KDZONE 情報站

微軟GitHub本周宣布Copilot Fusion協調系統已提供給開發人員，可讓Copilot自行依任務協調多個模型以完成工作。測試顯示比只用Claude Opus 5.5省一半成本。

微軟（Microsoft）周三（10/28）公布截至9月30日的2027財年第一季財報，該季營收達922.8億美元，年增19%，淨利（Net Income）366.3億美元，年增32%。微軟本季首度於季度財報中單獨揭露Azure營收，達331.7億美元，比去年同期成長48%。當天微軟盤後股價一度上揚3.48%，漲至549.44美元。

由於PHP廣泛應用於各類資訊系統，部分工業環境中的系統也可能採用PHP建置的網頁介面或管理平臺，因此，近期揭露與修補的PHP2Shell漏洞不僅影響全球7成網站伺服器，也對部分IT與OT產品供應商造成重大影響，許多人因此聯想到4年前爆發的Log4Shell漏洞風暴。

中國駭客組織Volt Typhoon的活動3年前首度浮上檯面，當時這些駭客綁架多個廠商的網路設備建立殭屍網路KV Botnet，藉此隱匿地攻擊美國關鍵基礎設施。然而，在殭屍網路遭到執法單位圍剿後，這些駭客建置更為隱密、複雜，且動態的攻擊基礎設施，持續從事相關活動。

Apple於10月26日推出macOS 27.2，但系統內建的Git、curl及Python 3等工具，仍可能接受印度憑證業者eMudhra已撤銷的問題憑證。研究人員10月28日公布測試，顯示攻擊者若能攔截或重新導向網路連線，可能冒充GitHub等網站，讓開發者下載遭竄改的程式碼。Apple已確認相關防護尚未完成，將透過後續macOS更新修正。

美國財政部外國資產管制辦公室（OFAC）於10月28日宣布制裁10名個人及1個實體，指控其協助北韓政府的遠端IT工作詐騙活動，包含在俄羅斯活動的北韓IT工作者、管理人員及俄羅斯籍洗錢中間人。

10月27日Adobe發布10月第二次例行更新，為Campaign Classic、Adobe Connect、Creative Cloud，以及Substance 3D Painter提供修補程式。其中最值得留意的部分是行銷自動化平臺Campaign Classic，Adobe一口氣修補8個資安漏洞，而且全部都是重大等級，該公司將其修補優先順序列為第2級（Priority 2），呼籲用戶儘速採取行動因應。

美國網路安全與基礎設施安全局（CISA）提供兩款免費雲端安全評估工具ScubaGear與ScubaGoggles，分別用於檢查Microsoft 365（M365）與Google Workspace的安全設定。兩者皆源自2022年成立的安全雲端商務應用計畫（SCuBA），目的是協助政府機關及企業找出雲端服務設定與安全基準之間的落差。

電子巨擘Sony集團（Sony Group）旗下網路通信服務部門Sony Network Communications本周一公告內部資料庫遭駭客入侵，使So-net及plala兩個品牌服務雙雙外洩會員資訊超過258萬筆，以及5.4萬會員郵件、密碼。Sony保險公司網站被駭則外洩保戶38.5萬筆個資。 Sony Network Communications於10月23日確認So-net會員個資外洩，立即將伺服器下線並切斷攻擊者存取通道。24日該公司確認遭外流的會員類型和數量。

TechCrunch報導，一名駭客宣稱竊得超過4萬筆美國國土安全部（Department of Homeland Security）員工資料，包括和移民及邊境管制相關的探員個資。

10月28日美國網路安全與基礎設施安全局（CISA）發布公告，他們更新了已遭利用漏洞名單（KEV）內容，根據遭到積極利用的證據增列兩個新漏洞。

Google母公司Alphabet周三（10/28）公布2026年第三季財報，營收年增25%至1,275.77億美元，營業利益（Operating Income）成長30%至405.76億美元。其中，Google Cloud營收年增103%，突破300億美元大關，成為推動成長的主要動力。不過，Google搜尋業務營收成長放緩，加上AI基礎設施投資持續擴大，使市場對其獲利前景產生疑慮。

