KDZONE 情報站

日本遊戲大廠卡普空（Capcom）證實，旗下會員帳號服務CAPCOM ID遭第三方入侵，導致全球超過1,177萬筆會員資料外洩，其中有196個帳號的登入密碼遭擅自變更。卡普空表示，未發現會員自行設定的密碼外洩，信用卡資料也不在此次外洩範圍。 CAPCOM ID是卡普空旗下網路服務及部分線上遊戲使用的共用帳號。外洩資料包括會員電子郵件地址、帳號建立時間、最後登入時間、登入次數，以及最後登入時使用的IP位址，而有43筆還包含出生年月日、性別、國家或地區及暱稱。

震撼全球的PHP2Shell網站漏洞危機，目前已知的影響，除了全世界70%的網站都可能有潛在風險，資安廠商Check Point目前揭露全球衝擊程度的研究數據，該公司表示，由於PHP2Shell漏洞的細節在預定公

資安漏洞嚴重程度的認定，一般而言大多會根據兩種指標，一是CVSS評分，另一種則為是否有資安公司，甚至如美國網路安全與基礎設施安全局（CISA）等國家級資安機構出面警告，但如今有資安漏洞上升至國家安全層級，罕見地由國家元首呼籲用戶確認及預備修補。

10月21日PHP開發團隊發布及修補統稱為PHP2Shell的重大漏洞CVE-2026-109618、CVE-2026-109619，這些漏洞由資安公司Wiz、Calif，以及

以戶外機能服飾、登山裝備及休閒用品為主要商品的興櫃公司歐都納（2940），於10月22日在公開資訊觀測站發布資安事件重大訊息，表示委外服務平臺業者的資料庫遭到自動化攻擊，部分資訊遭非法擷取，當日並接獲消費者反映疑似個資外洩。

印度數位憑證業者eMudhra週四（10/22）宣布，將退出全球SSL/TLS憑證市場。該公司日前被發現有8張中繼憑證授權機構（CA）憑證的私密金鑰存在嚴重安全問題，攻擊者可輕易還原私鑰，進而偽造網站憑證。這讓Google、蘋果、微軟及Mozilla等業者相繼封鎖有問題的中繼CA憑證，亦使得eMudhra最終決定退出憑證業務。

10月21日GitLab為社群版（CE）及企業版（EE）發布重要更新，總共修補11個資安漏洞，從危險程度來看，1個重大等級、2個高風險等級，其餘為中低風險。值得留意的是，開發團隊不光推出19.5.1、19.4.3、19.3.6版修補上述弱點，也同時針對已終止支援的版本推出19.2.9、19.1.9、 19.0.10，以及18.11.13版更新，用戶應儘速套用降低相關漏洞風險。

微軟進階著色器交付（Advanced Shader Delivery，ASD）已擴大支援AMD、Intel、Nvidia及Qualcomm的顯示硬體。使用符合條件的Windows 11電腦下載支援遊戲時，可一併取得預先編譯的著色器，減少首次啟動的等待時間及遊玩時的畫面卡頓。微軟也預告，ASD將擴展至Steam與Epic Games Store，但尚未公布確切上線日期。

資訊科技研究與顧問業者Gartner公布2027年十大策略科技趨勢，將10項技術分成3大方向，分別是非文字型AI技術（Leverage the Nontextual AI Frontier）、自主AI代理平臺治理（Govern the Autonomous Agent Platform），以及強化企業長期技術自主性與營運韌性（Arch

10月21日歐盟執委會宣布，依據《數位服務法》（Digital Services Act，DSA）對總部位於荷蘭的線上訂房平臺Booking.com展開正式調查，將檢視該平臺是否採取充分措施，防止詐騙者刊登虛假住宿資訊，或利用平臺進行網路釣魚及訂房詐騙。

