[每日信息流] 2026-01-14

# 每日安全资讯（2026-01-14）

- SecWiki News
  - [ ] [SecWiki News 2026-01-13 Review](http://www.sec-wiki.com/?2026-01-13)
- 奇安信攻防社区
  - [ ] [java安全最严厉的父亲-fastjson 高版本利用](https://forum.butian.net/share/4715)
- Doonsec's feed
  - [ ] [揭秘 Windows 隐藏取证证据:AutoLogger-Diagtrack-Listener.etl 的奥秘](https://mp.weixin.qq.com/s/_NumB9RqhH7vIQ-aCe3P6w)
  - [ ] [恶意软件的生存之道：监视器与辅助器组件解析](https://mp.weixin.qq.com/s/Wb_8PpnlshlA9oRGTsPNZw)
  - [ ] [分享图片](https://mp.weixin.qq.com/s/BG6xQJEyxqXEnM-sgALlIA)
  - [ ] [金刚狼1.8支持自定义程序内存加载执行](https://mp.weixin.qq.com/s/NO9uFgmbdKrYDPNhFDEUNg)
  - [ ] [OSCP/OSEP一对一私教直通车：协议保障，直通高级渗透测试专家](https://mp.weixin.qq.com/s/eRf037YUgMK00UGtI9PvHg)
  - [ ] [关系很好的2个同事被裁了，本以为是他们能力差爱摸鱼，没想到一个工资3w，一个工资2w，而且还马上找到涨薪30%的新工作，真是慕了。](https://mp.weixin.qq.com/s/XhIk8OYLEXGm1UGpHcf34Q)
  - [ ] [黑客如何反击美国移民及海关执法局（ICE）](https://mp.weixin.qq.com/s/vy7evQED0A1-5GCaXs42lA)
  - [ ] [大华智能物联管理平台evo-apigw/evo-arsm/1.0.0/ars/list接口存在SQL注入漏洞 附POC](https://mp.weixin.qq.com/s/GbmIyGNB3Gd16n9RCCyPCg)
  - [ ] [【人工智能】GM/T 0007 密码行业标准到底去了哪里？](https://mp.weixin.qq.com/s/7MXjgtwDvqY0Ez4tOHq8Ew)
  - [ ] [【安全工具】从底层突破WAF：自动化发现协议级漏洞，绕过Web防火墙](https://mp.weixin.qq.com/s/9bN76uwbuVx6Eubt0eJ4ag)
  - [ ] [【AI安全】暴击！垂域大模型的致命死穴：特种攻击](https://mp.weixin.qq.com/s/0F6g9UEQ4nXPWBQxNJgPfQ)
  - [ ] [信息搜集之边缘资产和隐形资产的发掘](https://mp.weixin.qq.com/s/391oHtoYz0ec9ww8gfxlYA)
  - [ ] [世界经济论坛联合埃森哲发布《2026年全球网络安全展望》](https://mp.weixin.qq.com/s/WwQjlQ3U4ZqG3SxY-wIkJg)
  - [ ] [全国网安标委发布《人工智能应用安全指引 总则（征求意见稿）》等4项网络安全标准实践指南](https://mp.weixin.qq.com/s/DwgX-axfhZDLBkO7Qjoumw)
  - [ ] [入侵论坛（BreachForums）遭黑客攻击：热门暗网论坛全部用户记录被曝光](https://mp.weixin.qq.com/s/7fHsHE1WnxSbT0c3IxLPOQ)
  - [ ] [年终查收入了吗？考了网安证书，这样操作可以减税！](https://mp.weixin.qq.com/s/hHbbQcU0NeOG9m-Xj3GQEw)
  - [ ] [使用burpMCP和kaliMCP自动化渗透](https://mp.weixin.qq.com/s/uV_-cHATPpRYxrfQ6cMfMw)
  - [ ] [src专项挖掘知识库](https://mp.weixin.qq.com/s/QpDkKSwG6lp1RJvKA8OKPg)
  - [ ] [【大话工控安全】工业控制系统行业知识：电力行业火力发电场景](https://mp.weixin.qq.com/s/qr-5VR20vDe56kopZ8MzVw)
  - [ ] [数据不懂用=白忙活？这门线上课教你用大数据驱动精准决策](https://mp.weixin.qq.com/s/-aQf1jt9P7OuvTHbeFMqlw)
  - [ ] [有人@你！2025年度品牌问卷调查获奖名单公布！](https://mp.weixin.qq.com/s/U95PmNG0Ne8IAMBbTM43_Q)
  - [ ] [【接口漏洞第五章第二节】API批量赋值漏洞实战：以电商折扣参数篡改为例](https://mp.weixin.qq.com/s/0Bg6aTiSrDTPu8y-zcSOjQ)
  - [ ] [【邀请函】破阵阁・网安淬锋公开赛邀您参加！现金奖、京东卡、证书已就位！](https://mp.weixin.qq.com/s/Fit-wZxjAwhlKhml6MEUjg)
  - [ ] [新的VoidLink云原生恶意软件攻击具有自删功能的Linux系统](https://mp.weixin.qq.com/s/PLal_IkP17XEh6wROmhpXg)
- paper - Last paper
  - [ ] [模仿游戏：利用大型语言模型作为聊天机器人打击基于聊天的网络犯罪](https://paper.seebug.org/3449/)
- LevelBlue Blog
  - [ ] [Secure What’s Next: How a World-Class MSSP Builds Trust and Scale for 2026](https://levelblue.com/blogs/levelblue-blog/secure-whats-next-how-a-world-class-mssp-builds-trust-and-scale-for-2026/)
- 安全客-有思想的安全新媒体
  - [ ] [科技云报到：RPA+Agent，为什么可以1+1>2？](https://www.anquanke.com/post/id/314301)
- Private Feed for M09Ic
  - [ ] [strands-agents released v1.22.0 at strands-agents/sdk-python](https://github.com/strands-agents/sdk-python/releases/tag/v1.22.0)
  - [ ] [bolucat released 202601131939 at bolucat/Archive](https://github.com/bolucat/Archive/releases/tag/202601131939)
  - [ ] [mgeeky starred nikitastupin/clairvoyance](https://github.com/nikitastupin/clairvoyance)
  - [ ] [FunnyWolf starred nextlevelbuilder/ui-ux-pro-max-skill](https://github.com/nextlevelbuilder/ui-ux-pro-max-skill)
  - [ ] [mgeeky starred EmilStenstrom/justhtml](https://github.com/EmilStenstrom/justhtml)
  - [ ] [ManassehZhou starred google/starlark-go](https://github.com/google/starlark-go)
  - [ ] [Mr-xn forked Mr-xn/PicList from Kuingsmile/PicList](https://github.com/Mr-xn/PicList)
  - [ ] [FunnyWolf starred bytedance/UI-TARS-desktop](https://github.com/bytedance/UI-TARS-desktop)
  - [ ] [timwhitez starred vercel-labs/agent-browser](https://github.com/vercel-labs/agent-browser)
