KDZONE 情報站

資料外洩查詢服務Have I Been Pwned（HIBP）上周揭露，AI音樂生成平臺Suno曾於2025年11月遭到駭客入侵。HIBP取得並分析外洩資料後，確認其中包含5,530萬個不重複的電子郵件地址，以及電話號碼、姓名、實體地址、消費紀錄與部分信用卡資料。

Article URL: https://misago-project.org/t/removing-reactjs-from-the-codebase-and-adapting-htmx-for-ui-interactivity/1267/ Comments URL: https://news.ycombinator.com/item?id=49067301 Points: 236 # Comments: 166

OpenJDK將簡易JSON API提案列為JEP 540候選案，計畫在JDK提供基本的JSON解析與產生能力，讓Java程式處理簡單JSON資料時，不必另外加入外部函式庫。該提案目前仍處於候選階段，API仍可能在孵化期間調整，尚未指定目標JDK版本。 JSON是網路服務與應用程式交換資料時常用的格式，但Java標準函式庫長期沒有通用的JSON處理介面。開發者目前多半需要自行選擇外部套件，JEP 540則希望為較單純的工作提供JDK內建選項，減少安裝、版本管理及安全維護等額外負擔。

西門子用於整合工廠製造流程與生產營運管理的Opcenter X平臺，被發現存在可能讓攻擊者取得完整系統存取權限的重大漏洞。西門子近日發布資安公告，修補Opcenter X的重大漏洞CVE-2026-56451，CVSS v3.1與v4.0嚴重性評分均達10.0分，可能導致攻擊者繞過身分驗證並取得系統完整存取權限，由於這套平臺負責連結製造流程與營運管理資訊，若遭攻擊者取得平臺存取權限，可能影響企業的製造管理與生產營運，用戶須立即升級至已完成修補的V2604以上版本。

為了協助資安應變人員在處理DNS威脅時的行動缺口，國際資安組織FIRST在今年5月底發布DNS濫用技術矩陣（DNS Abuse Techniques Matrix）1.3版，目的是在相關事件發生時，幫助資安團隊快速找到可協助偵測、緩解或預防該技術的利益關係人（stakeholders）。

TanStack Table V9 is a beta release of a headless UI library for creating tables in various JavaScript frameworks. It features improved state management, memory usage, and extensibility. The notable change is an opt-in feature model, allowing developers to load only necessary com…

Python套件索引服務PyPI開始拒絕向發布超過14天的套件版本新增檔案，避免專案發布憑證或自動化流程遭入侵後，攻擊者向長期穩定的舊版本加入惡意程式。PyPI表示，目前尚未發現這種攻擊方式遭實際利用，但在此之前並無技術限制阻止這種做法。

AI從程式碼補全工具，開始走進完整開發流程。不只參與需求釐清、規格拆解、程式生成、測試與除錯，不少企業更重新檢視開發方法、品質控管與團隊分工。當工作重心從「怎麼做」轉向「做什麼」，工程師的定位也開始改變。

依據資安媒體BleepingComputer的報導，美國快遞業者OnTrac於7月22日通知客戶，駭客曾入侵該公司網路，可能取得包含個人資料的檔案。OnTrac是美國主要包裹快遞業者之一，目前在35州設有102個據點，配送範圍涵蓋約70%的美國人口，並與超過7,000名獨立配送承包商合作，其資料外洩可能影響大量客戶。

AI程式開發代理人Devin的開發商Cognition上周四（7/23）宣布，已收購簡訊AI助理Poke的開發商The Interaction Company of California，計畫把Poke主動聯絡使用者、持續追蹤任務及較像朋友的對話方式導入Devin。

本日新聞焦點 ● 中國駭客透過AI代理於泰國財政部從事網路間諜活動 ● 勒索軟體Clop滲透Windchill與FlexPLM並向用戶寄勒索信 ● 勒索軟體Chaos打造將C2藏在瀏覽器的木馬程式msaRAT

微軟Active Directory憑證服務（AD CS）存在名為Certighost的權限提升漏洞，在研究人員測試的特定配置下，持有一般網域帳號的攻擊者可誘使憑證授權單位簽發帶有網域控制站身分資訊的憑證，藉此冒充網域控制站，取得網域內的帳號機密。該漏洞編號為CVE-2026-54121，微軟已於7月14日發布更新修補。

一般而言，駭客為了隱匿C2通訊，最常見的其中一種作法，就是濫用合法的雲端服務來建立通訊，以這些服務的合法流量來掩蓋非法活動。現在有駭客團體採用全新的手法來達到目的，引起研究人員的注意。