美國資安人才招聘業者CyberSN近期分析美國資安職缺刊登情況，發現2026年1月至9月，美國資安職缺刊登量為235,786筆，較2025年同期減少26.4%，創2023年以來同期新低。不過，各類資安職務的職缺變化並不一致，其中資安長（CISO）相關職缺年減38.9%，AI安全工程師（AI Security Engineer）職缺則逆勢年增268.3%。

Google於10月21日宣布Chrome瀏覽器已預設啟用HTTP連線前警告機制，使用者造訪一般HTTP網站時，Chrome會先要求使用者確認是否繼續存取，再建立HTTP連線。過去Chrome主要在建立連線後，才於網址列顯示Not Secure（不安全）標示，使用者可能已經暴露於資料遭攔截或竄改的風險。新機制則將警告提前至連線建立前，讓使用者先了解風險，再決定是否繼續存取網站。

AI已能協助開發人員尋找軟體漏洞，攻擊者也開始利用AI發動攻擊，軟體開發團隊因此更需要及早修補漏洞，避免遭攻擊者利用。開源軟體安全基金會（OpenSSF）發布AI漏洞發現與修補指引，由旗下Best Practices及AI/ML工作小組共同制定，提供開發人員利用AI尋找及修補自家軟體漏洞的實務建議，也供協助開發團隊尋找漏洞的資安研究人員參考。

inDrive plans to begin testing Pony.ai's robotaxis in Kazakhstan's capital in the first half of 2027.

AI安全研究組織METR與Redwood Research最新公布的報告顯示，OpenAI內部的AI模型監控系統存在多項漏洞，包括Codex代理人可能繞過沙箱及自動審查（Auto-Review）機制，在主機使用者原本有權執行的操作範圍內採取任意行動，或利用序列化差異，讓代理人與監控系統看到不同的執行軌跡，進而規避監控。OpenAI已修正這些問題。

Google Cloud發表AI代理專用運算服務Agent Compute Engine，供每個代理在獨立的微型虛擬機器中執行程式、操作瀏覽器及使用外部工具。該服務將企業系統的存取憑證保留在執行環境之外，降低憑證遭竊的風險，並能暫停閒置的虛擬機器以節省運算資源。

在半年前離開OpenAI的Kevin Weil，周四（10/22）正式宣布成立結合AI與機器人技術的醫藥新創Warp Sciences，並完成由Lightspeed領投的2.15億美元A輪募資。根據彭博社（Bloomberg）報導，其投後估值達8.65億美元。

Google Cloud與OpenAI本周稍早宣布，將在雲端市集提供OpenAI GPT-6最新三款模型，包括Astra、Sol和Luna。目前先開放有意者申請購買由API存取，之後逐步在Gemini for Business及Google Antigravity上架。

10月20日甲骨文發布2026年第四季度的關鍵修補更新，總共處理1,209個漏洞，沒想到隔天又發布新的資安公告，主角是CVSS 3.1嚴重度評分為9.1分的CVE-2026-91403，警示此漏洞可透過網路利用，無須使用者互動，而且攻擊的複雜度低，目前已知受影響的產品都與Java平臺有關，包括GraalVM Enterprise Edition（21.3.20版）、GraalVM for JDK（17.0.21版與 21.0.13版），以及Java SE（8u511版、8u511-perf版、11

MIT researchers marooned 13 AIs on a virtual island, and they responded by inventing games, mourning a lost ring and, eventually, getting better at their jobs.

OpenAI and Poland’s NASK are partnering on AI safety, security, and technical research to strengthen safeguards and support a more resilient digital ecosystem.

Article URL: https://codeandcake.dev/posts/2026-10-22-docker-is-weird Comments URL: https://news.ycombinator.com/item?id=50202681 Points: 366 # Comments: 180

"Userland" exploit relies on integer overflow found in "SmileBasic" interpreter.

Markers released top-line results today after previously reporting the trial succeeded.

Should OpenAI command an over $1 trillion valuation with this round, it would break records as the most highly valued private company ever.

"We need to keep our eyes on numerous required fuelings for the lander."

