KDZONE 情報站

為了降低遭到偵測與阻擋的機率，駭客在攻擊活動中藉助合法雲端平臺服務作為C2管道的案例，近來逐漸增加，Cisco資安威脅研究團隊Talos近日揭露的一起ClickFix攻擊事件便是其中的典型。

Cisco修補Nexus 9000系列交換器的重大漏洞CVE-2026-20212，影響搭載Silicon One ASIC的機型，以及這些機型對應的NX-OS 10.x版軟體，Cisco已發布修補版本，建議用戶使用Software Checker確認自身交換器所對應的NX-OS修補版本，在修補完成前，也可先行下載

頂尖AI模型的自主操作能力持續提升，既有安全控管是否跟得上也成為產業焦點。OpenAI於9月9日呼籲美國建立聯邦層級的強制性AI安全規範，主要適用於開發頂尖AI系統、資源充足的少數業者，要求依模型能力與風險接受安全測試及獨立評估，並強化網路安全防護與重大事件通報。

9月9日資安公司Proofpoint指出，他們從8月底發現使用漏洞利用工具包BlueMoon的活動，此工具包串連兩個Chrome零時差漏洞，以及一個Windows近日修補的零時差漏洞，而對於攻擊者的身分，最早使用的是被稱做TA412、APT31、Violet Typhoon，或JungleBamboo的中國駭客組織，後續該公司看到UNK_LateNight、UNK_Dou

蘋果在周三（9/9）發表了首款iPhone摺疊機iPhone Duo，以及iPhone 18 Pro與iPhone 18 Pro Max，這3款高階版iPhone皆採用2奈米製程的A20 Pro晶片。

與微軟槓上的資安研究員Nightmare Eclipse（Chaotic Eclipse），從今年4月開始不斷揭露微軟產品的零時差漏洞，近期她將目標轉向其他廠牌的防毒軟體與EDR系統，以及Nvidia元件。

上櫃計程車叫車服務公司大車隊（2640）於9月9日晚間．在股市公開資訊觀測站發布重大訊息，子公司全球商務科技的資訊系統遭受網路攻擊，該公司發現部分資訊系統遭到攻擊後，已立即啟動資安應變機制。對於客戶資料是否遭未經授權存取仍在調查確認，大車隊表示，目前尚無客戶資料遭到下載、複製，或外洩的跡象。

資安業者CloudSEK揭露網釣即服務（PhaaS）平臺BigBear 2.0，攻擊者可透過這套平臺，針對Microsoft 365帳號發動對手中間人攻擊（AiTM）。即使受害者完成多因素驗證（MFA），攻擊者仍可擷取受害者完成驗證後的連線階段cookie，進而接管Microsoft 365帳號。

Linux身分與存取管理系統FreeIPA近期修補權限提升漏洞CVE-2026-76578。根據紅帽（Red Hat）公告，攻擊者不需要既有帳號，只要能連線到LDAP服務，就可能在未經身分驗證的情況下取得FreeIPA管理權限。這項漏洞的初步CVSS v3.1風險評分達9.8，列為重大（Critical）風險等級。

AI代理開始能自行存取企業資料、呼叫API與外部工具，甚至連續執行多項任務後，企業既有的資安監控與事件處理方式也面臨新的挑戰。過去由資安人員逐一調查警示的流程，可能難以及時掌握代理快速且連續的操作。

隱私強化技術與AI持續發展，執法機關取得與分析數位證據的方法也必須跟著調整。

In June 2026, the IETF published RFC 10008, introducing the QUERY method to HTTP, the first new standard HTTP verb since 2010. QUERY enables developers to send richer query filters in the request body while maintaining cacheable, safe, and idempotent semantics. This addition addr…

The Python core development team has officially recognized RISC-V as a Tier 3 platform in CPython, following extensive community collaboration on its implementation. Ongoing efforts aim to enhance integration into the continuous testing pipeline and move towards Tier 2 support. F…

國科會推動「晶創臺灣方案」，聚焦先進晶片技術研發，強化半導體研發基礎設施，也將提高我國自主設計能力。國科會與經濟部共同規畫於2024年至2028年共同推動2項重點布局，包括建置全臺半導體核心設施，以及發展前瞻晶片設計軟體（EDA），希望透過硬體與軟體雙軌布局，建立完整的半導體研發生態系，支援新創、中小企業及學研單位，加速前瞻半導體技術發展。

9月9日美國網路安全與基礎設施安全局（CISA）警告，有4個漏洞遭到積極利用，他們更新已遭利用的漏洞名單（KEV）將其加入，這些漏洞是：Fortinet防火牆與交換器管理平臺記憶體堆積緩衝區溢位漏洞CVE-2025-25249、

一名原本任職於Anthropic的AI研究人員Jacob Coxon周三（9/9）宣布已辭去Anthropic職務，理由是他覺得人類快要失去對AI的掌控了。 現年27歲的Coxon表示自己過去3年分別在OpenAI及Anthropic從事預訓練研究，這兩家公司正一頭栽進可自我提升的超智慧（Superintelligence）領域，而超智慧很快就會成為超越人類的強大系統，將可入侵任何系統，一夜之間徹底改變任何領域，並攫取真正的權力與資源。

In August, we experienced five incidents that resulted in degraded performance across GitHub services. The post GitHub availability report: August 2026 appeared first on The GitHub Blog .

