Posts of last few hours

京东押注物理 AI，冲在前面的是一群 95 后
京东 AI 的下一站：真实世界。
https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2653113681&idx=1&sn=c8202657d800cbb9bbe928dd4c0b7a67
Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation
Google has disclosed that a high-severity security flaw in its Pixel Cellular Modem has come under exploitation in the wild. The vulnerability, tracked as CVE-2026-58704 (CVSS score: 8.0), is a privilege escalation flaw. "In Cellular Modem, there is a possible permission bypass due to a logic error in the code," according to a description of the bug in the NIST National Vulnerability Database
https://thehackernews.com/2026/09/google-patches-pixel-modem-flaw-amid.html
Threat Intelligence Alone Won't Close the Exploitation Gap
A leaked credential shows up in a criminal marketplace, or a vulnerability gets a disclosure advisory, and either one can be weaponized against a real target before most security teams have triaged the alert. Attackers are combining that kind of intelligence with AI-assisted exploitation to accelerate the path from exposure to breach faster than most security programs are built to react.
https://thehackernews.com/2026/09/threat-intelligence-alone-wont-close.html
Critical ScreenConnect flaw now actively exploited in attacks
Attackers now exploit a critical-severity ConnectWise ScreenConnect vulnerability in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). [...]
https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-screenconnect-flaw/
FAST 发现极短周期、最轻双中子星系统
天文学家利用中国天眼（500 米口径球面射电望远镜，FAST）开展大规模银道面脉冲星系统性搜寻，迄今已成功发现约 900 颗新脉冲星。通过持续后续精准观测，研究讨团队识别了一颗处于紧致轨道的双中子星系统 PSRJ1856-0039。该双中子星系统轨道周期仅 2.36 小时，在人类已知双中子星系统中位列第二短。极短的轨道周期意味着两颗中子星间距极小、双星相互绕转轨道的致密程度极高，是目前已知相对论效应表现最显著的双中子星系统之一。同时该系统刷新了人类已知双中子星质量下限，整体总质量仅为 2.488 倍太阳质量，为迄今发现的总质量最轻的双中子星组合。其中可见脉冲星质量约 1.30 倍太阳质量，伴星中子星的质量约 1.19 倍太阳质量。该系统将在约 8200 万年后发生并合，最终大概率形成一颗更大质量的中子星。

https://www.solidot.org/story?sid=85396
Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks
Acronis has warned that a high-severity security flaw in its Backup plugin for cPanel and Web Host Manager (WHM) deployments has been exploited in the wild. The vulnerability, tracked as CVE-2026-87886 (CVSS score: 7.8), is described as a case of local privilege escalation due to insecure file permissions. It affects the following versions - Acronis Backup plugin for cPanel & WHM (Linux
https://thehackernews.com/2026/09/acronis-cpanel-backup-plugin.html
Agent 写稿突然“断片”？OpenViking 治好了我的内容创作焦虑
https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247522604&idx=2&sn=38a6922a7fb8711c9851a44e15582b31
从“做过”到“会做”：用 OpenViking 经验记忆构建 Agent 的进化闭环
https://mp.weixin.qq.com/s?__biz=MzI1MzYzMjE0MQ==&mid=2247522604&idx=1&sn=6ea201d826647e12047227cd3d386ba4
Из песочницы прямо в root. LiteSpeed нарушил главный принцип общего хостинга
cPanel советует обновить веб-сервер до версии 6.3.7, не полагаясь только на автообновление.
https://www.securitylab.ru/news/577440.php
【安全圈】Vite 开发服务器被大规模扫描：云凭据和 AWS / Azure 配置被直接拿走
关键词扫描🚨 F5 Labs 披露，一波针对互联网公开 Vite 开发服务器的大规模扫描活动已经在实际运行。
https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652078970&idx=3&sn=831e1e6cc470864b0321fca813a9d6e7
【安全圈】WSO2 API Manager 爆 JWT 签名绕过漏洞：伪造管理员 Token 直接拿下控制台
关键词漏洞🚨 安全研究团队 watchTowr 披露，WSO2 API Manager 及相关产品出现高危
https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652078970&idx=2&sn=1a1c65218e30a1fe49375dd00d68006d
【安全圈】WooCommerce 批发插件曝 9.8 高危漏洞：未授权上传即成 PHP Web Shell
https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652078970&idx=1&sn=79e2e22a1ea642c180b12f34e2d63115
Cohesity adds recovery capabilities for AI agents and the data they manage