Article URL: https://www.vanityfair.com/story/jared-kushner-hacked-phone-secret-negotiations Comments URL: https://news.ycombinator.com/item?id=50201259 Points: 325 # Comments: 136

Comcast plans job cuts and more AI agents for its shrinking cable customer base.

Flubbed key signing "ceremony" allowed minting of web credentials for any site.

We can't have nice things, but at least we can get trailers for them.

DE STAAT - FREEDOM (Official Music Video) OK well this is a first for me... at 00:44 in this new music video by Dutch alternative rock band De Staat : The visual effects are credited to Matties Grooten of Fake it or Leave it . Via flir on Hacker News Tags: music , ai , generative…

Ole Bielfeldt of Germany captured a microscopic view of an inkjet printer depositing ink onto paper.

The new feature allows agents to log into a customer's personal accounts while still protecting the private credentials that secure those accounts.

The departure comes amid turmoil in Kennedy's Make America Healthy Again movement.

460 kW charging and 450 miles of range are among the reasons the EV is the one to get.

Canva is making its new image model available to all users, promising better, more customizable performance at lower costs.

OpenAI is launching its decision model to the world. Can it compete with the original Jev?

Fast, focused, low-cost decisions for any application.

Searches for Samsung foldables just happened to skyrocket following iPhone Duo unveiling.

Microsoft’s new AI diagnostic system beat generalist doctors on hard cases, according to a study in Science. But most of the improvement seems to come from the AI models underneath, not from Microsoft’s system itself.

The Russian official who called commercial satellites "legitimate targets" now says concerns are "unfounded."

Donating Agent Skills to the Agentic AI Foundation News today from Anthropic: We’re committed to keeping Agent Skills open, community-driven, and vendor-neutral. Today, we are donating the standard to the Agentic AI Foundation (AAIF) under the Linux Foundation, which we co-founde…

Article URL: https://github.com/NVIDIA/OpenShell Comments URL: https://news.ycombinator.com/item?id=50198675 Points: 343 # Comments: 182

As Cybersecurity Awareness Month continues, the GitHub Bug Bounty team spotlights @r31n, diving into their research approach, favorite bug classes, and advice for aspiring hackers. The post How bug bounty sharpens one researcher’s security skills appeared first on The GitHub Blog…

Meta will appeal a ruling imposing the largest fine Mark Zuckerberg has ever seen.

Microsoft points the blame for ConnectWise's breach at a China-aligned hacker, which relied on AI agents to rapidly hack into thousands of its customers.

The decried trial was canceled last week before police seized vaccine doses.

Article URL: https://www.modelcompare.ai/blog/ai-models-controversial-take-on-humans Comments URL: https://news.ycombinator.com/item?id=50197313 Points: 352 # Comments: 382

The ride share giant previously deployed a much smaller pilot for ChatGPT Work, but is now taking the enterprise agent company-wide.

Tile-based color palettes go way beyond the four shades of red on original hardware.

As fun as AI is, we built so much bad software over the last 30 years, and now the universe is punishing us for our sins. — Armin Ronacher Tags: security , generative-ai , armin-ronacher , ai , ai-security-research , llms

Article URL: https://www.techspot.com/news/114100-google-cleared-300-hectares-finnish-forest-data-center.html Comments URL: https://news.ycombinator.com/item?id=50196837 Points: 278 # Comments: 191

https://hackios-web.vercel.app/en Comments URL: https://news.ycombinator.com/item?id=50196718 Points: 315 # Comments: 120

Hackers were already probing the bug before defenders were told it existed.

Spotify co-CEO Gustav Söderström explains why the rise of AI agents could be good news for the music service.

Article URL: https://quad9.net/news/blog/au-revoir-france/ Comments URL: https://news.ycombinator.com/item?id=50195959 Points: 302 # Comments: 96

"I will take my place as the conqueror, a sorcerer, a king."

Article URL: https://pwn.watch/ Comments URL: https://news.ycombinator.com/item?id=50195543 Points: 326 # Comments: 152