  - [ ] [PrefectHQ released 3.6.11.dev3 at PrefectHQ/prefect](https://github.com/PrefectHQ/prefect/releases/tag/3.6.11.dev3)
  - [ ] [CHYbeta starred ihower/zh-tw-embedding-model-benchmark](https://github.com/ihower/zh-tw-embedding-model-benchmark)
  - [ ] [ourren starred sansan0/TrendRadar](https://github.com/sansan0/TrendRadar)
- 嘶吼 RoarTalk – 网络安全行业综合服务平台,4hou.com
  - [ ] [嘶吼快讯|网安厂商动态汇（第3期）](https://www.4hou.com/posts/xypE)
  - [ ] [云文件共享平台成为企业数据盗窃攻击的目标](https://www.4hou.com/posts/0MwV)
- Tenable Blog
  - [ ] [Microsoft’s January 2026 Patch Tuesday Addresses 113 CVEs (CVE-2026-20805)](https://www.tenable.com/blog/microsofts-january-2026-patch-tuesday-addresses-113-cves-cve-2026-20805)
- Recent Commits to cve:main
  - [ ] [Update Tue Jan 13 11:39:37 UTC 2026](https://github.com/trickest/cve/commit/76bff21d5d61c186b96d00cc086d519e646584b3)
- Microsoft Security Blog
  - [ ] [How Microsoft builds privacy and security to work hand-in-hand](https://www.microsoft.com/en-us/security/blog/2026/01/13/how-microsoft-builds-privacy-and-security-to-work-hand-in-hand/)
- Sucuri Blog
  - [ ] [Malware Intercepts Googlebot via IP-Verified Conditional Logic](https://blog.sucuri.net/2026/01/malware-intercepts-googlebot-via-ip-verified-conditional-logic.html)
- ElcomSoft blog
  - [ ] [Browser Forensics in 2026: App-Bound Encryption and Live Triage](https://blog.elcomsoft.com/2026/01/browser-forensics-in-2026-app-bound-encryption-and-live-triage/)
- 美团技术团队
  - [ ] [KuiTest：基于大模型通识的 UI 交互遍历测试](https://tech.meituan.com/2026/01/13/kuitest-ui.html)
- Horizon3.ai
  - [ ] [CVE-2025-64155 | Fortinet FortiSIEM](https://horizon3.ai/attack-research/vulnerabilities/cve-2025-64155-fortinet-fortisiem/)
  - [ ] [CVE-2025-64155: Three Years of Remotely Rooting the Fortinet FortiSIEM](https://horizon3.ai/attack-research/disclosures/cve-2025-64155-three-years-of-remotely-rooting-the-fortinet-fortisiem/)
  - [ ] [Horizon3.ai Secures Investment from Prosperity7 Ventures to Protect AI Datacenters and Critical Infrastructure](https://horizon3.ai/news/press-release/prosperity7-ai-infrastructure/)
- CCC Event Blog
  - [ ] [39C3: Feedback and lost+found](https://events.ccc.de/2026/01/13/39c3-lost-found/)
- Malwarebytes
  - [ ] [Data broker fined after selling Alzheimer’s patient info and millions of sensitive profiles](https://www.malwarebytes.com/blog/news/2026/01/data-broker-fined-after-selling-alzheimers-patient-info-and-millions-of-sensitive-profiles)
  - [ ] [Why iPhone users should update and restart their devices now](https://www.malwarebytes.com/blog/news/2026/01/why-iphone-users-should-update-and-restart-their-devices-now)
- The Trail of Bits Blog
  - [ ] [Lack of isolation in agentic browsers resurfaces old vulnerabilities](https://blog.trailofbits.com/2026/01/13/lack-of-isolation-in-agentic-browsers-resurfaces-old-vulnerabilities/)
- LevelBlue SpiderLabs Blog
  - [ ] [BEC Email Trends: Attacks up 15% in 2025](https://levelblue.com/blogs/spiderlabs-blog/bec-email-trends-attacks-up-15-in-2025/)
- Bug Bounty in InfoSec Write-ups on Medium
  - [ ] [When a Checkout Page Leaks Your Session](https://infosecwriteups.com/when-a-checkout-page-leaks-your-session-f08885668ae7?source=rss----7b722bfd1b8d--bug_bounty)
  - [ ] [Bypassing SSRF Protections: A $10,000 Lesson from Slack](https://infosecwriteups.com/bypassing-ssrf-protections-a-10-000-lesson-from-slack-6cff022a44a6?source=rss----7b722bfd1b8d--bug_bounty)
- rtl-sdr.com
  - [ ] [GhostHunter (Anti-LIF): Using Spiking Neural Networks to Rescue Satellite Signals Drowned in Noise](https://www.rtl-sdr.com/ghosthunter-anti-lif-using-spiking-neural-networks-to-rescue-satellite-signals-drowned-in-noise/)
  - [ ] [Echo – A Native iOS Client for KiwiSDR & OpenWebRX](https://www.rtl-sdr.com/echo-a-native-ios-client-for-kiwisdr-openwebrx/)