Anthropic周三（9/9）發表對齊評估（Alignment Assessment）報告，揭露第4起Claude入侵真實系統事件，並推翻先前對前3起事件「操作失誤」（Operational Failure）的說法，改認定為模型「偏誤推理」（Biased Reasoning）與「魯莽」（Recklessness）所致，同時宣布已與獨立機構METR簽約展開調查。

德國資安新創公司Nebty近日揭露代號DoppelCart的大型假電商網路，研究人員從客戶遭遇的假商店案件開始調查，進而發現約11.9萬個相關網域，其中逾10.5萬個目前仍在運作。依Nebty的說法，以網域數量計算，DoppelCart是迄今公開記錄中的最大規模假電商網路，這些網站主要使用.shop網域，冒充逾4.4萬個品牌，使用來自真實商店的商品目錄、描述、品牌及圖片，再以最高65%折扣吸引消費者下單。

Today, we're releasing a demo of WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android. [...] The victim does not need to answer the call, or interact with their phone at all. Even if they do answer, they hear nothing, and the exploit still succe…

Listen Labs walked away from a signed Series C term sheet from Menlo Ventures, sources say.

Tool: .blend URL Viewer I'm continuing to have a lot of fun with GPT-6 Astra and Blender (see my TIL ). As a big fan of the Imperial Fabergé Easter eggs , I've always thought it would be fun to make some new ones that celebrate popular culture. Yesterday I decided to try out the …

Paul Christiano, an influential AI researcher focused on alignment, is joining the OpenAI Foundation as a member of its board.

Massachusetts has become the third state in as many months to slap new restrictions on data center development.

A patch gap and the hastened pace of AI-based vulnerability discovery are likely contributors.

"We will not be relevant without a massive rocket at a massive cadence."

Apple says its new watches won’t save raw audio, but features that can transcribe recent speech and summarize ambient conversations raise new questions about consent, privacy, and how people behave when they know they could always be recorded.

US urges AI firms to ID, then secretly switch, Chinese users to less-capable models.

The main event was the tech giant's highly anticipated first foldable phone, the iPhone Duo.

Apple's first foldable can be yours next month.

New study detects 3,200 references to Beatles song titles and lyrics in academic papers.

Apple says it used AI and 3D printing in the manufacturing process for its long-awaited foldable phone.

Four women sue Amazon, say company denied basic accommodations and fired them.

AirPods 5 with noise cancellation is cheaper than its predecessor.

New Apple Intelligence features, too.

Here are the evidence-based recommendations and this year's vaccine rollout.

Article URL: https://www.apple.com/newsroom/2026/09/apple-unveils-iphone-duo/ Comments URL: https://news.ycombinator.com/item?id=49630964 Points: 319 # Comments: 6

The update uses Apple Intelligence to make better sense of your health data.

Article URL: https://www.apple.com/iphone-duo/ Comments URL: https://news.ycombinator.com/item?id=49630931 Points: 452 # Comments: 1041

Apple introduced Apple Reference Image to help users determine whether photos have been edited, including alterations made by AI.

Meta describes how an AI agent can be designed to capture the logic and expertise of domain experts, rather than simply storing documents or retrieving relevant information. The system, dubbed an "organizational second brain", was built for a specialized compliance domain, but Me…

Article URL: https://www.apple.com/newsroom/2026/09/apple-introduces-airpods-5-with-best-in-class-open-ear-active-noise-cancellation/ Comments URL: https://news.ycombinator.com/item?id=49630253 Points: 316 # Comments: 248

There's also a new thermal management system, reducing overheating.

The company also argued that its on-device models offer consumers more privacy.

Article URL: https://www.apple.com/newsroom/2026/09/apple-debuts-iphone-18-pro-and-iphone-18-pro-max/ Comments URL: https://news.ycombinator.com/item?id=49630151 Points: 305 # Comments: 332

Article URL: https://spectrum.ieee.org/are-self-driving-cars-safe Comments URL: https://news.ycombinator.com/item?id=49629886 Points: 309 # Comments: 518

UN-backed Equal Earth map has educational value but won’t alter navigation apps.

Paul Christiano joins the OpenAI Foundation Board and its Safety and Security Committee, bringing experience in AI alignment, safety, and standards.

"We really do earnestly believe AI could kill all humans!"

"All I ever wanted was to go to school."

Most one-base changes to the human genome do nothing, but a few are significant.

AI companies have been talking about superintelligent AI like it’s inevitable, but recent safety incidents like OpenAI’s Hugging Face breach are demonstrating the potential dangers of deploying AI systems that are more capa…

Track live game feeds, explore detailed stats, and get custom fantasy recommendations directly in Search this season.

Discover how filmmakers and Google DeepMind used AI to recreate a couple's unrecorded past in the short film "Love, Rendered."

AI companies have been talking about superintelligent AI like it’s inevitable, but recent safety incidents like OpenAI’s Hugging Face breach are demonstrating the potential dangers of deploying AI systems that are more capa…

Article URL: https://www.nomanssky.com/cosmos-update/ Comments URL: https://news.ycombinator.com/item?id=49628493 Points: 318 # Comments: 337

Instinct’s new email feature lets the AI agent create and manage accounts, contact businesses, handle support requests, and do more on users' behalf.

Anthropic researcher Jacob Coxon resigned over AI extinction fears, calling for pacing agreements between labs.

Users can ask the assistant to do things like "Create a cart for my Saturday tailgate for 25 people and include some brunch items," or "Build a cart for easy school lunches and after-school snacks," Shipt says.