資安業者Flare近日分析2024年至2026年歐洲、中東與非洲（EMEA）地區的勒索軟體活動，觀察到14個鎖定EMEA醫療業的勒索組織，且攻擊活動已擴大至整個醫療保健供應鏈，涵蓋醫院、診所、遠距醫療、診斷實驗室、藥局、醫療軟體與設備供應商、醫療人力服務及公共衛生機構，一些原本以攻擊政府單位為主的駭客組織，近幾個月來也大幅增加對醫療業的攻擊。

Anthropic上周五（7/24）推出Claude Opus 5，主打程式設計、知識工作及電腦操作等日常任務，效能接近前沿模型Claude Fable 5，但使用成本僅約一半。Opus 5即日起成為Claude Max方案的預設模型，也是Claude Pro方案提供的最強模型。

微軟上周五（7/24）發布《開放權重與美國AI領導地位》聯合公開信，呼籲美國決策者支持開放權重AI模型，避免過早限制可供下載的模型。目前連署者包括Meta、微軟、Nvidia、OpenAI、Google、IBM、AMD、GitHub、Hugging Face及Linux基金會等業者與組織。

三年前烏克蘭電腦緊急應變團隊（CERT-UA）揭露俄羅斯駭客UAC-0099的攻擊行動，後續資安公司Deep Instinct公布進一步的調查結果，指出駭客的主要目標是境外公司的烏克蘭員工，透過多種管道在受害電腦植入惡意程式LonePage，其中一種是WinRAR已知漏洞CVE-2023-38831。如今CERT-UA指出，這些駭客手法出現了顯著變化。

WordPress開發團隊宣布，React 19不會納入WordPress 7.1，該版本將繼續使用React 18.3。團隊先前曾在Gutenberg外掛中短暫啟用React 19，但測試發現，新舊React版本之間的互動，以及部分外掛使用React的方式，會引發未預期的相容問題，因此撤回這項變更，並需要較長的測試期，持續改善及調整相容層。

去年聲稱從許多企業組織的Oracle E-Business Suite（EBS）竊得大批資料的勒索軟體駭客Clop（FIN11、Lace Tempest、Graceful Spider），近期發動新一波攻擊，並向許多企業組織寄送勒索信的情形。

Article URL: https://nikolays.github.io/PGSimCity/ Comments URL: https://news.ycombinator.com/item?id=49063754 Points: 315 # Comments: 39

Article URL: https://github.com/vercel-labs/scriptc Comments URL: https://news.ycombinator.com/item?id=49063175 Points: 217 # Comments: 109

Article URL: https://www.techspot.com/news/113236-us-prosecutors-charge-atlanta-man-after-grapheneos-phone.html Comments URL: https://news.ycombinator.com/item?id=49063022 Points: 431 # Comments: 273

Plus Mike Flanagan's Carrie teaser, trailers for Dark Matter S2 and Matchbox the Movie , and Marvel news.

Article URL: https://www.theclimatebrink.com/p/the-strongest-el-nino-ever Comments URL: https://news.ycombinator.com/item?id=49060978 Points: 204 # Comments: 189

Article URL: https://beyondloom.com/decker/ Comments URL: https://news.ycombinator.com/item?id=49060856 Points: 209 # Comments: 44

Article URL: https://www.france24.com/en/live-news/20260726-french-firefighters-face-pyrocumulonimbus-for-first-time Comments URL: https://news.ycombinator.com/item?id=49060495 Points: 248 # Comments: 144

Article URL: https://stephango.com/design-is-compromise Comments URL: https://news.ycombinator.com/item?id=49059367 Points: 216 # Comments: 76

Article URL: https://aerospaceglobalnews.com/news/gatwick-airport-robotic-parking-stanley-robotics/ Comments URL: https://news.ycombinator.com/item?id=49058669 Points: 216 # Comments: 158

Article URL: https://sunflowersgame.com/ Comments URL: https://news.ycombinator.com/item?id=49057666 Points: 207 # Comments: 68

Article URL: https://www.wsj.com/tech/google-discloses-94-1-billion-in-spacex-stock-marking-6-stake-91655d7c Comments URL: https://news.ycombinator.com/item?id=49057574 Points: 254 # Comments: 200

Article URL: https://pkg.go.dev/golang.org/x/tools/go/analysis Comments URL: https://news.ycombinator.com/item?id=49057398 Points: 212 # Comments: 70

Article URL: https://english.mapn.ro/ Comments URL: https://news.ycombinator.com/item?id=49057248 Points: 208 # Comments: 249

Article URL: https://swag.htmx.org/en-cad/products/htmx-4-the-game Comments URL: https://news.ycombinator.com/item?id=49057241 Points: 252 # Comments: 80

Article URL: https://killthecookiebanner.eu/ Comments URL: https://news.ycombinator.com/item?id=49057175 Points: 518 # Comments: 263

JFrog Security Research revealed "PixelSmash," a vulnerability in the FFmpeg media framework, allowing for Remote Code Execution and Denial of Service attacks. Present for sixteen years, it affects numerous applications using the MagicYUV decoder. Exploitation requires only a cra…