  - [ ] [Guglielmo FM and DAB Receiver Software Updated to Version 0.7](https://www.rtl-sdr.com/guglielmo-fm-and-dab-receiver-software-updated-to-version-0-7/)
- 奇客Solidot–传递最新科技情报
  - [ ] [伊朗搜查和收缴 Starlink 设备](https://www.solidot.org/story?sid=83291)
  - [ ] [中文用户的脑机接口](https://www.solidot.org/story?sid=83290)
  - [ ] [Google 对为何没有下架 Grok 应用拒绝置评](https://www.solidot.org/story?sid=83289)
  - [ ] [挪威电动汽车销量占到了总销量的 97%](https://www.solidot.org/story?sid=83288)
  - [ ] [苹果选择 Gemini 驱动 Siri](https://www.solidot.org/story?sid=83287)
- bishopfox.com
  - [ ] [The Total Cost of AI Ownership: The Costs Not on Your Budget Sheet](https://bishopfox.com/blog/the-total-cost-of-ai-ownership-the-costs-not-on-your-budget-sheet)
- HackerNews
  - [ ] [2500 美元，能买到多少国家秘密？ 800 万份政府记录疑似在黑客论坛售卖](https://hackernews.cc/archives/62236)
  - [ ] [Apache Struts 2 关键漏洞允许攻击者窃取敏感数据](https://hackernews.cc/archives/62234)
  - [ ] [威胁行为者据称声称掌握包含 78,541,207 个文件的 Discord 数据集](https://hackernews.cc/archives/62232)
  - [ ] [Telegram 暴露用户真实IP地址，可一键绕过 Android 和 iOS 代理](https://hackernews.cc/archives/62230)
  - [ ] [GoBruteforcer 僵尸网络利用弱凭证攻击加密货币项目数据库](https://hackernews.cc/archives/62228)
- Security Blog | Praetorian
  - [ ] [Exploiting LLM Write Primitives: System Prompt Extraction When Chat Output Is Locked Down](https://www.praetorian.com/blog/exploiting-llm-write-primitives-system-prompt-extraction-when-chat-output-is-locked-down/)
- 安全分析与研究
  - [ ] [伪装成火绒安装包银狐最新攻击样本分析](https://mp.weixin.qq.com/s?__biz=MzA4ODEyODA3MQ==&mid=2247495343&idx=1&sn=15236965950a95eb46e4281cf7dacd01)
- 腾讯玄武实验室
  - [ ] [每日安全动态推送(26/1/13)](https://mp.weixin.qq.com/s?__biz=MzA5NDYyNDI0MA==&mid=2651960357&idx=1&sn=587a4de36ff6f1d3339e74ef01d0511e)
- 绿盟科技技术博客
  - [ ] [彻底删除指定打印机](https://blog.nsfocus.net/%e5%bd%bb%e5%ba%95%e5%88%a0%e9%99%a4%e6%8c%87%e5%ae%9a%e6%89%93%e5%8d%b0%e6%9c%ba/)
- 黑鸟
  - [ ] [黑客如何反击美国移民及海关执法局（ICE）](https://mp.weixin.qq.com/s?__biz=MzAxOTM1MDQ1NA==&mid=2451184798&idx=1&sn=42b4500c87467cc40e6c796c82d4237b)
- 青衣十三楼飞花堂
  - [ ] [青衣十三楼技术文档离线包](https://mp.weixin.qq.com/s?__biz=MzUzMjQyMDE3Ng==&mid=2247488959&idx=1&sn=132711294eb1bde19e371223c60306e3)
- 雷神众测
  - [ ] [雷神众测漏洞周报2026.1.5-2026.1.11](https://mp.weixin.qq.com/s?__biz=MzI0NzEwOTM0MA==&mid=2652503684&idx=1&sn=ff960cdd5ce6f5c6e73c4cfc426d26a2)
- 安全客
  - [ ] [4 个月超9.1万次攻击，AI基础设施成自动化攻击新靶标](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&mid=2649789613&idx=1&sn=5fb152f4cb50fd27686f3bdee7900fff)
- 代码卫士
  - [ ] [Apache Struts 2 严重 XXE 漏洞可用于窃取敏感数据](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247524857&idx=1&sn=7d98b989a61c9b25103ccef5b0524560)
  - [ ] [React Router严重漏洞可用于访问或修改服务器文件](https://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247524857&idx=2&sn=8c1f832d3fbc13cae125177e8f0247af)
- 虎符智库
  - [ ] [AI 重构攻防，合规直达价值｜奇安信发布 2026 网络安全十大趋势](https://mp.weixin.qq.com/s?__biz=MzIwNjYwMTMyNQ==&mid=2247493677&idx=1&sn=c1eec766be6334075b9b5305d7295e76)
- 暗影安全
  - [ ] [Telegram 一键暴露用户真实 IP 地址](https://mp.weixin.qq.com/s?__biz=MzI2MzA3OTgxOA==&mid=2657165708&idx=1&sn=9405dc54d6690ea497eee0e0f9242d64)
- 威努特安全网络
  - [ ] [当数字孪生遇上智能制造：威努特的“智算防护”实践](https://mp.weixin.qq.com/s?__biz=MzAwNTgyODU3NQ==&mid=2651139593&idx=1&sn=71f4248fef456f53be8c57543bc984a1)
  - [ ] [网络攻击重创罗马尼亚火电巨头，业务运营停摆](https://mp.weixin.qq.com/s?__biz=MzAwNTgyODU3NQ==&mid=2651139488&idx=1&sn=5b8399c9deaf0373d128325509b71eda)
- 二道情报贩子
  - [ ] [我在一部碎屏安卓手机上自学了编程，现在却找不到工作。](https://mp.weixin.qq.com/s?__biz=MzU5NTA3MTk5Ng==&mid=2247489972&idx=1&sn=c0c0f465178aa5fe95baae3df887f582)
- 绿盟科技研究通讯
  - [ ] [全球云上数据泄露风险分析简报 （第九期）](https://mp.weixin.qq.com/s?__biz=MzIyODYzNTU2OA==&mid=2247499380&idx=1&sn=758aec1de6189ff0110dac08780f75db)
- 安全内参
  - [ ] [布局新一代安全！网安巨头Palo Alto推出氛围编程防护框架](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247515456&idx=1&sn=102fc60270ba31db0efd3f5e7b986597)
  - [ ] [美国针对委内瑞拉行动表明网络干扰已成为“灰色地带”斗争手段](https://mp.weixin.qq.com/s?__biz=MzI4NDY2MDMwMw==&mid=2247515456&idx=2&sn=3bbaa09735ed3648d60f9de35cbbd2f3)
