安全资讯归档（2026-04-18）

• 2Libra
  • openclaw 现在熄火了吗 感觉大家不咋提问题了
  • “游烟” 我不敢言
  • 一觉起来我的篡改猴插件损坏了，悲剧
  • 感谢 cnskis 的反馈，产品派已经立马更新了
  • 明日边缘（All You Need Is Kill）动画版人设有点辣眼啊
  • 社区功能的一个疑惑，关于“私信”
  • 还是有点搞不懂签到勤勉检定
• 36氪
  • FF：获4500万美元新融资
  • Meta计划于5月20日启动今年首轮大规模裁员
  • Sora负责人离职
  • 一季度全国完成水利建设投资2070亿元，同比增长4.1%
  • 上海航交所：沿海散货综合运价指数止跌回稳
  • 亚洲开发银行行长：货币和财政纪律是抵御重大外部冲击的最佳缓冲
  • 京东回应被处罚：全面接受并坚决拥护监管要求，保障食品安全和品质
  • 伯克希尔CEO阿贝尔出售前投资组合经理库姆斯管理的股票
  • 公积金使用范围再扩容
  • 国内首台，10MeV超紧凑医用回旋加速器研制成功
  • 国际海事组织：约有2万海员被困波斯湾
  • 大华股份：2025年营收超327亿元，2026年一季度业绩稳健增长
  • 我国首座海上移动式多功能措施平台“增产一号”交付
  • 智元机器人，要做AI大模型平台和开放生态
  • 智元稚晖君谈特斯拉：相比于我们有点落后 先阶段性享受领跑快乐
  • 江苏发布2026年消费品以旧换新地方自主品类补贴政策
  • 海康威视一季度营收增长11.78% 净利润同比增长36.42%
  • 海康威视增利不增收：去年净利同比增长近两成，创新业务贡献继续提升
  • 海航控股去年净利19.8亿元扭亏为盈，四家子公司实现盈利
  • 特朗普称很快发布第一批UFO文件
  • 猪价有望逐步企稳回升 全年或将呈现“前低后高、窄幅波动”特征
  • 绿城水务董事长黄东海被立案调查，公司称经营不受重大影响
  • 美国能源部将释放第三批战略石油储备
  • 美股三大指数收盘集体上涨，纳指13连涨再创新高
  • 美计划用 “猎鹰重型”火箭发射欧航局火星车
  • 老外抢着当张雪机车代理，张雪机车全球订单狂飙
  • 蔚来回应ES9仍用隐藏式门把手：完全合规
  • 迈瑞医疗：2026年利润率预计会有小幅下降，但下降幅度将显著收窄
  • 金饰价格涨到1475元
  • 霍尔木兹海峡重开 国际金银价格大涨
  • 马斯克：SpaceX和特斯拉始终是台积电的重要客户
  • 马斯克：从物理学第一原理出发，重新设计了锂提炼工艺
  • 高德动量机器人官宣将首次亮相亦庄机器人马拉松
• 404 Media
  • Babies Born from Dead Parents Will Increase with New Tech. Are We Ready?
• Ars Technica
  • $25,000 buys plenty of used EVs: Here are some options
  • Amazon won’t release Fire Sticks that support sideloading anymore
  • Ridley Scott's post-apocalyptic The Dog Stars drops first trailer
  • Russia-friendly exchange says "western special service" behind $15 million cyberattack
  • Satellite and drone images reveal big delays in US data center construction
  • Trump picks qualified, normal health leader to head CDC; experts still cautious
• Bruce's Blog
  • Fish Shell 4.6 Review: Best Interactive Shell, Wrong Default
  • Harness Engineering: Build the 6 Layers Backwards (6→1, Not 1→6)
  • Playwright CLI + Skills: 0-Token Browser Automation Pattern
• construction-physics.com
  • Reading List 04/18/2026
• daringfireball.net
  • Apple’s Developer Guidelines for Ratings and Review Prompts
  • Follow-Up Regarding App Store Reviews, Which Are Definitely Busted
• EFF
  • Keep Pushing: We Get 10 More Days to Reform Section 702
• Emergent Minds | paddo.dev
  • Son of Anton
• filfre.net
  • The Mystery of Rennes-le-Château, Part 4: Non-Fiction Meets Fiction
• gilesthomas.com
  • How an LLM becomes more coherent as we train it
• Hacker News Frontpage
  • A simplified model of Fil-C
  • All 12 moonwalkers had "lunar hay fever" from dust smelling like gunpowder
  • Flock Condemns False Child Predator Allegations, Yet Calls Critics Terrorists
  • How to Host a Blog on a Subdirectory Instead of a Subdomain
  • Hyperscalers have already outspent most famous US megaprojects
  • Landmark ancient-genome study shows surprise acceleration of human evolution
  • Migrating from DigitalOcean to Hetzner: From $1,432 to $233 With Zero Downtime
  • Show HN: Smol machines – subsecond coldstart, portable virtual machines
• HackerNoon
  • How World ID's Biggest Upgrade Replaces Device Trust With Human Continuity
• Hexacorn
  • A few more protocol handlers :), Part 2
• idiallo.com
  • We Are All Playing Politics at Work
• johndcook.com
  • 4-bit floating point FP4
  • Gaussian distributed weights for LLMs
• NetSPI Blog
  • Auditing Salesforce Permission Hierarchies with ForceHound
  • Walking Through an Attack Path with ForceHound
• Product Hunt
  • Grok Voice API
• ProjectDiscovery.io | Blog
  • Neo v. DIY: The gap between a single finding and a mature security program
• PwnDefend