Cohesity has introduced Cohesity Agent Resilience. This new Cohesity Data Cloud capability will discover, protect, and recover the infrastructure behind enterprise AI agents. A unified view of an agent and the state it depends on. (Source: Cohesity) The company outlined its vision for Autonomous Cyber Resilience, which uses agentic workflows to automate its five-step cyber resilience framework: protect data, identity, applications, and agents; help ensure recoverability in all scenarios; remediate cyber and AI threats; practice … More →

The post Cohesity adds recovery capabilities for AI agents and the data they manage appeared first on Help Net Security.

https://www.helpnetsecurity.com/2026/09/16/cohesity-agent-resilience-capability/
Mistral 与 Mozilla 合作推出 Firefox Smart Window
法国 AI 公司 Mistral 与 Mozilla 合作推出注重隐私保护的 AI 浏览助手 Firefox Smart Window(beta)。Smart Window 使用了 Mistral 的开放权重模型，能帮助用户梳理复杂搜索，记住浏览过的重要信息，根据当前标签页查找关键信息，目前主要为法国和北美用户提供服务，今年晚些时候会扩大到英国和德国用户。Smart Window 的对话内容默认不会存储在 Mozilla 的服务器上，Mistral 等合作伙伴也承诺不保留任何数据。

https://www.solidot.org/story?sid=85395
Rubrik MCP gives AI agents controlled access to security intelligence

Rubrik has announced Rubrik MCP (Model Context Protocol), giving an organization’s AI agents a secure, programmable path to Rubrik’s data, identity, and application intelligence. Support for MCP expands Rubrik AI, which is now trusted by one-third of its global customers, and unites Anthropic’s frontier models with Rubrik’s domain expertise and security guardrails—to deliver a multi-step reasoning agent engineered for critical incident response. “We are seeing rapid growth with AI, and the addition of Rubrik MCP … More →

The post Rubrik MCP gives AI agents controlled access to security intelligence appeared first on Help Net Security.

https://www.helpnetsecurity.com/2026/09/16/rubrik-mcp/
Абсолютный антирекорд компании Apple. 260+ уязвимостей и почти вся экосистема под патчами
Обновления накрыли почти всю экосистему, а macOS получила больше 200 исправлений.
https://www.securitylab.ru/news/577446.php
CenterPoint Energy confirms data breach following claims on hacking forum

CenterPoint Energy disclosed that an unauthorized third party got into customer data through one of its external systems, after online claims by a hacker that millions of records had been stolen from the company. CenterPoint Energy is a Houston-based public utility company that provides electricity and natural gas services. It serves about 7 million customers across Indiana, Minnesota, Ohio, and Texas. A hacker, posting under the alias ‘4d722e4d656f77,’ claims to have pulled 7.49 million lines … More →

The post CenterPoint Energy confirms data breach following claims on hacking forum appeared first on Help Net Security.

https://www.helpnetsecurity.com/2026/09/16/centerpoint-energy-data-breach-hacker-claims/
360深度参与昆明网安周，以实景攻防演练护航智能时代网络安全
持续探索以人工智能提升安全攻防能力
https://mp.weixin.qq.com/s?__biz=MzA4MTg0MDQ4Nw==&mid=2247586921&idx=2&sn=9b290cc4612c51b04060a39dc1ff212e
16部门指导AI安全测试揭榜 360大模型卫士获国家级测试第一
AI安全实力再获国家级实测验证
https://mp.weixin.qq.com/s?__biz=MzA4MTg0MDQ4Nw==&mid=2247586921&idx=1&sn=005a92c25dc52042af61b57e9dd0b473
Mozilla 报告称中国开放权重模型与美国前沿模型仅相差 4.4 个月
Mozilla 发表《State of Open Source AI》报告，称美国科技公司的前沿 AI 模型性能仅领先中国公司最优秀的开放权重模型 4.4 个月。由于前沿模型价格更昂贵，很多公司都将开放权重模型用于处理日常工作，将前沿模型用于处理特定工作负荷。美国闭源前沿模型优势主要在于专家级专业工作、高强度检索以及长上下文。 配送公司 DoorDash 将月之暗面的 Kimi 模型用于处理日常工作，将 Anthropic 的闭源模型 Fable 用于更复杂的任务。前沿模型完成一项任务的成本经常达到了最先进开放权重模型的五倍。

https://www.solidot.org/story?sid=85394

Managed ad