- 绿盟科技CERT
  - [ ] [【漏洞通告】Apache Struts外部实体(XXE)注入漏洞S2-069（CVE-2025-68493）](https://mp.weixin.qq.com/s?__biz=Mzk0MjE3ODkxNg==&mid=2247489472&idx=1&sn=db2067a5b796dfec6e3aadef74bb9c40)
- 天御攻防实验室
  - [ ] [美国网络司令部在“绝对决心行动”中角色（三）](https://mp.weixin.qq.com/s?__biz=MzU0MzgyMzM2Nw==&mid=2247486671&idx=1&sn=a9bd5f06ee6993de784010789149c0ff)
- 安全研究GoSSIP
  - [ ] [G.O.S.S.I.P 阅读推荐 2026-01-13 十三年零漏洞的密码学算法库，翻车了？](https://mp.weixin.qq.com/s?__biz=Mzg5ODUxMzg0Ng==&mid=2247501261&idx=1&sn=15aa1c7063a90bda5c4aafac96d211c5)
- 看雪学苑
  - [ ] [《Linux Pwn 番外篇》重磅上线！6大架构全覆盖，异构漏洞利用5h学透](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458607943&idx=1&sn=5fcf7ec92bff6761d0d98524fa5e166a)
  - [ ] [庖丁解牛之——Windows DTrace实现原理](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458607943&idx=2&sn=3d1a71c603bd1a873c2a0a55cbc09b98)
  - [ ] [黑客叫卖Target内部源码，零售商紧急下架并关闭Git服务器](https://mp.weixin.qq.com/s?__biz=MjM5NTc2MDYxMw==&mid=2458607943&idx=3&sn=9853ea45411c50152c5a871e9d476d7c)
- 安全圈
  - [ ] [【安全圈】河南省考报名系统高峰时段崩溃](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652073695&idx=1&sn=14a84617c207be6b51cea6574f210d58)
  - [ ] [【安全圈】知名黑客论坛数据库泄露！逾32万名用户数据被公开](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652073695&idx=2&sn=62a46a42e6435c6d3c12e63e2f5a0d27)
  - [ ] [【安全圈】Telegram 暴露用户真实IP地址，可一键绕过 Android 和 iOS 代理](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652073695&idx=3&sn=4658cd602aecc29e2466f392d21b54a4)
  - [ ] [【安全圈】GoBruteforcer 僵尸网络利用弱凭证攻击加密货币项目数据库](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652073695&idx=4&sn=080d75ef27ce9b31399927cffaf20808)
- 中国信息安全
  - [ ] [论坛·算法治理 | 智能算法安全治理技术体系构建的探索与实践](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664257371&idx=1&sn=12e7a8ee24b742de7db7b7025ba1fb80)
  - [ ] [国家安全部提示：警惕国家基础性测绘信息外泄](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664257371&idx=2&sn=81593b61a3a4c41c6561a4191e14b26c)
  - [ ] [专家解读 | 强化数据科技创新赋能，构筑数字经济发展新引擎——《关于加强数据科技创新的实施意见》政策解读](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664257371&idx=3&sn=f184edfffe7f82c9caa2751ce204e612)
  - [ ] [观点 | 准确把握人工智能健康有序发展的三维坐标](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664257371&idx=4&sn=c3ae2cfc3598f38ba54b103a63da456b)
  - [ ] [评论 | AI魔改乱象需标本兼治](https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664257371&idx=5&sn=730437f2929cd340c17a00182c2fcc5b)
- 补天平台
  - [ ] [【GROW计划年度榜单】校园白帽黑客变身专业志愿者，补天GROW计划打造"公益+能力"双增长模式](https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247510060&idx=1&sn=74f2b6cf588833a0deb875ed9a86909d)
- 微步在线
  - [ ] [被黑产拉群？微步免费帮忙！](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650185384&idx=1&sn=4e6185e99f8038dc992c1db1352da181)
  - [ ] [微步荣膺产业贡献与AI安全智能体领航者两项大奖](https://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650185384&idx=2&sn=962e66b58e4855a3a8511570ec4c646e)
- 安全牛
  - [ ] [从智谱、MiniMax、Manus看国内AI市场的资本逻辑](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651140108&idx=1&sn=f023f2aee76196a5004f414843424552)
  - [ ] [网安标委发布《网络安全标准实践指南——人工智能加速芯片安全功能技术规范》：网络钓鱼成头号威胁：企业如何防御新型AI驱动欺诈？| 牛览](https://mp.weixin.qq.com/s?__biz=MjM5Njc3NjM4MA==&mid=2651140108&idx=2&sn=befc70d14f6e77b8b8beea96bc5fba31)
- 火绒安全
  - [ ] [U盘文件突然“消失”？这样解决超管用！](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247529891&idx=1&sn=01a2a1186af3d614783b962722c40147)
  - [ ] [诚邀渠道合作伙伴共启新征程](https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247529891&idx=2&sn=e071f579329aea33923d80d4956fb3ab)
- 极客公园
  - [ ] [发布 ChatGPT 健康 6 天后，OpenAI 在自家医疗健康 Benchmark 上被反超](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2653097118&idx=1&sn=29940fcd1727a9d8afed045f7b78ce16)
  - [ ] [Alphabet 成第四家四万亿美元公司；德亚官网偷跑大疆 Pocket 4；国内首起 AI 服务涉黄案二审在即 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2653097107&idx=1&sn=0eb4e14ceac1eaf580a3045a71f45a3f)
- 字节跳动安全中心
  - [ ] [飞连2026，成为AI时代最好的办公安全平台](https://mp.weixin.qq.com/s?__biz=MzUzMzcyMDYzMw==&mid=2247495995&idx=1&sn=e92cd52cac1f400b1ba0a26ea2e7db45)
