PLANCK기술 소식
보안 · 통신 기술 분야 공식 매체의 RSS에서 매일 8시 · 17시에 제목과 짧은 요약을 모읍니다. 본문은 각 매체 사이트에서 읽으십시오.
- Hackers exploit SiteGuard WAF flaw to run commands as admins (새 창 · 바깥 사이트)
Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers. [...]
EN BleepingComputer · 보안 · 2026.10.18 - Orphaned VBA Projects Inside DWG Files: YARA Rule, (Sun, Oct 18th) (새 창 · 바깥 사이트)
Here is the YARA rule I used to detect "Orphaned VBA Projects Inside DWG Files".
EN SANS ISC · 보안 · 2026.10.18 - ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants (새 창 · 바깥 사이트)
ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled i…
EN The Hacker News · 보안 · 2026.10.18 - Week in review: Hidden implant in Ledger wallets linked to $93M theft, 1,500+ npm packages exposed (새 창 · 바깥 사이트)
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Strands Box: Open-source sandbox for AI agents AWS released Strands Box, an open source sandbox for AI agents that pairs operating-system isolation with rules that can weigh what…
EN Help Net Security · 보안 · 2026.10.18 - Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack (새 창 · 바깥 사이트)
ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. [...]
EN BleepingComputer · 보안 · 2026.10.18 - Drupal patches critical RCE flaws, warns exploits may emerge soon (새 창 · 바깥 사이트)
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. [...]
EN BleepingComputer · 보안 · 2026.10.17 - MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon (새 창 · 바깥 사이트)
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." I…
EN The Hacker News · 보안 · 2026.10.17 - Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants (새 창 · 바깥 사이트)
Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environm…
EN The Hacker News · 보안 · 2026.10.17 - BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs (새 창 · 바깥 사이트)
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.
EN Dark Reading · 보안 · 2026.10.17 - Critical BlockStrap flaw lets hackers run code on Magento servers (새 창 · 바깥 사이트)
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...]
EN BleepingComputer · 보안 · 2026.10.17 - Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk (새 창 · 바깥 사이트)
Campaigns that impersonate popular AI brands are on the rise, and they typically use ClickFix-like tactics to target unsuspecting enterprise employees.
EN Dark Reading · 보안 · 2026.10.17 - Biomemory Launches DNA Shield, First Commercial Product Built on Its Molecular IT Platform (새 창 · 바깥 사이트)
The launch follows the acquisition of catalog's assets and the appointment of Laurent Guengant as CEO earlier this year.
EN Dark Reading · 보안 · 2026.10.17 - Enterprise AI Enters Risk Management Phase as Security Concerns Rise (새 창 · 바깥 사이트)
Companies are increasingly discovering that the challenge with AI is no longer adoption, but execution.
EN Dark Reading · 보안 · 2026.10.17 - AI Takes Control of Robotic Arm in 16 Minutes Flat (새 창 · 바깥 사이트)
Most OT devices at utilities, factories, and elsewhere have been deployed for a decade or more, but operators need to get agile and deploy new cyber defenses.
EN Dark Reading · 보안 · 2026.10.17 - Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug (새 창 · 바깥 사이트)
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, wh…
EN The Hacker News · 보안 · 2026.10.17 - Targeted ads installed Candiru spyware in zero-click attacks (새 창 · 바깥 사이트)
Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. [...]
EN BleepingComputer · 보안 · 2026.10.17 - Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor (새 창 · 바깥 사이트)
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows w…
EN The Hacker News · 보안 · 2026.10.17 - UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing (새 창 · 바깥 사이트)
Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harves…
EN The Hacker News · 보안 · 2026.10.17 - OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract (새 창 · 바깥 사이트)
OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ethereum test network, spent test cryptocurrency from a third-party's wallet without…
EN The Hacker News · 보안 · 2026.10.16 - When Your Ransomware Negotiator Works for the Other Side (새 창 · 바깥 사이트)
The shocking arrest of a well-known ransomware negotiator reveals the critical need for vendor program oversight.
EN Dark Reading · 보안 · 2026.10.16 - Employees using personal ChatGPT at work? Here's what IT admins need to do (새 창 · 바깥 사이트)
Employees using personal ChatGPT accounts at work can expose sensitive company data, even when their organization provides an approved Enterprise workspace. NordLayer explains how IT teams can investigate unauthorized AI use and block sensitive information before it reaches perso…
EN BleepingComputer · 보안 · 2026.10.16 - When AI Agents Commit Breaches, Humans May Not Be Held Liable (새 창 · 바깥 사이트)
As agents escape containment and access external systems, responsibility remains human. Accountability, however, is much less settled.
EN Dark Reading · 보안 · 2026.10.16 - Hackers disguise phishing as promising business opportunities (새 창 · 바깥 사이트)
Attackers are breaking into business email accounts with short messages asking whether a company can quote on an upcoming project, the kind of request sales and procurement staff answer every week. Cadence Riddle, a cybersecurity researcher at Fortra, tracked a 12-fold increase i…
EN Help Net Security · 보안 · 2026.10.16 - Burger King Japan data breach exposes 11 million customer records (새 창 · 바깥 사이트)
Burger King Japan, the Japanese subsidiary of global fast-food giant Burger King, disclosed a major data breach after attackers accessed a server containing 11.18 million customer records. [...]
EN BleepingComputer · 보안 · 2026.10.16 - CISA Adds Two Known Exploited Vulnerabilities to Catalog (새 창 · 바깥 사이트)
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoof…
EN CISA Advisories · 보안 · 2026.10.16 - Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials (새 창 · 바깥 사이트)
CISA and the Federal Bureau of Investigation (FBI) released a Public Service Announcement (PSA) warning election and campaign officials about cyber threats during the 2026 U.S. midterm elections. Malicious cyber actors may use phishing and smishing techniques to steal login crede…
EN CISA Advisories · 보안 · 2026.10.16 - CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support (새 창 · 바깥 사이트)
CISA is aware of critical authentication bypass vulnerability CVE-2026-102764 , affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade fir…
EN CISA Advisories · 보안 · 2026.10.16 - Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation (새 창 · 바깥 사이트)
The National Institute of Standards and Technology (NIST), National Security Agency’s Super Intelligence Security Center (NSA SISC) and Cybersecurity and Infrastructure Security Agency (CISA) published Key Practices for Incident Readiness and Response in Super Intelligence Trai…
EN CISA Advisories · 보안 · 2026.10.16 - Scammers clone candidates’ voices to steal cash and voter data ahead of 2026 midterms, FBI warns (새 창 · 바깥 사이트)
Three weeks before Americans vote in the 2026 midterm election, fraudsters are borrowing candidate names, logos and slogans to collect fake donations and harvest personal data, the FBI warned. “The FBI warns the public that scammers could exploit the 2026 US Midterm Election to…
EN Help Net Security · 보안 · 2026.10.16 - AI Decision Models and Their Impact on AI SOC Platforms (새 창 · 바깥 사이트)
In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own Decisions API at DevDay and opened a public b…
EN The Hacker News · 보안 · 2026.10.16
제목과 요약의 저작권은 각 매체에 있습니다. PLANCK는 링크만 모아 보여 주며 내용을 고치거나 번역하지 않습니다. 피드(제목 · 링크)