  • Using AI in a positive (non scary) way
• Schneier on Security
  • Friday Squid Blogging: New Giant Squid Video
• Sebastian Raschka
  • My Workflow for Understanding LLM Architectures
• Security Affairs
  • Microsoft Defender under attack as three zero-days, two of them still unpatched, enable elevated access
• simonwillison.net
  • Adding a new content type to my blog-to-newsletter tool
• Sploitus.com Exploits RSS Feed
  • bounty-stack exploit
  • CVE-2026-27542-CVE-2026-27540- exploit
  • Exploit for CVE-2025-13342 exploit
  • Exploit for CVE-2025-14364 exploit
  • Exploit for CVE-2025-2563 exploit
  • Exploit for CVE-2025-49901 exploit
  • Exploit for CVE-2026-1492 exploit
  • Exploit for CVE-2026-1937 exploit
  • Exploit for CVE-2026-39808 exploit
  • Exploit for CVE-2026-39987 exploit
  • Exploit for Deserialization of Untrusted Data in Facebook React exploit
  • Exploit for Missing Authentication for Critical Function in Nginxui Nginx_Ui exploit
  • Exploit for Path Traversal in Python exploit
  • Exploit for SQL Injection in Cmsmadesimple Cms_Made_Simple exploit
  • hackingtool-kit exploit
  • mt6893-security-research exploit
  • sqli-research exploit
  • xsspayloads exploit
• TechCrunch
  • Anthropic’s relationship with the Trump administration seems to be thawing
  • Chef Robotics escaped the robot cooking graveyard and says it’s thriving — here’s why
  • Gigs turns your concert history into a personal live music archive
  • Hackers are abusing unpatched Windows security flaws to hack into organizations
  • Kevin Weil and Bill Peebles exit OpenAI as company continues to shed ‘side quests’
  • Man who hacked US Supreme Court filing system sentenced to probation
  • Once close enough for an acquisition, Stripe and Airwallex are now going after each other
  • Sam Altman’s project World looks to scale its human verification empire. First stop: Tinder.
  • Sources: Cursor in talks to raise $2B+ at $50B valuation as enterprise growth surges
  • The App Store is booming again, and AI may be why
  • Zoom teams up with World to verify humans in meetings
  • “Tokenmaxxing” is making developers less productive than they think
• The Decoder
  • Alibaba's open model Qwen3.6 leads Google's Gemma 4 across agentic coding benchmarks
  • Anthropic CEO Amodei declares "there is no end to the rainbow" for AI scaling
  • ChatGPT bleeds market share as Claude posts explosive monthly growth
  • Deepseek reportedly seeks outside funding for the first time at $10 billion valuation
  • Google Deepmind's Gemini Robotics-ER 1.6 gives robots a sharper brain for planning and perception
  • Google finds new ways to keep you from ever visiting a website directly again
  • Just ten minutes of using AI as an answer machine can measurably erode problem-solving skills, new study finds
  • OpenAI loses three executives in one swoop as restructuring reshapes its product lineup
  • Self-improving AI startup Recursive Superintelligence pulls in $500 million just four months after founding
  • The myth of Claude Mythos crumbles as small open models hunt the same cybersecurity bugs Anthropic showcased
  • The White House weighs whether Anthropic's Mythos is too valuable for the federal government to refuse
• The Verge
  • Anthropic’s new cybersecurity model could get it back in the government’s good graces
  • Betting on the news raises ethical questions for journalists
  • Dyson’s handheld fan is more powerful and louder than I expected
  • OpenAI’s former Sora boss is leaving
  • Should you stare into Sam Altman’s orb before your next date?