- 嘶吼专业版
  - [ ] [云文件共享平台逐渐成为企业数据盗窃攻击的目标](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247586326&idx=1&sn=b5bfee8ba7ced6cdcef964a3f09d8623)
  - [ ] [嘶吼快讯|网安厂商动态汇（第3期）](https://mp.weixin.qq.com/s?__biz=MzI0MDY1MDU4MQ==&mid=2247586326&idx=2&sn=bc1168abb3f6009f6066845f54b13485)
- 黑伞安全
  - [ ] [【网安圈大事件】破阵阁・网安淬锋公开赛开打！全国高手速来！](https://mp.weixin.qq.com/s?__biz=MzU0MzkzOTYzOQ==&mid=2247489912&idx=1&sn=6c6dfac64239afcdf2bb57ba4406b6d2)
- 360Quake空间测绘
  - [ ] [360独家分析：2026伊朗全国性断网事件背后的数字防御启示](https://mp.weixin.qq.com/s?__biz=Mzk0NzE4MDE2NA==&mid=2247487966&idx=1&sn=32321e8b27c33862461b58f6cf30060a)
- 斗象智能安全
  - [ ] [你的智能挖洞搭档，已上线！| 蛙池AI内测邀请码派送中](https://mp.weixin.qq.com/s?__biz=MzIwMjcyNzA5Mw==&mid=2247495277&idx=1&sn=449f3623cd210c2de5444973c960c055)
- 数世咨询
  - [ ] [防火墙成本将在2026年暴涨](https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247541429&idx=1&sn=44244b2a0e0e5464c5b00bc4ddee86f9)
- 情报分析师
  - [ ] [开源情报揭露深度伪装人物画像，间谍“玛丽亚”的双面人生](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650566203&idx=1&sn=a73121eb47767cf8c984fe3daa37e799)
  - [ ] [近期热点研判](https://mp.weixin.qq.com/s?__biz=MzA3Mjc1MTkwOA==&mid=2650566203&idx=2&sn=f93506ec7edaf1ed4f84f23eb7317c97)
- 软件安全与逆向分析
  - [ ] [redex中文技术手册](https://mp.weixin.qq.com/s?__biz=MzU3MTY5MzQxMA==&mid=2247484995&idx=1&sn=192ff6cee29c7bf92558f0881bfdb623)
- Qualys Security Blog
  - [ ] [Microsoft Patch Tuesday, January 2026 Security Update Review](https://blog.qualys.com/category/vulnerabilities-threat-research)
- 360数字安全
  - [ ] [18家权威机构联合背书！360入选国家级数据安全产品目录](https://mp.weixin.qq.com/s?__biz=MzA4MTg0MDQ4Nw==&mid=2247584572&idx=1&sn=d8363bdce311ea02c6ceffddcfd9e799)
  - [ ] [360独家分析：2026伊朗全国性断网事件背后的数字防御启示](https://mp.weixin.qq.com/s?__biz=MzA4MTg0MDQ4Nw==&mid=2247584572&idx=2&sn=1c760dccc547ac0754573527df7e0b8e)
- 迪哥讲事
  - [ ] [越权和敏感信息泄露所导致的高危](https://mp.weixin.qq.com/s?__biz=MzIzMTIzNTM0MA==&mid=2247498919&idx=1&sn=ead83e0cbd0c4ae54124f706a8222d61)
- Over Security - Cybersecurity news aggregator
  - [ ] [Ukraine's army targeted in new charity-themed malware campaign](https://www.bleepingcomputer.com/news/security/ukraines-army-targeted-in-new-charity-themed-malware-campaign/)
  - [ ] [New VoidLink malware framework targets Linux cloud servers](https://www.bleepingcomputer.com/news/security/new-voidlink-malware-framework-targets-linux-cloud-servers/)
  - [ ] [More than 40 countries impacted by North Korea IT worker scams, crypto thefts](https://therecord.media/40-countries-impacted-nk-it-thefts-united-nations)
  - [ ] [Tennessee man to plead guilty to hacking Supreme Court’s electronic case filing system](https://therecord.media/guilty-plea-hacking-supreme-court-case-filing-system)
  - [ ] [Central Maine Healthcare breach exposed data of over 145,000 people](https://www.bleepingcomputer.com/news/security/central-maine-healthcare-breach-exposed-data-of-over-145-000-people/)
  - [ ] [Belgian hospital AZ Monica shuts down servers after cyberattack](https://www.bleepingcomputer.com/news/security/belgian-hospital-az-monica-shuts-down-servers-after-cyberattack/)
  - [ ] [Ukraine parliament approves resignation of security service chief in major reshuffle](https://therecord.media/ukraine-parliament-approves-resignation-sbu-chief)
  - [ ] [New Windows updates replace expiring Secure Boot certificates](https://www.bleepingcomputer.com/news/security/microsoft-rolls-out-new-secure-boot-certificates-for-windows-devices/)
  - [ ] [Man to plead guilty to hacking US Supreme Court filing system](https://techcrunch.com/2026/01/13/man-to-plead-guilty-to-hacking-us-supreme-court-filing-system/)
  - [ ] [Target employees confirm leaked source code is authentic](https://www.bleepingcomputer.com/news/security/target-employees-confirm-leaked-source-code-is-authentic/)
