Tag
pwn.watch 实时安全事件汇总：美国主要银行发现客户账户中存在未经授权的第三方 AI 代理，GitLab 披露 CVSS 10.0 未认证 RCE 漏洞（CVE-2026-110264），以及多个未修补的 Linux 内核高危漏洞细节被意外公开至公共邮件列表。
Trend Micro's Zero Day Initiative accidentally disclosed multiple high-severity Linux kernel vulnerabilities (up to CVSS 9.0) on the public LKML instead of the private security list, prompting responses from Greg Kroah-Hartman as patches are expedited.
A Hacker News poster apologizes for unknowingly breaking the embargo on two critical PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), disrupting the coordinated disclosure schedule.
A tweet speculating about the unknown CVEs and zero-day vulnerabilities that national agencies or large AI companies may have discovered and kept undisclosed for months or longer.
Two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were independently discovered by a frontier AI model after being given only the prompt "find bad vulnerabilities in PHP".
The author argues that the latest high-profile PHP vulnerability is far less exploitable than Log4Shell or Heartbleed, and that the thousands of circulating 'PoC' exploits are largely broken artifacts generated by LLMs that modify test environments instead of chaining the real bug.
CZ warns users to be cautious browsing the web after two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting WordPress and Magento servers were exploited in the wild following an early leak, prompting patches and WAF protections.
GitLab 发布关键补丁版本，修复 CVSS 10.0 的未认证远程代码执行漏洞（CVE-2026-110264），该漏洞源于正则表达式编译器中的整数溢出，影响 7.0 至 19.5 的多个版本。
A potential third critical PHP CVE is surfacing, raising fresh security concerns for web developers and servers relying on the popular scripting language.
A newly disclosed vulnerability, CVE-2026-107891, reveals multiple integer overflows in musl libc's regcomp that can lead to incorrect allocation sizes and out-of-bounds heap writes, disclosed via the Openwall oss-security mailing list.
Node.js 发布 2026 年 10 月安全更新，覆盖 26.x、24.x、22.x 版本线，修复了包括 Brotli 解码器远程代码执行和 TLS 证书主机名绕过在内的多个高危漏洞。
紧急修复的两个关键 PHP 漏洞影响自 2004 年以来的所有版本，可能导致大规模远程控制攻击，促使全球政府和企业网站紧急下线并抢在攻击前打补丁。
Wiz Research 发现了 PHP 核心中一系列严重的内存安全漏洞，包括未经认证的远程代码执行，影响过去十年发布的几乎所有 PHP 版本（占全球 70% 网站），并借助前沿 AI 模型构建了复杂的利用链，促使 PHP 于 2026 年 10 月 21 日发布补丁。
A heap use-after-free in PHP's session.upload_progress handler (CVE-2026-109618 / -109619) allows attackers to hijack freed bucket pointers and achieve remote code execution via zend_call_function; the writeup includes verified PoC chains for PHP 8.4.4 and 8.2.34 along with pre-patch mitigations.
Ian Goodfellow highlights AISLE's first year results: an AI security research lab that discovered 500+ zero-day vulnerabilities with CVEs across 100+ open-source codebases, rivaling frontier AI labs even with small, cheap, fast models. The key insight is that the system built around an LLM matters as much as the model itself.
Stanislav Fort's AI security research lab AISLE claims to have discovered 500+ zero-day vulnerabilities with CVEs across 100+ codebases in a year, roughly 1% of 2026's global open-source CVEs, while matching or outperforming frontier AI labs on hardened codebases like curl.
作者通过追踪 Linux 内核 CVE 修复数据发现，AI 批量审查代码后新漏洞数量骤降（周发布量从 600+ 降到 1），并探讨了 AI 时代软件安全、情报机构囤积漏洞以及 Windows 升级模式可能受到的冲击。
curl 8.23.0 修复了一个严重的 Use-After-Free 漏洞 (CVE-2026-92392)，该漏洞源于 HTTP/2 上传过程中残留的 easy handle 悬垂指针，可在特定条件下被利用为远程代码执行。
Telegram Desktop中披露了一个安全漏洞，攻击者可利用该漏洞窃取任意用户的文件。该漏洞影响桌面客户端用户，属于严重的数据泄露风险。
curl 8.23.0 will be released early on October 14, 2026 to address one HIGH-severity vulnerability (CVE-2026-92392) along with 21 other, less serious security flaws.