蘋果（Apple）周三（10/28）發表首款支援觸控操作的MacBook Pro，搭載全新PROLED XDR雙層OLED顯示器，並將iPhone的動態島（Dynamic Island）設計引進Mac。另一項引人注意的變化，是睽違多年的發光蘋果標誌重新出現在筆電機蓋上。

汽車零配件製造商橙的（4554）於10月28日，於股市資訊公開觀測站發布重大訊息，部分位於區域網路環境的網路儲存設備，遭受勒索軟體攻擊，事發後資安團隊於第一時間立即啟動防禦機制與斷網隔離措施，並啟動相關資安應變機制，根據橙的初步評估，對公司整體營運不致有重大影響。

Google周三（10/28）發表新一代AI模型Gemini 4 Carbon，在第三方評測機構Artificial Analysis最新的綜合能力指數中，以59分排名第一，並在漏洞發現、利用驗證及修補等3項資安基準測試中創下最佳成績。

Datadog has released Scout, a model trained to investigate production problems. It runs inside Bits Investigation, the company's AI SRE product, where it can pick up an alert, look through telemetry and suggest what caused the problem. Datadog engineers and a small number of cust…

法國超市冷藏設備日前遭到網路攻擊，網路安全業者Forescout指出，受影響的超市超過700家，攻擊者入侵冷藏管理系統，修改溫度及除霜設定，造成食品損失。該公司旗下Vedere Labs於10月22日公布全球冷藏控制系統調查結果，發現全球有12,976筆冷藏控制相關服務暴露於公開網路的觀測紀錄，來自99個國家與地區的6,017個公開IP位址。研究也發現，部分暴露服務對應的設備使用存在已知漏洞的舊版韌體。

雲端資安業者Wiz近日揭露Gheist攻擊活動，駭客濫用遭竊的GitHub權杖，在儲存庫植入惡意GitHub Actions工作流程，企圖竊取機密資料。研究人員發現，這波攻擊影響超過850個遭入侵的GitHub帳號，相關儲存庫遭植入逾1.35萬個惡意分支。

美國網路安全暨基礎設施安全局（CISA）公布2030年資安戰略，將從被動防禦轉向更積極的威脅偵測與排除，並根據風險及事故可能造成的後果，決定關鍵基礎設施的防護優先順序，同時提升重大資安事件的應變與復原能力。

企業AI安全治理業者Harmonic Security近期宣布完成5,000萬美元B輪融資，累計募資金額達7,600萬美元。該公司已將原本以瀏覽器為主的AI使用監控與敏感資料防護，擴展至桌面AI工具及AI代理，協助企業控管員工及AI代理使用AI工具時的資安風險。

Cloudflare has recently launched a beta Web Search API through AI Gateway. Available through REST APIs and Cloudflare Workers, it provides unified logging, access controls, and billing, and supports bring-your-own-provider keys. By Renato Losio

虛擬私人網路（VPN）服務Tailscale發布1.104.4版安全更新，修補先前揭露的SSH權限提升漏洞，並處理SSH記憶體耗盡，以及讓其他裝置存取本機服務的Serve功能所存在的權限檢查問題。此次更新涵蓋4項安全漏洞，可能造成一般使用者越權存取、主機遭接管，或導致Tailscale連線中斷。

上週Oracle發布今年第4次關鍵修補更新（CPU），修補超過1,200個漏洞，近期有漏洞遭到利用而引起資安公司注意。威脅情報公司Defused Cyber於10月27日，在他們的Oracle E-Business Suite（EBS）誘捕系統當中，首度偵測到嘗試利用CVE-2026-101767的攻擊活動，呼籲EBS用戶應加快修補的速度。

Nvidia推出開放權重語音模型Nemotron 3.5 Transcribe，將語音轉文字、翻譯、講者區分及錄音問答整合在同一模型。新模型可轉錄40種語言，其中31種支援與英語互譯，13種可標記不同講者的發言，目前已在Hugging Face及ModelScope開放下載。

Article URL: https://divagr.com/blog/qwenputer Comments URL: https://news.ycombinator.com/item?id=50282838 Points: 335 # Comments: 76

Article URL: https://data.stackexchange.com/stackoverflow/query/1926661#graph?t=1 Comments URL: https://news.ycombinator.com/item?id=50282454 Points: 317 # Comments: 268

In general, LLM performance is incredibly multidimensional. There's no guarantee of a fixed ordering where the model that is best at math is also the model that's best at jokes. Despite that complexity, much of the variation in performance is explained by just a single variable: …

This Vulcan launch will be the first to utilize a full complement of six solid rocket boosters.