  - [ ] [Windows 11 KB5074109 & KB5073455 cumulative updates released](https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5074109-and-kb5073455-cumulative-updates-released/)
  - [ ] [Microsoft releases Windows 10 KB5073724 extended security update](https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-10-kb5073724-extended-security-update/)
  - [ ] [Microsoft January 2026 Patch Tuesday fixes 3 zero-days, 114 flaws](https://www.bleepingcomputer.com/news/microsoft/microsoft-january-2026-patch-tuesday-fixes-3-zero-days-114-flaws/)
  - [ ] [Microsoft Patch Tuesday for January 2026 — Snort rules and prominent vulnerabilities](https://blog.talosintelligence.com/microsoft-patch-tuesday-january-2026/)
  - [ ] [Google confirms Android bug causing volume key issues](https://www.bleepingcomputer.com/news/google/google-confirms-android-bug-causing-volume-key-issues/)
  - [ ] [Tp-Link Router Deep Research](https://r0keb.github.io/posts/Tp-Link-Router-Deep-Research/)
  - [ ] [majd/ipatool: Command-line tool that allows searching and downloading app packages (known as ipa files) from the iOS App Store](https://github.com/majd/ipatool)
  - [ ] [Android recon for Bug Bounty hunters: A complete guide](https://www.yeswehack.com/learn-bug-bounty/android-recon-bug-bounty-guide)
  - [ ] [Senior military cyber operator removed from Russia task force](https://therecord.media/senior-military-cyber-op-removed-russia-task-force)
  - [ ] [Security Research in the Age of AI Tools](https://www.invicti.com/blog/security-labs/security-research-in-the-age-of-ai-tools)
  - [ ] [Betterment confirms data breach after wave of crypto scam emails](https://www.bleepingcomputer.com/news/security/betterment-confirms-data-breach-after-wave-of-crypto-scam-emails/)
  - [ ] [NIS2, AI Act, CRA: perché il 2026 segna una svolta per la sicurezza cyber](https://www.cybersecurity360.it/legal/nis2-ai-act-cra-perche-il-2026-segna-una-svolta-per-la-sicurezza-cyber/)
  - [ ] [Privilegi di accesso e identità alimentate dall’AI: rischi e mitigazioni](https://www.cybersecurity360.it/news/privilegi-di-accesso-e-identita-alimentate-dallai-rischi-e-mitigazioni/)
  - [ ] [Suspected ransomware attack threatens one of South Korea’s largest companies](https://therecord.media/kyowon-group-south-korea-suspected-ransomware-attack)
  - [ ] [Kremlin-linked hackers pose as charities to spy on Ukraine’s military](https://therecord.media/kremlin-linked-hackers-pose-as-charities-spy-ukraine)
  - [ ] [Allarme password aziendali deboli: più del 40% è violabile in meno di un’ora](https://www.securityinfo.it/2026/01/13/allarme-password-aziendali-deboli-piu-del-40-e-violabile-in-meno-di-unora/)
  - [ ] [Convincing LinkedIn comment-reply tactic used in new phishing](https://www.bleepingcomputer.com/news/security/convincing-linkedin-comment-reply-tactic-used-in-new-phishing/)
  - [ ] [Asset management: perché l’IT non deve essere l’asset owner e come farlo bene](https://www.cybersecurity360.it/soluzioni-aziendali/asset-management-perche-lit-non-deve-essere-lasset-owner-e-come-farlo-bene/)
  - [ ] [Target employees confirm leaked code after ‘accelerated’ Git lockdown](https://www.bleepingcomputer.com/news/security/target-employees-confirm-leaked-code-after-accelerated-git-lockdown/)
  - [ ] [Wraps - AWS Email Pricing with Modern Developer Experience](https://wraps.dev/blog/your-dmarc-policy-is-useless)
  - [ ] [Report annuale Polizia Postale 2025: la normalità dell’attacco, il dovere della resilienza](https://www.cybersecurity360.it/news/report-annuale-polizia-postale-2025-la-normalita-dellattacco-il-dovere-della-resilienza/)
  - [ ] [Quando un incidente cyber smette di essere un problema tecnico e diventa di interesse pubblico](https://www.cybersecurity360.it/legal/quando-un-incidente-cyber-smette-di-essere-un-problema-tecnico-e-diventa-di-interesse-pubblico/)