Article URL: https://astral.sh/blog/ruff-v0.16.0 Comments URL: https://news.ycombinator.com/item?id=49056112 Points: 320 # Comments: 195

Amazon EKS has recently introduced support for Kubernetes version rollbacks, letting practitioners revert a cluster's control plane to its previous Kubernetes version within 7 days of an upgrade if issues arise. The feature reduces the risk of in-place cluster upgrades by giving …

Article URL: https://discuss.grapheneos.org/d/40700-grapheneos-protections-against-data-extraction-from-locked-devices Comments URL: https://news.ycombinator.com/item?id=49055169 Points: 314 # Comments: 195

Article URL: https://www.jetzero.aero Comments URL: https://news.ycombinator.com/item?id=49054224 Points: 170 # Comments: 123

Article URL: https://blog.ktz.me/esp32-plane-radar/ Comments URL: https://news.ycombinator.com/item?id=49054107 Points: 245 # Comments: 53

I got tired of Googling basic course info, so I made a free directory of every US course Google filters for golf course results are terrible so I built a better way to browse courses using OSM as the backbone.... https://golfcoursebrowser.com/ It's a work in progress and mostly U…

Article URL: https://huggingface.co/owensong/Inflect-Micro-v2 Comments URL: https://news.ycombinator.com/item?id=49053375 Points: 193 # Comments: 24

Article URL: https://github.com/demo-zexuan/liang-wenfeng-investor-meeting-2026-7-22/blob/master/%E6%A2%81%E6%96%87%E9%94%8B%E6%8A%95%E8%B5%84%E8%80%85%E4%BA%A4%E6%B5%81%E4%BC%9A-%E6%96%87%E5%AD%97%E7%A8%BF_1_18_translate_20260723201651.pdf Comments URL: https://news.ycombinator.…

Article URL: https://siepr.stanford.edu/publications/policy-brief/what-really-happening-jobs-separating-ai-hype-reality Comments URL: https://news.ycombinator.com/item?id=49052570 Points: 223 # Comments: 296

Article URL: https://spectrum.ieee.org/sodium-ion-battery-peak-energy Comments URL: https://news.ycombinator.com/item?id=49051947 Points: 196 # Comments: 94

Also: Forging the One Ring in Rings of Power S3 teaser; new Lanterns trailer; Spaceballs: The New One panel.

Article URL: https://fly.io/blog/kurt-scott-money-sprites/ Comments URL: https://news.ycombinator.com/item?id=49051369 Points: 189 # Comments: 126

Article URL: https://claude.com/blog/the-new-rules-of-context-engineering-for-claude-5-generation-models Comments URL: https://news.ycombinator.com/item?id=49051361 Points: 289 # Comments: 177

Article URL: https://didtheyghostyou.com/ Comments URL: https://news.ycombinator.com/item?id=49051120 Points: 372 # Comments: 165

Article URL: https://www.theguardian.com/us-news/ng-interactive/2026/jul/25/flock-surveillance-cameras Comments URL: https://news.ycombinator.com/item?id=49050538 Points: 228 # Comments: 134

SpaceX will likely attempt to catch Starship back at the launch pad on its next flight.

The UK MET office recently redesigned their site, adding a lot of additional whitespace, scrolling, and animations. This significantly reduced its usability for me, and left me wanting an ‘at a glance’ weather site. I made https://brolly.sh , a minimalist, plain text weather fore…

Article URL: https://kirwinhampshire.substack.com/p/the-dark-night-of-mathematics Comments URL: https://news.ycombinator.com/item?id=49048681 Points: 190 # Comments: 240

Article URL: https://tobi.knaup.me/2026-07-25-open-weight-ai-is-having-its-kubernetes-moment/ Comments URL: https://news.ycombinator.com/item?id=49048034 Points: 160 # Comments: 108

Article URL: https://radicle.network/nodes/rosa.radicle.network/rad%3Az2v9tRJz1oknFAqCSY5W5c76nVvm6 Comments URL: https://news.ycombinator.com/item?id=49047365 Points: 232 # Comments: 128

本週二Google發布Chrome穩定版更新150.0.7871.181版與150.0.7871.182版，不料兩天後突然又推出新版本，針對Windows與macOS提供150.0.7871.186版與150.0.7871.187版，針對Linu

Museums are embracing data-driven curation and a shifting technology landscape.

Researchers say TikTok, X, and Meta aren't providing data they're legally required to.

Engineers are increasingly arguing that modern LLMs can already reason through root cause analysis once given correctly prepared context, shifting the hard problem to the pipelines that correlate telemetry. A Coroot experiment across eleven models offers early evidence for the cl…

Article URL: https://www.augmental.tech/ Comments URL: https://news.ycombinator.com/item?id=49045446 Points: 173 # Comments: 38