
  • Operation FlashHole: Lazarus breaks security, defies control
• Malwarebytes
  • WhatsApp’s chatbot was given hidden instructions to not mention privacy regulators
  • PHP2Shell: Why websites are going offline for emergency security updates
  • Fake Amazon Music x YouTube deal lures creators into a Google login trap
  • Signal bug could let someone keep listening after you hang up
• Reverse Engineering
  • gore: a CLI that turns a Godot game (PCK or EXE) into a project you can open, with automatic AES-256 key recovery
  • How Cryo's Atlantis: The Lost Tales (1997) engine works: formats, panoramic projection, scripts and 3D heads
• Kitploit — Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!
  • trivy v0.76.1
  • TLDR
  • SafeLine v9.4.3
  • CoercedPotato
  • GenAI-LLM-Top10
  • malware-research
  • wazuh v4.14.10-rc1
  • Antibody
  • Black_Hole_Attack_for_Vector_Database
  • ARTEX
  • autorun-audit
  • brave-browser v1.100.20
  • enterprise-abac-gateway
  • decomp.anything
  • AuthorizationBench
  • OpenShell v0.1.5
  • process-watcher
  • trawl v1.9.2
  • sshesame
• The Trail of Bits Blog
  • Your AI agent fixed the bug, but what else did it change?
• Intigriti
  • AI raised the floor. The hacker crowd keeps raising the ceiling.
• GuidePoint Security
  • Keep Calm, and Patch PHP2Shell
  • Protecting Against AiTM Attacks: Is Your Microsoft Environment at Risk?
  • AI Agents Are Redefining Credential Management
• HackerNews
  • OVHcloud CLI 在 GitHub 上的发布版本被植入后门，用于窃取开发者机密
  • 被盗的 UpdraftCentral 密钥被用于给 WordPress 网站植入后门
  • PHP 警告管理员存在两个严重漏洞，明日发布紧急补丁
  • Zeabur 在两个月内遭遇第二次安全入侵后宣布关闭
  • 贝尔格莱德大学校长 iPhone 被确认感染 Pegasus 间谍软件，距选举仅数天
  • Qilin 和 INC 勒索软件组织利用 Palo Alto Networks 漏洞绕过 MFA
• Exploit-DB.com RSS Feed
  • [webapps] pizzafy-1.0 - SQLi
  • [remote] South River Technologies Titan MFT Server 26.0.0 - code execution
  • [remote] Synametrics Syncrify 6.2 - command execution
  • [webapps] Keycloak 26.7.2 - Unauthenticated Account Takeover
  • [webapps] Open eClass 3.15 - RCE
  • [webapps] Automotive Shop Management System 1.0 - SQLi
  • [remote] Edimax BR-6478AC firmware v2.20 - authenticated command injection
  • [remote] Exasol Database 7.1.30 - command execution
  • [remote] Parasoft Continuous Testing Platform 10.7.5 - JSP command execution
  • [remote] ProSoft RLX-IFH24E v2.2.44 - Unsigned Firmware Upgrade Package Executed as Root
• 黑海洋Wiki | AI机器人硬件开发 | 网络安全攻防实战 | 区块链技术文档教程 - 免费资源平台
  • 日本插画网站Pixiv停站维护以修复漏洞
  • 三星、SK海力士升级中国工厂，生产更先进闪存芯片
  • Spotify已删除7500万首垃圾信息歌曲
  • 字节阿里腾讯订购总值逾350亿美元英伟达芯片
  • YouTube可能正在测试隐藏“不喜欢”按钮
  • 观看量下降后Netflix首要目标仍是提高盈利
  • 马斯克下令星盾降速 令乌克兰措手不及