  - [ ] [CastleLoader: A Deep Dive into Stealthy Loader Targeting Government Sector](https://any.run/cybersecurity-blog/castleloader-malware-analysis/)
  - [ ] [deVixor: An Evolving Android Banking RAT with Ransomware Capabilities Targeting Iran](https://cyble.com/blog/devixor-an-evolving-android-banking-rat-with-ransomware-capabilities-targeting-iran/)
- Securityinfo.it
  - [ ] [Allarme password aziendali deboli: più del 40% è violabile in meno di un’ora](https://www.securityinfo.it/2026/01/13/allarme-password-aziendali-deboli-piu-del-40-e-violabile-in-meno-di-unora/?utm_source=rss&utm_medium=rss&utm_campaign=allarme-password-aziendali-deboli-piu-del-40-e-violabile-in-meno-di-unora)
- IT Service Management News
  - [ ] [Articolo 2086 del Codice Civile, sicurezza delle informazioni e continuità](http://blog.cesaregallotti.it/2026/01/articolo-2086-del-codice-civile.html)
- T00ls安全
  - [ ] [EDUSRC × T00ls 达成战略合作，开启“精英白帽”进阶直通车](https://mp.weixin.qq.com/s?__biz=Mzg3NzYzODU5NQ==&mid=2247485636&idx=1&sn=9859af74bca98acf8f54e62fa9073397)
- Troy Hunt's Blog
  - [ ] [Who Decides Who Doesn’t Deserve Privacy?](https://www.troyhunt.com/who-decides-who-doesnt-deserve-privacy/)
- Tor Project blog
  - [ ] [New Release: Tor Browser 15.0.4](https://blog.torproject.org/new-release-tor-browser-1504/)
  - [ ] [Arti 1.9.0 released: Proxy improvements, relay development, and more.](https://blog.torproject.org/arti_1_9_0_released/)
- SANS Internet Storm Center, InfoCON: green
  - [ ] [January 2026 Microsoft Patch Tuesday Summary, (Tue, Jan 13th)](https://isc.sans.edu/diary/rss/32624)
  - [ ] [ISC Stormcast For Tuesday, January 13th, 2026 https://isc.sans.edu/podcastdetail/9764, (Tue, Jan 13th)](https://isc.sans.edu/diary/rss/32622)
- bellingcat
  - [ ] [Analysing Footage of Minneapolis ICE Shooting](https://www.bellingcat.com/news/2026/01/13/analysing-footage-of-minneapolis-ice-shooting/)
- 云鼎实验室
  - [ ] [Struts2 S2-069 XXE漏洞 (CVE-2025-68493) 来袭，腾讯云主机安全RASP可自动防护](https://mp.weixin.qq.com/s?__biz=MzU3ODAyMjg4OQ==&mid=2247497101&idx=1&sn=bf9b5c37f748f072b12c6b0f8d78e2e3)
- Trend Micro Research, News and Perspectives
  - [ ] [Key Insights on SHADOW-AETHER-015 and Earth Preta from the 2025 MITRE ATT&CK Evaluation with Trend Vision One™](https://www.trendmicro.com/en_us/research/26/a/shadow-aether-015-earth-preta-mitre.html)
- The Register - Security
  - [ ] [Popular Python libraries used in Hugging Face models subject to poisoned metadata attack](https://go.theregister.com/feed/www.theregister.com/2026/01/13/ai_python_library_bugs_allow/)
  - [ ] [AI and automation could erase 10.4 million US roles by 2030](https://go.theregister.com/feed/www.theregister.com/2026/01/13/ai_us_jobs_2030/)
  - [ ] [Dutch cops cuff alleged AVCheck malware kingpin in Amsterdam](https://go.theregister.com/feed/www.theregister.com/2026/01/13/avcheck_arrest/)
  - [ ] [Federal agencies told to fix or ditch Gogs as exploited zero-day lands on CISA hit list](https://go.theregister.com/feed/www.theregister.com/2026/01/13/cisa_gogs_exploit/)
  - [ ] [Mandiant open sources tool to prevent leaky Salesforce misconfigs](https://go.theregister.com/feed/www.theregister.com/2026/01/13/mandiant_salesforce_tool/)
  - [ ] [Court tosses appeal by hacker who opened port to coke smugglers with malware](https://go.theregister.com/feed/www.theregister.com/2026/01/13/dutch_port_hacker_appeal/)
  - [ ] [Britain goes shopping for a rapid-fire missile to help Ukraine hit back](https://go.theregister.com/feed/www.theregister.com/2026/01/13/mod_project_nightfall/)
  - [ ] [India demands crypto outfits geolocate customers, get a selfie to prove they’re real](https://go.theregister.com/feed/www.theregister.com/2026/01/13/india_crypto_kyc_aml_update/)
- GRAHAM CLULEY
  - [ ] [The AI Fix #83: ChatGPT Health, Victorian LLMs, and the biggest AI bluffers](https://grahamcluley.com/the-ai-fix-83/)
