KDZONE 情報站

OpenAI產品負責人Thibault Sottiaux周四（9/10）透過X宣布，由於GPT-6 Astra推出後需求爆量，OpenAI將暫停每月200美元Pro方案的新訂閱及升級，以確保既有用戶能持續使用Astra，其它ChatGPT方案與API則維持開放。

本週資安公司Check Point發布公告，該公司於9月9日修補兩個與VPN有關的重大漏洞，有可能導致未經授權的攻擊者在特定情況下遠端執行程式

9月8日資安公司Fortinet發布一系列資安更新，修補10個弱點，其中有兩個為重大等級而成為焦點。根據CVSS嚴重程度評分，最嚴重的是FortiMonitorOnSight漏洞CVE-2026-84390，此為特定JWT權杖能用於網頁介面身分驗證的問題，未經身分驗證攻擊者能利用偽造或已使用過的JWT，繞過FortiMonitorOnSight入口網站的身分驗證流程，CVSS評分為9.6，影響7.2.0至7.2.2、7.2.4至7.2.7版FortiMonitorOnSight，用戶應升級至7.2.8版緩解弱點。

行政院長卓榮泰周四在行政院治安會報中表示，加密勒索事件已影響科技、製造、醫療、零售及旅遊等多元產業，不僅涉及企業營運安全，也攸關產業發展、社會安定，甚至是國家安全。 卓榮泰要求數位發展部擔任跨機關資安情資統籌單位，針對民間企業資安防護需求研訂參考指引，並將民間企業發生的重大駭侵或加密勒索案件納入通報義務，建立政府、企業與執法機關間的情資交流與預警機制，提升整體資安防護與應變能力。

Anthropic本周公布了AI濫用威脅報告，揭露各界濫用其模型Claude的各種型態，從網路攻擊、資訊操弄、AI輔助監控、開發傳統武器、生物濫用、詐騙與詐欺，以及非法蒸餾等，並直接點名7家中國AI實驗室的非法蒸餾行為，包括阿里巴巴的Qwen、月之暗面（Moonshot）、DeepSeek、智譜（Z.ai）、小米、商湯及MiniMax等。

根據民視新聞網的報導，勒索軟體Everest於9月1日聲稱入侵台達電旗下的網路攝影機廠商晶睿通訊（Vivotek），從中竊取236 GB內部資料，總共近9.5萬個檔案，其中包括網路攝影機與網路錄影機相關韌體、原始程式碼，以及開發、測試與維修資料，這些駭客公開其中一份56頁的技術報告資料，要

歐盟《網路韌性法案》（CRA）今（11）日起率先適用漏洞與重大資安事件通報義務，並將於2027年12月全面適用。隨著法規逐步上路，如何全面因應CRA，也成為電子與半導體供應鏈近期高度關注的議題。以TPU與MCU聞名的新唐科技，在9月9日舉行新品發表活動之際，特別以智慧家庭裝置及工業閘道器的產品架構為例，闡釋MCU、MPU在CRA合規中扮演的角色，並回應業界常見的疑問：為了符合CRA，產品中的MCU是否都必須升級？

隨著企業IT環境跨足雲端、營運技術（OT）、IoT及AI代理，傳統依賴IP位址、VLAN及固定網路拓樸的分段方式，愈來愈難因應不同系統之間持續變動的通訊關係。

近期Cylake宣布完成2.45億美元募資，這家資安新創由Palo Alto Networks創辦人Nir Zuk、SentinelOne共同創辦人Udi Shamir及Wilson Xu共同成立，這次募得資金將用於資安平臺開發與團隊擴充，產品預計2026年底推出Beta版，並於2027年正式推出。

資料勒索組織ShinyHunters近期對全球醫療產業發動語音網釣攻擊。醫療產業資安資訊分享與分析中心Health-ISAC發布資安警訊，攻擊者近期註冊帶有醫療產業意涵或結合受害企業名稱的仿冒網域，顯示攻擊範圍正擴大至醫療機構營運及特定業務單位。

電力系統一旦遭到網路攻擊並引發停電，供水、通訊、交通與醫療等重要服務也可能受到波及。

TinyGo version 0.42 introduces significant updates, including recoverable panics and support for Go 1.27 and LLVM 22, improving error handling and enabling Go code to run as UEFI applications. The TinyGo Starter Kit with Seeed Studio XIAO facilitates hardware use for developers, …

Datasette 1.0a39 and 0.65.4 security releases Today we're releasing two new security patch versions of Datasette: 1.0a39 and 0.65.4 - one for the current alpha series and one for the stable 0.65.x family. These are security fixes which you should apply if you are running a Datase…