  • This charming gadget writes bad AI poetry
• Threatninja.net
  • Hack The Box: Airtouch Mahcine Walkthrough – Medium Diffiiculty
• VulDB Recent Entries
  • CVE-2025-65104 | FirebirdSQL Firebird up to 3.x information disclosure (GHSA-mfpr-9886-xjhg)
  • CVE-2026-0894 | vanderwijk Content Blocks Plugin up to 3.3.9 on WordPress Custom Post Widget content_block cross site scripting
  • CVE-2026-1559 | Youzify Plugin up to 1.3.6 on WordPress checkin_place_id cross site scripting
  • CVE-2026-1838 | prasunsen Hostel Plugin up to 1.1.6 on WordPress Shortcode shortcode_id cross site scripting
  • CVE-2026-2434 | poporon Pz-LinkCard Plugin up to 2.5.8.1 on WordPress Shortcode blogcard cross site scripting
  • CVE-2026-2505 | elzahlan Categories Images Plugin up to 3.3.1 on WordPress Shortcode z_taxonomy_image cross site scripting
  • CVE-2026-27890 | FirebirdSQL Firebird up to 3.0.13/4.0.6/5.0.3 grow size memory corruption (GHSA-6crx-4g37-7j49)
  • CVE-2026-28212 | FirebirdSQL Firebird up to 3.0.13/4.0.6/5.0.3 Packet SDL_info null pointer dereference (GHSA-9884-9qm3-hqch)
  • CVE-2026-28214 | FirebirdSQL Firebird up to 3.0.13/4.0.6/5.0.3 Batch getClumpletSize integer overflow (GHSA-7cq5-994r-jhrf)
  • CVE-2026-28224 | FirebirdSQL Firebird up to 3.0.13/4.0.6/5.0.3 op_crypt_key_callback null pointer dereference (GHSA-xrcw-wpjx-pr95)
  • CVE-2026-32105 | neutrinolabs xrdp up to 0.10.5 Message xrdp.ini integrity check
  • CVE-2026-32107 | neutrinolabs xrdp up to 0.10.5 dropped privileges (GHSA-p5m6-7m43-pjv9)
  • CVE-2026-32623 | neutrinolabs xrdp up to 0.10.5 NeutrinoRDP heap-based overflow (GHSA-phw3-qp59-x2v4)
  • CVE-2026-32624 | neutrinolabs xrdp up to 0.10.5 Domain Name xrdp.ini domain_user_separator heap-based overflow (GHSA-7q2g-6fjr-h6pp)
  • CVE-2026-33145 | neutrinolabs xrdp up to 0.10.5 AlternateShell os command injection
  • CVE-2026-33337 | FirebirdSQL Firebird up to 3.0.13/4.0.6/5.0.3 Packet xdr_datum buffer overflow (GHSA-89mq-229g-x47p)
  • CVE-2026-33516 | neutrinolabs xrdp up to 0.10.5 RDP Capability Exchange out-of-bounds (GHSA-rvh9-9wm3-28c7)
  • CVE-2026-33689 | neutrinolabs xrdp up to 0.10.5 RDP Message Parser out-of-bounds
  • CVE-2026-34232 | FirebirdSQL Firebird up to 3.0.13/4.0.6/5.0.3 xdr_status_vector syntactically invalid structure
  • CVE-2026-35215 | FirebirdSQL Firebird up to 3.0.13/4.0.6/5.0.3 sdl_desc divide by zero (GHSA-g99w-prq5-29c6)
  • CVE-2026-35465 | freedomofpress securedrop-client up to 0.17.4 Archive Extraction file inclusion (GHSA-2jrc-x8fq-prvc)
  • CVE-2026-35512 | neutrinolabs xrdp up to 0.10.5 EGFX size heap-based overflow
  • CVE-2026-40282 | LabRedesCefetRJ WeGIA up to 3.6.9 Notifications cross site scripting
  • CVE-2026-40283 | LabRedesCefetRJ WeGIA up to 3.6.9 Informações Pacientes Page Nome cross site scripting (GHSA-x74c-gwj9-6cwr)
  • CVE-2026-40317 | MinecAnton209 NovumOS up to 0.23 privileges management (GHSA-xjx3-gjh9-45fm)
  • CVE-2026-40319 | Giskard-AI giskard-oss up to 1.0.2b0 Regex re.search redos (GHSA-rq2q-4r55-9877)
  • CVE-2026-40320 | Giskard-AI giskard-oss up to 1.0.2b0 Rule Template special elements used in a template engine (GHSA-7xjm-g8f4-rp26)
  • CVE-2026-40323 | succinctlabs sp1 up to 6.0.x data authenticity (GHSA-63x8-x938-vx33)