  - [ ] [Hackers get hacked, as BreachForums database is leaked](https://www.bitdefender.com/en-us/blog/hotforsecurity/hackers-get-hacked-as-breachforums-database-is-leaked)
- Schneier on Security
  - [ ] [1980s Hacker Manifesto](https://www.schneier.com/blog/archives/2026/01/1980s-hacker-manifesto.html)
- TorrentFreak
  - [ ] [Court Orders Porkbun and Other Registrars to Hand Over PornXP Domains to Aylo](https://torrentfreak.com/court-orders-porkbun-and-other-registrars-to-hand-over-pornxp-domains-to-aylo/)
- Security Affairs
  - [ ] [AZ Monica hospital in Belgium shuts down servers after cyberattack](https://securityaffairs.com/186882/cyber-crime/az-monica-hospital-in-belgium-shuts-down-servers-after-cyberattack.html)
  - [ ] [Threat actor claims the theft of full customer data from Spanish energy firm Endesa](https://securityaffairs.com/186861/cyber-crime/threat-actor-claims-the-theft-of-full-customer-data-from-spanish-energy-firm-endesa.html)
  - [ ] [Dutch court convicts hacker who exploited port networks for drug trafficking](https://securityaffairs.com/186851/cyber-crime/dutch-court-convicts-hacker-who-exploited-port-networks-for-drug-trafficking.html)
- ICT Security Magazine
  - [ ] [Whistleblowing: nuove linee guida ANAC 2025 e Modello 231](https://www.ictsecuritymagazine.com/articoli/whistleblowing-anac/)
  - [ ] [Dalla Crittografia Militare a Google Workspace: la nuova frontiera digitale dell’Arma dei Carabinieri](https://www.ictsecuritymagazine.com/articoli/google-workspace-carabinieri/)
- The Hacker News
  - [ ] [Long-Running Web Skimming Campaign Steals Credit Cards From Online Checkout Pages](https://thehackernews.com/2026/01/long-running-web-skimming-campaign.html)
  - [ ] [Malicious Chrome Extension Steals MEXC API Keys by Masquerading as Trading Tool](https://thehackernews.com/2026/01/malicious-chrome-extension-steals-mexc.html)
  - [ ] [[Webinar] Securing Agentic AI: From MCPs and Tool Access to Shadow API Key Sprawl](https://thehackernews.com/2026/01/webinar-t-from-mcps-and-tool-access-to.html)
  - [ ] [New Advanced Linux VoidLink Malware Targets Cloud and container Environments](https://thehackernews.com/2026/01/new-advanced-linux-voidlink-malware.html)
  - [ ] [What Should We Learn From How Attackers Leveraged AI in 2025?](https://thehackernews.com/2026/01/what-should-we-learn-from-how-attackers.html)
  - [ ] [ServiceNow Patches Critical AI Platform Flaw Allowing Unauthenticated User Impersonation](https://thehackernews.com/2026/01/servicenow-patches-critical-ai-platform.html)
  - [ ] [New Malware Campaign Delivers Remcos RAT Through Multi-Stage Windows Attack](https://thehackernews.com/2026/01/new-malware-campaign-delivers-remcos.html)
  - [ ] [CISA Warns of Active Exploitation of Gogs Vulnerability Enabling Code Execution](https://thehackernews.com/2026/01/cisa-warns-of-active-exploitation-of.html)
- 矛和盾的故事
  - [ ] [iOS DeviceCheck：苹果设备身份链与黑灰产对抗的攻防博弈](https://mp.weixin.qq.com/s?__biz=MzU3MDc0MTY1MA==&mid=2247484121&idx=1&sn=7edc9a634643c1387094163d87aace78)
- Security Weekly Podcast Network (Audio)
  - [ ] [Are you dead?, AI Hellscape, Copilot, Blue Delta, Quishing, Confer, Aaran Leyland... - SWN #546](http://sites.libsyn.com/18678/are-you-dead-ai-hellscape-copilot-blue-delta-quishing-confer-aaran-leyland-swn-546)
  - [ ] [Secure By Design Is Better Than Secure By Myth - Bob Lord - ASW #365](http://sites.libsyn.com/18678/secure-by-design-is-better-than-secure-by-myth-bob-lord-asw-365)
- 网安寻路人
  - [ ] [情感交互启动事件（SIE）判定指标体系设计：精准圈定“拟人化互动”](https://mp.weixin.qq.com/s?__biz=MzIxODM0NDU4MQ==&mid=2247508062&idx=1&sn=6d062e77e126dcd40c1bbb7ccdb8a8ac)


Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[每日信息流] 2026-01-14 #1114

每日安全资讯（2026-01-14）

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[每日信息流] 2026-01-14 #1114

Description

每日安全资讯（2026-01-14）

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions