Aggregator

A vulnerability identified as problematic has been detected in ISC BIND up to 9.18.50/9.18.50-S1/9.20.27/9.20.27-S1/9.21.25. The affected element is an unknown function of the component Resolver. Performing a manipulation results in resource consumption. This vulnerability is cataloged as CVE-2026-81736. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability marked as critical has been reported in ISC BIND 9 up to 9.20.27/9.21.25/9.20.27-S1. This affects an unknown function of the component DNS-over-HTTPS. The manipulation leads to improper input validation. This vulnerability is documented as CVE-2026-77692. The attack can be initiated remotely. There is not any exploit available.

A vulnerability labeled as critical has been found in ISC BIND up to 9.21.25. Affected is an unknown function. The manipulation results in improper input validation. This vulnerability is cataloged as CVE-2026-80274. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability has been found in ISC BIND up to 9.18.50/9.18.50-S1/9.20.27/9.20.27-S1/9.21.25 and classified as problematic. The affected element is an unknown function. This manipulation causes improper input validation. This vulnerability is handled as CVE-2026-77119. The attack can be initiated remotely. There is not any exploit available.

A vulnerability categorized as critical has been discovered in ISC BIND up to 9.18.49/9.18.50-S1/9.20.26/9.20.27-S1/9.21.24. Impacted is an unknown function of the component Resolver. Such manipulation leads to resource consumption. This vulnerability is listed as CVE-2026-81563. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

本文记录了 Hack The Box 靶机 Vintage 的完整攻防渗透过程。目标处于禁用 NTLM 的纯 Kerberos 环境下，作者从初始凭据出发，利用 Pre-Windows 2000 机器账户弱口令获取域计算机权限；随后通过 LDAP 提取并解析 gMSA 托管服务账号凭据，结合 ACL 权限为无 SPN 的服务账号手工赋予 SPN 并成功实施 Targeted Kerberoasti

本文通过拆解六款智能渗透 Agent 的源码与真实执行链路，分析它们在状态管理、上下文控制、工具调用和证据约束上的工程设计与取舍。

这并非普通的输入校验遗漏，而是两条基本安全规则同时失守：认证材料的比较未采用常数时间实现，认证材料本身又被写入常规日志

Python 3.8 的 PEP 570 给函数签名引入了 positional-only 参数（`/` 语法），AST 上对应一个新字段 `posonlyargs`。RestrictedPython 的名字校验器 `check_function_argument_names()` 逐字段枚举检查了普通参数、`*args`、`**kwargs`、keyword-only 参数——唯独漏了这个新字段

IBM JCC getConnection 反序列化

通过UDRL看前置式反射DLL注入

vLLM 在 `0.26.0` 之前的两个 derender 端点会接受调用方提交的嵌套 `GenerateResponse`，并在资源边界校验前执行去分词、logprob 处理和 OpenAI 兼容响应构造。拥有相应 API 访问权限的客户端因此可用格式合法、但规模异常的 JSON 竞争 CPU、内存、响应缓冲与带宽，影响同一服务上的其他请求。

在实际渗透测试里，偶尔会碰到一种比较难受的情况：请求明明已经抓到了，但真正开始改包时，才发现它并不好下手，GWT-RPC 就是一个比较典型的例子。

Android App WebView JSBridge任意页面凭证窃取漏洞挖掘案例分析

本文以 Apache Syncope 的一个真实漏洞链为例，整理 Groovy 黑名单沙箱的三类绕过方式：解释器逃逸、运行时间接调用、反射与黑名单盲区。每种方式都会从沙箱的实现原理出发，说明绕过的切入点在哪、为什么能绕过，并给出在真实目标上的利用效果。

关于DeepSeek Harness安全问题的小研究

OWASP GenAI LLM TOP 10 2026中文译本

人看到的安全文档，对 RAG 来说不一定安全。那么当知识在 Parser、Chunk、Retrieval 之间不断被重新解释和组织时，它原本的语义和安全属性还能不能完整保留下来？

先介绍发包单线程发包（同步发包） 整条业务逻辑、组包、网络发送全部在同一个线程一次性跑完，调用完发包 call 就立刻走网络。 ① 无加密版本流程：控件 call → 功能 call1 → 功能 call2 → 组包 → 发包 控件 call：入口，触发发包事件（比如人物移动、技能、聊天这类动作入口函数） 功能 call1：业务逻辑，填充对象、校验状态、读取角色数据 功能 call2：

github 一个 sdk，存在反序列化漏洞，一步一步构造利用链复现