  • PHP核心曝严重远程代码执行漏洞，官方计划今日发布补丁
  • OpenAI自曝AI智能体“反监控”：削弱并关闭内部警报
  • 流媒体平台Spotify推出新的播客会员服务
• 黑鸟
  • Cellebrite手握iPhone无线电0day漏洞？8米内隔空解锁设备
• 皮相
  • 我对 AI 说：“要有光”
• 威努特安全网络
  • GPU集群越扩越大，大模型训练提速为何却“打折”？
• 长亭安全应急响应中心
  • 【已复现 UAF】php2shell：PHP Core 远程代码执行漏洞（CVE-2026-109618/109619）
• 安全内参
  • VPN漏洞遭勒索软件大规模利用，Palo Alto警告多家客户被入侵
  • 美军网络司令部正打造可自主复制自毁的AI网络武器
• 青衣十三楼飞花堂
  • 从张雪机车到东鹏特饮
• 代码卫士
  • PHP 提醒注意两个未修复的严重 0day 漏洞
  • OVHcloud CLI GitHub 发布遭劫持 窃取开发人员机密
• 阿里云应急响应
  • PHP 远程代码执行漏洞通告（2026-109618 / CVE-2026-109619）
• 信息安全国家工程研究中心
  • 多人访问请求异常跳转至博彩网站，调查情况公布
• 数世咨询
  • 漏洞管理不能只看评分高低，更要看对业务的实际影响
• 奇安信 CERT
  • 【安全预警】PHP 远程代码执行漏洞(CVE-2026-109618、CVE-2026-109619)安全风险通告
• 安全圈
  • 【安全圈】最高赔500万！宝马员工争相离职挤崩内网系统
  • 【安全圈】突发双高危RCE！PHP官方紧急发布9.2分安全通告
  • 【安全圈】0dayPoC公布！FortiSIEM遭空字节截断实现免认证RCE
• 中国信息安全
  • 专题·网暴治理 | 张凌寒：以系统集成推进网络暴力治理的法律制度建设
  • 前沿 | 美国网络作战范式改变路径刍议
  • 关注 | 最新一批“银狐”木马相关恶意域名及IP公布！
  • 专家观点 | 如何看待AI治理“第三条道路”的探索
  • 行业 | 从“防住攻击”到“建立秩序”：启明星辰Agentic SOC开启自主安全运营新范式
• 奇安信威胁情报中心
  • 一把钥匙开千扇门：ConnectWise Cloud Backup 凭据失窃致数百个 Microsoft 365 租户沦陷
• XCTF联赛
  • 清北联袂 战火重燃 | 首届 CCF 网络安全智能挑战赛暨“京华杯”TPCTF 2026邀你来战
• 默安科技
  • 用 Flash 的成本，交付 Pro 的效果：默安智能路由实测数据解析
• 微步在线
  • 官网都靠不住了！多个应用软件遭投毒
• 补天平台
  • 【问卷调研】2026智能化网络安全实战人才调研启动
• 安全牛
  • AI Agent 在 SOC 中到底能干什么？6 个真实案例，看懂安全运营智能化落地
  • 美CISA、NSA、NIST联合发布 “失控 AI 智能体” 处置清单：中国互联网网络安全威胁治理联盟（CCTGA）启动“银狐”木马专项打击行动| 牛览
• 网络空间安全科学学报
  • 2026年 第4卷 第4期
  • 关于征集2026年度网络空间安全团体标准项目及起草单位的通知
• 极客公园
  • 大模型内卷之后，AI 竞争进入搜索基建时代
  • AI 漫剧越做越快，赚钱却没那么容易了
  • 这个拒绝「上下文崇拜」的 AI 墨水屏，又融了数千万
  • 曝高通启动全球裁员；上线 40 天，Muse 下载量突破 1000 万次；ChatGPT 上线幻灯片工具 | 极客早知道
• 安全学术圈
  • 宾夕法尼亚州立大学 | The Task Shield：不问“是否危险”，只问“是否在办你的事”
• 天融信阿尔法实验室
  • 【风险提示】天融信关于PHP远程代码执行漏洞CVE-2026-109618/CVE-2026-109619(PHP2Shell)的风险提示
• 火绒安全
  • 火绒小问答--「个人版」近期top问题解答
  • 诚邀渠道合作伙伴共启新征程
• 丁爸 情报分析师的工具箱
  • 【开源报告】美国生物防御体系两用风险深度调研
• 复旦白泽战队
  • Security 26 | 小游戏里的广告， 为什么总能在“不该出现”的时候出现？
• 云鼎实验室
  • CodeBuddy Security推出SCA漏洞可达性分析，告警降噪达88%
• 深信服千里目安全技术中心
  • 【漏洞通告】PHP远程代码执行漏洞(CVE-2026-109618/CVE-2026-109619)
  • 【漏洞通告】Drupal Field UI远程代码执行漏洞(CVE-2026-108097)
  • “银狐”木马专项——恶意域名及恶意IP（七）
• 国家互联网应急中心CNCERT
  • 网络安全信息与动态周报2026年第42期（10月12日-10月18日）
• 墨菲安全
  • 「AI与安全」线下闭门沙龙第四期北京站来啦
• 安全分析与研究
  • 长时程行为漂移检测
• Over Security
  • Critical PHP Security Update: Two RCE Flaws (CVE-2026-109618, CVE-2026-109619)
  • Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
  • Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected
  • Compromised eMudhra intermediate certificates
  • Lazarus hackers use post-quantum cryptography for malware delivery
  • Meta on the spot for $25 billion under New Mexico privacy ruling