Europe's Pan-Arctic Cable will bypass US to link Canada, Japan, and South Korea.

Six unproven peptides popular with MAHA now under "enforcement discretion policy."

Microsoft has never disclosed Azure's quarterly revenue in dollars. But for the first time, we can see just how close it is getting to besting the biggest competitor in the market, AWS.

The announcement came alongside parent company Alphabet's third-quarter earnings report, which saw revenue grow 25% year over year to $127.6 billion.

Microsoft said it made $10 billion in revenue from commercial arrangements with OpenAI, including revenue-sharing payments, in the quarter ending September 30. It underscores the still-enormous financial dependency of the partnership.

Whatever the future of AI might be, the current situation is still very good for Microsoft. The tech giant reported yet another record for quarterly revenue on Wednesday: $92.3 billion, a 19% increase over the year-ago quarter.

Article URL: https://www.wired.com/story/massive-leak-exposes-41000-homeland-security-workers-including-undercover-ice-agents/ Comments URL: https://news.ycombinator.com/item?id=50280864 Points: 293 # Comments: 151

US agency has sued 10 states for trying to stop gambling on prediction markets.

It has been nearly a year since any space tourism flights occurred.

The frontier lab is lifting the curtain on how users spend money on its models ahead of a planned IPO.

It's not as different from the previous model as you might have expected.

The PHP scare may have faded from your feed, but the cleanup is far from over. Last week, two critical bugs in the open source language behind roughly 70% of websites left organizations scrambling to fix their systems, with some taking sites offline until the vulnerabilities coul…

The PHP scare may have faded from your feed, but the cleanup is far from over. Last week, two critical bugs in the open source language behind roughly 70% of websites left organizations scrambling to fix their systems, with some taking sites offline until the vulnerabilities coul…

Gemini 4 Carbon is essentially a slightly better version of Argon.

The Echo Studio with Home Camera can "see and understand what's in front of the camera."

With more than 200 kWh, this luxury three-row can go 460 miles on a charge.

But the AI responses get more forthright when asked outside the US.

Florida county claims it lacks resources to find owners of unpermitted Flock cameras.

The OLED display is the main draw, but the price is a lot to reckon with.

Article URL: https://nullpt.rs/fingerprinting-bioweapons Comments URL: https://news.ycombinator.com/item?id=50276998 Points: 396 # Comments: 87

https://www.apple.com/newsroom/2026/10/apple-unveils-groundb... Comments URL: https://news.ycombinator.com/item?id=50276940 Points: 289 # Comments: 457

Article URL: https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/ Comments URL: https://news.ycombinator.com/item?id=50276792 Points: 467 # Comments: 394

The autofill update lets Chrome pull flight confirmations, tracking info, order details, and other information from your inbox, with your permission.

A new developer platform will let businesses bring their services to Google's AI experiences, potentially changing how consumers discover and use apps.

GitHub Octoverse 2026 I'm at GitHub Universe today (GitHub gave me a free ticket through their "GitHub Stars" program). EVP Jay Parikh just announced this year's Octoverse report, and highlighted these numbers in particular: This is a pretty stark representation of the impact of …

Today, we laid out our vision for GitHub as the most comprehensive, end-to-end software delivery system in the world. The post GitHub Universe 2026: Evolving every layer of the stack appeared first on The GitHub Blog .

See how a record year of growth reached every industry, every field, and every kind of builder in the 2026 Octoverse report. The post Octoverse: Commits, pushes, reach new highs in 2026 as developers build with agents appeared first on The GitHub Blog .

Tech leaders are flaunting how out of touch they are when they brag about using AI to connect with their families.

"We have to be ready for whatever's coming next. If we lose in here, there won't be a home to go back to."

South Korea’s financial institutions have been hit by another wave of cyberattacks, highlighting the growing risk of AI-driven hacking in Asia.

Nvidia just released a free speech-to-text model that can transcribe up to 40 languages, but it only works on recordings, not live audio, so it’s a big step for meeting and medical transcription tools while still leaving real-time use to rivals like ElevenLabs.