{"locale":"zh","total":10,"articles":[{"title":"APT37 针对中国境内朝鲜族人使用 Android BirdCall 恶意软件","digest":"ESET 表示 APT37 破坏了 Sqgame 纸牌游戏平台，向 Android 设备传递 BirdCall 后门，窃取延边朝鲜族人的短信、通话记录和私钥。","content_source_url":"https://zcybernews.com/zh/articles/2026-05-06-apt37-targets-ethnic-koreans-in-china-with-android-birdcall-malware","author":"ZCyberNews","date":"2026-05-06","category":"malware","tags":["apt37","birdcall","android-malware","supply-chain-attack","north-korea","espionage"],"severity":"high","threat_actor":"APT37"},{"title":"MOVEit Automation CVE-2026-5174 因 Cl0p 历史需紧急修补","digest":"CVE-2026-5174 是 MOVEit Automation 中的高危权限提升漏洞。当前尚无 APT 或 Cl0p 利用确认，但 2023 年 MOVEit 入侵历史使快速修补尤为紧迫。","content_source_url":"https://zcybernews.com/zh/articles/2026-05-06-moveit-automation-cve-2026-5174-cl0p-history-patch-urgency","author":"ZCyberNews","date":"2026-05-06","category":"vulnerabilities","tags":["moveit","moveit-automation","progress-software","cve-2026-5174","cl0p","ta505","apt-risk","privilege-escalation"],"severity":"high","threat_actor":null},{"title":"Palo Alto PAN-OS CVE-2026-0300 通过 Captive Portal 遭攻击","digest":"CVE-2026-0300 是 PAN-OS User-ID Authentication Portal 中的关键缓冲区溢出漏洞。修复版本尚属后续发布，应立即禁用或限制该门户。","content_source_url":"https://zcybernews.com/zh/articles/2026-05-06-palo-alto-pan-os-cve-2026-0300-attacked-via-captive-portal","author":"ZCyberNews","date":"2026-05-06","category":"vulnerabilities","tags":["palo-alto-networks","pan-os","cve-2026-0300","buffer-overflow","remote-code-execution","active-exploitation"],"severity":"critical","threat_actor":null},{"title":"USB 投掷攻击定义了社交工程学已20年","digest":"Steve Stasiukonis 在2006年对一家信用合作社进行的USB投掷测试 —— 员工插入的20个驱动器中有15个 —— 成为了至今仍被使用的物理社交工程评估的蓝图...","content_source_url":"https://zcybernews.com/zh/articles/2026-05-06-usb-drop-attack-that-defined-social-engineering-turns-20","author":"ZCyberNews","date":"2026-05-06","category":"industry","tags":["social-engineering","usb-drop-attack","physical-security","penetration-testing","history"],"severity":"informational","threat_actor":null},{"title":"Apache 修补关键 HTTP/2 双重释放漏洞 CVE-2026-23918","digest":"Apache HTTP Server CVE-2026-23918（CVSS 8.8）通过 HTTP/2 处理中的双重释放启用 DoS 和潜在 RCE。影响所有 mod_http2 用户。立即修补。","content_source_url":"https://zcybernews.com/zh/articles/2026-05-05-apache-patches-critical-http-2-double-free-flaw-cve-2026-23918","author":"ZCyberNews","date":"2026-05-05","category":"vulnerabilities","tags":["apache","http-server","cve-2026-23918","http2","remote-code-execution","denial-of-service"],"severity":"critical","threat_actor":null},{"title":"CloudZ RAT 劫持微软电话链接窃取短信和一次性密码","digest":"思科 Talos：CloudZ RAT 的新 Pheno 插件滥用 Windows Phone Link 从本地 SQLite 数据库读取短信和一次性密码。","content_source_url":"https://zcybernews.com/zh/articles/2026-05-05-cloudz-rat-hijacks-microsoft-phone-link-to-steal-sms-otps","author":"ZCyberNews","date":"2026-05-05","category":"malware","tags":["cloudz","pheno","microsoft-phone-link","sms-interception","otp-theft","cisco-talos"],"severity":"high","threat_actor":"CloudZ"},{"title":"严重Ollama漏洞CVE-2026-7482暴露30万部署","digest":"Cyera披露CVE-2026-7482（CVSS 9.3）— Ollama的GGUF模型加载器中的堆越界读取，通过三个未经身份验证的API调用泄露提示、API密钥和秘密。","content_source_url":"https://zcybernews.com/zh/articles/2026-05-05-critical-ollama-bug-cve-2026-7482-exposes-300k-deployments","author":"ZCyberNews","date":"2026-05-05","category":"vulnerabilities","tags":["ollama","cve-2026-7482","bleeding-llama","llm-security","heap-out-of-bounds","cyera"],"severity":"critical","threat_actor":null},{"title":"EOL 开源盲点隐藏 40 万+ 未标记 CVEs","digest":"HeroDevs 分析：npm、PyPI、Maven 上有 540 万 EOL 软件包版本避开 SCA 扫描器；约 80% 的 CVEs 影响支持版本，也影响未列出的 EOL 发布。提供免费扫描。","content_source_url":"https://zcybernews.com/zh/articles/2026-05-05-eol-open-source-blind-spots-hide-400k-unflagged-cves","author":"ZCyberNews","date":"2026-05-05","category":"industry","tags":["open-source-security","eol-software","sca-tools","supply-chain-security","cve-blind-spots","herodevs"],"severity":"high","threat_actor":null},{"title":"Persistent OAuth Tokens: 攻击者利用的后门","digest":"没有过期的OAuth令牌在Google和Microsoft租户中持续存在 —— 攻击者绕过MFA和边界控制。","content_source_url":"https://zcybernews.com/zh/articles/2026-05-05-persistent-oauth-tokens-the-back-door-attackers-exploit","author":"ZCyberNews","date":"2026-05-05","category":"industry","tags":["oauth","token-security","identity-threats","cloud-security","attack-surface"],"severity":"high","threat_actor":null},{"title":"ShinyHunters 侵入 Vimeo，泄露 119K 用户记录","digest":"ShinyHunters 在侵入 Anodot 后泄露了一个 106GB 的 Vimeo 数据档案，暴露了 119,200 名用户的电子邮件和姓名。没有泄露任何凭证或支付信息。","content_source_url":"https://zcybernews.com/zh/articles/2026-05-05-shinyhunters-breaches-vimeo-leaks-119k-user-records","author":"ZCyberNews","date":"2026-05-05","category":"industry","tags":["shinyhunters","vimeo","anodot","data-breach","extortion","saas"],"severity":"high","threat_actor":"ShinyHunters"}]}