  • CVE-2026-40342 | FirebirdSQL Firebird up to 3.0.13/4.0.6/5.0.3 ENGINE Name path traversal (GHSA-7pxc-h3rv-r257)
  • CVE-2026-40346 | nocobase up to 2.0.36 server-side request forgery (GHSA-mvvv-v22x-xqwp)
  • CVE-2026-40348 | leepeuker movary up to 0.71.0 Endpoint server-url-verify server-side request forgery (GHSA-2m2v-v563-qqvj)
  • CVE-2026-40349 | leepeuker movary up to 0.71.0 Endpoint /settings/users/ authorization (GHSA-mcfq-8rx7-w25v)
  • CVE-2026-40350 | leepeuker movary up to 0.71.0 Setting /settings/users authorization (GHSA-7r3f-9fwv-p43w)
  • CVE-2026-40479 | Kimai up to 2.52.x KimaiEscape.js escapeForHtml cross site scripting (GHSA-g82g-m9vx-vhjg)
  • CVE-2026-40482 | ChurchCRM up to 7.1.x getMemberByScanString routeAndAccount sql injection (GHSA-hc37-vx3w-34fg)
  • CVE-2026-40483 | ChurchCRM up to 7.1.x Comment cross site scripting (GHSA-wjmf-w8gj-rx7g)
  • CVE-2026-40487 | gitroomhq postiz-app up to 2.21.5 cross site scripting (GHSA-44wg-r34q-hvfx)
  • CVE-2026-40489 | editorconfig editorconfig-core-c up to 0.12.10 EditorConfig Parser ec_glob stack-based overflow (GHSA-97xg-vrcq-254h)
  • CVE-2026-40518 | bytedance deer-flow Directory Creation path traversal
  • CVE-2026-40525 | volcengine OpenViking up to 0.3.8 Exposed Service api_key failing open
  • CVE-2026-40572 | MinecAnton209 NovumOS up to 0.23 privileges management (GHSA-rg7m-6vh7-f4v2)
  • CVE-2026-40582 | ChurchCRM up to 7.1.x API Endpoint /api/public/user/login authentication bypass (GHSA-8cwr-x83m-mh9x)
  • CVE-2026-40880 | Zebra Cached Mempool Verification comparison using wrong factors
  • CVE-2026-40881 | Zebra addr Message resource consumption
  • CVE-2026-41254 | Little CMS up to 2.18 CubeSize cmslut.c incorrect behavior order
  • CVE-2026-4801 | godaddy Page Builder Gutenberg Blocks Plugin up to 3.1.16 on WordPress cross site scripting
  • CVE-2026-5710 | glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Plugin Email Attachment dnd_wpcf7_posted_data path traversal
  • CVE-2026-5718 | glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 Plugin wpcf7_antiscript_file_name unrestricted upload
  • CVE-2026-6048 | dragwyb Flipbox Addon for Elementor Plugin up to 2.0.8 on WordPress custom_attributes cross site scripting
  • CVE-2026-6437 | Amazon AWS EFS CSI Driver up to 3.0.0 argument injection (GHSA-mph4-q2vm-w2pw)
• Wired
  • Asus TUF Gaming A14 (2026) Review: GPU-Less Gaming Laptop
  • Gazing Into Sam Altman’s Orb Now Proves You’re Human on Tinder
  • It Takes 2 Minutes to Hack the EU’s New Age-Verification App
  • OpenAI Executive Kevin Weil Is Leaving the Company
  • Schematik Is ‘Cursor for Hardware.’ Anthropic Wants In
  • The Best Movies to Stream This Month (April 2026)
  • Where to Shop for Vinyl Records Online (2026): Discogs, Bandcamp, Ebay
• 代码审计星球
  • 原域名已变更且将在2024年彻底废弃，请访问 https://govuln.com/news/ 查看新的RSS订阅
• 博客
  • ar and tar
  • Link Editor
• 奇客Solidot–传递最新科技情报
  • 美国科技巨头成功在欧盟法律中将数据中心环境影响列为保密信息
• 杨龙
  • Call to undefined method GuzzleHttp\Psr7\Utils::redactUserInfo()
• 爱范儿
  • 早报｜刚刚，OpenAI两位大牛离职/一季度iPhone出货量激增20%/雷军回应小米做入门车型：10万块难做好智能化
• 量子位 QbitAI
  • 魏建军发布会开炮：专属电动车平台纯粹伪命题，友商回去立马向我们学习
• 黑海洋
  • 英国大臣呼吁公众拥抱AI并启动主权AI基金