今年3月美國網路安全暨基礎設施安全局（CISA）警告，去年10月揭露的重大漏洞CVE-2025-53521已被實際利用，該問題存在於F5 BIG-IP元件Access Policy Manager（APM），CVSS v4.0嚴重性評分達到9.3分，如今傳出新一波漏洞利用活動。

9月9日美國網路安全與基礎設施安全局（CISA）更新已遭利用的漏洞名單（KEV），其中一個被加入的是思科防火牆管理平臺Secure Firewall Management Center（FMC）漏洞CVE-2026-20079，CVSS嚴重程度評為10分，相當危險。同一天思科威脅情報團隊Talos指出，有國家級駭客團體用於攻擊活動。

政府求職網站明明有許多職缺，為什麼求職者輸入關鍵字後，還是找不到適合自己的工作？ 問題不是職缺太少，而是求職者和系統「說不同語言」。一般求職者找的是「土水師傅」，政府職業分類寫的卻是「泥作工作人員」；雇主說要找「AI工程師」，現行職業編碼卻把它歸在「軟體開發及程式設計師」。只要雙方用詞不同，傳統仰賴精確關鍵字的系統，就可能錯過適合的媒合機會。

DeepSeek周四（9/10）發表新一代AI模型V4.1-Flash，採用全新的Causal Encoder-Decoder（CED）架構，為DeepSeek新架構家族中的首款也是最小型模型。DeepSeek宣稱，V4.1-Flash不僅推論速度及吞吐量更高，在多項基準測試的整體表現也超越上一代旗艦V4-Pro。

OpenAI周四（9/10）推出金融業專用的ChatGPT for Financial Services，以ChatGPT Work為基礎，結合GPT-6 Astra與專業金融資料，協助金融機構進行研究、建立財務模型及製作客戶資料，目前僅提供符合資格的金融機構使用。

上週末波蘭電腦緊急事件應變團隊CERT Polska警告，他們借助AI的力量找出多個MikroTik路由器作業系統RouterOS的資安弱點，並指出其中有部分漏洞自9月2日被用於實際攻擊，呼籲用戶儘速套用MikroTik發布的更新。

Any Nix package, live in your browser Farid Zakaria calls this his " magnum opus of Nix work", and I can see why. trynix.dev provides a qemu-wasm powered x86_64 Linux virtual machine running entirely in your browser through WebAssembly. That VM can then be booted with any Nix pac…

Laptops don't usually get hot enough to burn—but they can still be harmful.

Nvidia has its finger in every pie, and sees another year of plenty in its future, Jensen Huang says. But, he insists, its deals are not circular.

Mark Wahlberg joins Bruce K. Lee at Disrupt to discuss investing, entrepreneurship, healthcare, wellness and building businesses.

Checking agent-generated code usually means hopping between tabs. Learn how to view diffs, run terminal commands, and preview web apps side by side in the GitHub Copilot app. The post GitHub Copilot app for Beginners: Using the diff, terminal, and browser appeared first on The Gi…

Native is now the future of mobile at Shopify Shopify are moving from React Native back to separate Swift and Kotlin codebases for their native apps, for the exact reason you would expect: We decided to switch from native to React Native in 2020 for three reasons: Stop building t…

The company said Pro subscriptions put the most strain on its systems, so it's pausing sign-ups while adding more capacity.

A new report released Thursday by Anthropic alleges persistent distillation attacks by China-based AI companies, which have escalated in recent months as competition in the space has intensified.

Judge tosses lawsuits, says plaintiffs didn't allege any real privacy violation.

Meta's newest app Muse is off to a slower start than the company's other apps, like Meta AI or Threads.

Europe is looking inward, and perhaps to China, as the White House tries to cancel some NASA partnerships.

App support is slim right now, but Google says more are coming.

"Bankruptcy cannot become the new land grab for AI.”

Come inside the mind of a bot trying to convince the internet it's human.

The trick from Next Generation would be even more effective in real life.

OpenAI has released GPT-6 Astra, a new model focused on coding, computer use, long-running agentic tasks, and cybersecurity, with availability across ChatGPT, Codex, and the OpenAI API. By Daniel Dominguez

Pocket FM uses AI to produce 99% of its new content, helping make content production about 80 times cheaper.

Talarico talk to be on YouTube to save ABC stations the hassle of dealing with FCC.

DJI drones that already supply Mount Everest camps assist Nepal’s flood relief.