  • Tech trio launches $10 million initiative to help under-resourced utilities bolster cybersecurity
  • The Missing Layer in Vulnerability Prioritization: Full Visibility Into Your Attack Surface
  • Democrat lawmakers say Russia is aiming to undermine party ahead of midterms
  • CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
  • Identità non umane e sicurezza degli accessi, le nuove sfide cyber
  • PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024
  • AI Data Leakage Prevention: proteggere i dati dall’AI
  • How To Test An AI OSINT Agent Before You Trust Its Sources
  • OpenAI agents disabled safety monitoring, one lied about it
  • Widespread PHP Flaw May Cause Many Site Outages Today
  • Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
  • Two critical RCEs in PHP core
  • I modelli OpenAI auto-disabilitano i controlli di sicurezza
  • Hundreds of websites taken offline as concern grows over two PHP vulnerabilities
  • Due vulnerabilità critiche in PHP consentono l’esecuzione di codice da remoto: rilasciati aggiornamenti di sicurezza
  • ClickFix has never been bigger, and AI tools are its most convincing lure yet
  • PHP ships emergency patches for critical PHP2Shell flaws
  • The forgotten hardware: your security depends on your weakest link
  • AppSec Qwen3.8 27B: Best LLM to protect web applications
  • Operation Fashion Weak
  • SneakPeek, la falla in Claude Code Desktop che poteva esporre le credenziali degli sviluppatori
  • PHP2Shell, due vulnerabilità critiche in PHP: come proteggere i server in attesa delle patch
  • Upcoming Critical PHP Security Release.
  • Microsoft PowerToys adds CursorHide, Button Lock mouse tools
  • Why Satellites Can't Count The Trees Felled At East Potomac
  • Fusion Fireside #21: Understanding the Psychology of Scams with Dr Nicola Harding
  • Related Threat Context: Cut Time-to-Triage with Actionable Context for Every IOC
  • php2shell: Dissecting PHP's Critical Session Upload Progress Vulnerabilities
  • Sekoia + Zimperium: investigate mobile threats in your SOC
  • Microsoft says October updates didn’t actually fix VPN issues
  • Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
  • Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress
  • La vulnerabilità dell’AI tra sycophancy e guerra geopolitica
  • UK Cybercrime Journal: Teenage Online Extremism Cases in 2026
  • Quando l’attacco cyber diventa una minaccia fisica
  • CISA: SafePay ransomware hit over 600 critical infrastructure orgs
  • FTC Says A Sextortion Help Firm Faked Its Hunt For Blackmailers
  • Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
  • Only for the curious...