Article URL: https://graybeard.ing/software-drives-people-insane/ Comments URL: https://news.ycombinator.com/item?id=49646181 Points: 323 # Comments: 123

César de la Fuente’s lab uses Codex and ChatGPT to search living and extinct genomes for antimicrobial candidates to fight drug-resistant infections.

Search can help runners get race-day ready with registration alerts, tailored training plans, and more.

Article URL: https://cognition.com/blog/swe-2 Comments URL: https://news.ycombinator.com/item?id=49645443 Points: 290 # Comments: 120

https://dstretch.com/DecorrelationStretch.pdf https://www.nasa.gov/technology/tech-transfer-spinoffs/nasa-... Comments URL: https://news.ycombinator.com/item?id=49645437 Points: 292 # Comments: 46

Article URL: https://blog.jim-nielsen.com/2026/hands-off-my-cables/ Comments URL: https://news.ycombinator.com/item?id=49645393 Points: 288 # Comments: 223

Meet the Data agent in ChatGPT Work. Connect company data, uncover insights, and build interactive dashboards with AI using natural language.

“The vast majority of cases we find are people who are entitled to claim for something, claiming for that thing,” the researcher told TechCrunch.

Maven Robotics emerged from stealth today with a $100 million Series A and active deployments.

Article URL: https://shopify.engineering/back-to-native Comments URL: https://news.ycombinator.com/item?id=49643982 Points: 359 # Comments: 243

I've reset this more than once and the last time I made a careful note of when I did it and to my surprise I found it re-enabled when I checked just now. Make sure you check this thing to see if it hasn't been re-enabled if you believe it to be off right now. Comments URL: https:…

Article URL: https://rustfoundation.org/media/guest-post-rust-is-tier-1-language-at-microsoft/ Comments URL: https://news.ycombinator.com/item?id=49643546 Points: 326 # Comments: 157

1.1.1.1 now validates DNSSEC signatures using NIST’s post-quantum ML-DSA-44 algorithm. Here is how we manage 2,420-byte signatures and downgrade risks at scale.

Article URL: https://consumerrights.wiki/w/Sony_PlayStation_digital_game_ownership_lawsuit Comments URL: https://news.ycombinator.com/item?id=49642531 Points: 301 # Comments: 98

為了降低遭到偵測與阻擋的機率，駭客在攻擊活動中藉助合法雲端平臺服務作為C2管道的案例，近來逐漸增加，Cisco資安威脅研究團隊Talos近日揭露的一起ClickFix攻擊事件便是其中的典型。

"Artemis II is done."

Cisco修補Nexus 9000系列交換器的重大漏洞CVE-2026-20212，影響搭載Silicon One ASIC的機型，以及這些機型對應的NX-OS 10.x版軟體，Cisco已發布修補版本，建議用戶使用Software Checker確認自身交換器所對應的NX-OS修補版本，在修補完成前，也可先行下載

頂尖AI模型的自主操作能力持續提升，既有安全控管是否跟得上也成為產業焦點。OpenAI於9月9日呼籲美國建立聯邦層級的強制性AI安全規範，主要適用於開發頂尖AI系統、資源充足的少數業者，要求依模型能力與風險接受安全測試及獨立評估，並強化網路安全防護與重大事件通報。

9月9日資安公司Proofpoint指出，他們從8月底發現使用漏洞利用工具包BlueMoon的活動，此工具包串連兩個Chrome零時差漏洞，以及一個Windows近日修補的零時差漏洞，而對於攻擊者的身分，最早使用的是被稱做TA412、APT31、Violet Typhoon，或JungleBamboo的中國駭客組織，後續該公司看到UNK_LateNight、UNK_Dou

新加坡新創資安研究團隊Kinryū Labs於9月9日揭露一起疑似航班旅客系統資料庫外洩事件。研究人員於6月3日發現一個存放於越南河內、疑似與航班乘客資訊系統（APIS）相關的Elasticsearch資料庫，該資料庫包含2017年1月至2026年4月的2.2億筆旅客及機組員紀錄，涉及1,008家航空公司及全球多國旅客，其中的資料包括姓名、生日、性別、國籍、護照號碼、航班、起降及轉機機場、座位與行李資訊，但這些是旅行紀錄而非2.2億名不同個人。

Autonomous teams are an article of faith in modern software development. The shape of our value determines what we can do; it determines our trade-offs between agency and coherence. We all have a purpose, and we all have agency to do something, hence the suggestion is moving from…

Article URL: https://honestlyranked.com/guides/streaming-price-increases/ Comments URL: https://news.ycombinator.com/item?id=49641215 Points: 334 # Comments: 301