  • Operation FlashHole: Lazarus breaks security, defies control
  • Stolen UpdraftCentral keys used to backdoor WordPress sites
  • Mozilla, Google, Apple block compromised eMudhra CA certificates
• Qualys Security Blog
  • The Science of Exploitability: Decoding BlueHammer
  • PHP2Shell: PHP Patches Two Critical RCE Vulnerabilities, Urges Immediate Updates
• 安全419
  • 国家数据集团成立：谁的机会，谁的考题？
• 绿盟科技CERT
  • 【漏洞通告】PHP远程代码执行漏洞（CVE-2026-109618&CVE-2026-109619）
• Instapaper: Unread
  • Indian certification authority eMudhra’s private keys compromised – one of them was the number ‘4’
  • Sequestro di criptovalute, cosa cambia con il decreto 1862026
  • Falla vecchia di 16 anni minaccia milioni di router Wi-Fi
  • PHP2Shell, due vulnerabilità critiche in PHP come proteggere i server in attesa delle patch
  • Cellebrite’s Advanced Unlocks and the case of the missing iPhone 17
  • Francia, attacco informatico ai freezer di 400 negozi e supermercati, merce rovinata per milioni. Dettagli di un disastro evitabile
  • Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
  • Possible new Cellebrite iPhone Radio Zero-Day
• The Hacker News
  • Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
  • LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
  • OpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So
  • PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
  • Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands
  • China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors
  • Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports
  • PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't
  • The Harness Is the Hard Part of Agentic Pentesting
  • Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
  • PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
  • Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
  • U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases
  • State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web
  • CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
  • Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
• Schneier on Security
  • Workshop on Economics and Information Security (WEIS) Archive
• Microsoft Browser Vulnerability Research
  • SleeperWidget: How Ad-Driven Installs Activate Hidden Browser Extension Behavior
• NetSPI
  • PHP2Shell Unauthenticated RCE on PHP: CVE-2026-109618 & CVE-2026-109619
• ICT Security Magazine
  • La trappola di Tucidide e l’Europa nell’era dell’intelligenza artificiale
  • CVD, 615-ter e il coraggio di chiedere aiuto
• KitPloit - PenTest Tools!
  • trivy v0.76.1
  • TLDR
  • SafeLine v9.4.3
  • CoercedPotato
  • GenAI-LLM-Top10
  • malware-research
  • wazuh v4.14.10-rc1
  • Antibody
  • Black_Hole_Attack_for_Vector_Database
  • ARTEX
  • autorun-audit
  • brave-browser v1.100.20
  • enterprise-abac-gateway
  • decomp.anything
  • AuthorizationBench
  • OpenShell v0.1.5
  • process-watcher
  • trawl v1.9.2
  • sshesame
• www.theregister.com - Articles
  • PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
  • LiteLLM supply chain attack hoovers up passwords and secrets
  • Signal bug could keep your mic - and camera - on after hangup
  • PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched
  • AI has 'potential' to turn script kiddies into sophisticated infrastructure attackers
  • Nvidia picks OpenShell to tame AI gents
  • EU wants Booking.com to check out of its scam problem
• SANS Internet Storm Center, InfoCON: yellow
  • Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
  • ISC Stormcast For Wednesday, October 21st, 2026 https://isc.sans.edu/podcastdetail/10144, (Wed, Oct 21st)
• Your Open Hacker Community
  • Hello, I need help.
• Krebs on Security
  • Widespread PHP Flaw May Cause Many Site Outages Today
• Tor Project blog
  • New Release: Tor Browser 15.0.26
• Security Affairs
  • Russian Satellite Makes a Close Approach To A Commercial Radar Satellite Used by Ukraine
  • OpenAI Reports Two Incidents of AI Agents Disabling Their Own Oversight
  • US Government Orders DeepSeek Out of Federal Civilian Systems
  • PHP Prepares Emergency Fixes for Two Critical Remote Code Execution Flaws
  • NSO Spyware Pegasus Hit a Serbian University Rector Six Days Before Snap Elections
• GRAHAM CLULEY
  • Smashing Security podcast #489: How a brand new crypto wallet came with a spy inside
• Deeplinks
  • Introducing Our New Surveillance Self-Defense Guide: Online Privacy for Parents and Youth
  • Interoperability vs. Security: Why not both?
  • EFF to Brazil’s ANPD: Data Privacy and Free Expression Must Underpin Platform Regulations
  • EFF’s State Legislative Agenda to End ALPR Mass Surveillance
  • EFF Launches Guide to Help Parents and Youth Protect Privacy Online
• Security Weekly Podcast Network (Audio)
  • Minimum Viable Company as Security’s Inflection Point & Human Breaking Point Collide - Kriss Stephen - BSW #470