KDZONE 情報站

Article URL: https://qwen.ai/blog?id=qwen-image-3.0 Comments URL: https://news.ycombinator.com/item?id=48989701 Points: 232 # Comments: 108

GitLab has released version 19.2 of its DevSecOps platform, adding agentic automation aimed at the security and review work that has piled up as AI coding tools generate more code than developers can check by hand. The release, announced on 16 July 2026, brings four features out …

OpenAI and Hugging Face share early findings from a security incident during AI model evaluation, highlighting advanced cyber capabilities and lessons for defenders.

微軟發布公開預覽中的WinApp VS Code擴充套件v0.2，新增AppxManifest視覺化編輯器，讓開發者透過表單調整Windows應用程式封裝資訊，不必直接修改XML。新版也支援工作區內的多專案偵測，開發者可維持開啟儲存庫根目錄，直接對工作區中的專案執行初始化、執行、除錯、封裝與簽署等指令。

法國資安公司Lexfo近日揭露，研究人員從一臺錯誤設定、在網路上公開啟用目錄列表的Python網頁伺服器，發現3名攻擊者各自利用客製的Evilginx釣魚工具，對Microsoft 365用戶發動釣魚攻擊，竊取帳號憑證與驗證權杖，顯示攻擊者可利用公開GitHub程式碼庫，快速建立釣魚攻擊基礎設施。

隨著電子商務會員帳號安全日益受重視，不只是金融業，提供各類醫療、保健與護理用品的「杏一醫療」（MedFirst），自去年起亦導入FIDO無密碼登入機制。該公司近日分享會員端的導入實務經驗，並透露年底將把FIDO技術進一步延伸，應用於供應商系統登入及企業帳號管理。 從數位會員管理到會員SSO認證架構建立，如今更進一步導入FIDO無密碼登入 成立36年的杏一醫療，從早年一間位於長庚急診室對面二樓的門市，發展成如今五大事業群，全臺總計有314家門市、29個商場體系，並涵蓋布品洗滌、居家照護用品批發代理，是臺灣規模最大的醫療護理用品零售連鎖通路。

英國醫療軟體業者Craneware於7月20日向倫敦證卷交易所通報發生資安事件，表示該公司部分資料環境遭到非授權存取， 部份客戶、合作夥伴紀錄及大量員工資料遭竊。該公司提供醫療財務、計費與藥局管理軟體，客戶涵蓋超過2,000家美國醫院、近1萬家診所與零售藥局，因而此次事件可能牽涉廣泛的醫療產業客戶。

資安業者Kaspersky近日揭露新型惡意軟體框架OkoBot，可結合多種惡意軟體元件，竊取加密貨幣錢包及其他敏感資料，目前已有25個國家數百人受害，主要位於巴西、越南、加拿大、墨西哥與土耳其。研究人員觀察到，這款惡意軟體的伺服器會拒絕來自俄羅斯與其他前蘇聯地區國家的連線，部分程式碼也包含俄語註釋，推測可能有俄語系人士參與其中。

Google預告將在2026年底調整其Nearby Connections API預設行為，未來Wi-Fi或藍牙關閉時，API不再替Google自家及第三方App自動開啟相關無線功能。使用這項API的開發者必須在執行鄰近裝置探索或連線工作前，確認所需功能已啟用，否則應通知使用者並引導其手動開啟。

本日新聞焦點 ● 勒索軟體駭客D1R聲稱竊得晶片設計軟體廠客戶資料 ● 韓國外交官培訓平臺遭零時差漏洞攻擊，駭客滲透近10個月 ● 東南亞政府與外交機構遭後門GoSerpent攻擊

Article URL: https://asia.nikkei.com/business/technology/five-us-tech-giants-hidden-debts-soar-to-1.65tn-on-opaque-ai-funding Comments URL: https://news.ycombinator.com/item?id=48987863 Points: 241 # Comments: 112

Article URL: https://github.com/janestreet/incremental Comments URL: https://news.ycombinator.com/item?id=48987822 Points: 236 # Comments: 42

資安業者Group-IB於7月20日揭露新型惡意軟體HollowGraph，攻擊者利用Microsoft 365行事曆與Microsoft Graph API建立隱蔽的命令與控制（C2）通道，藉由受信任的微軟雲端服務來傳遞指令與資料，避免直接連線至攻擊者控制的伺服器。Group-IB目前發現12臺受感染主機，受害對象主要位於以色列，研判這是一起高度針對性的攻擊。

新加坡南洋理工大學、新加坡科技研究局（A*STAR）及美國約翰霍普金斯大學研究人員發表AI代理攻擊框架MemGhost，可透過單封電子郵件投遞惡意指令，誘使具備長期記憶的個人AI代理將假資訊寫入持續性狀態，且不在當次回覆中透露記憶已遭修改。使用者日後提出相關要求時，代理可能載入受污染的記憶，進而改變回答或執行行為。

「如果AI今天也能通過CISSP考試，你的價值是什麼？」ISC2臺北分會理事長唐任威日前在臺灣資安大會（CYBERSEC 2026）的兩場演講中，反覆拋出這個問題。他並非要嚇唬臺灣的資安工作者，而是希望提醒大家開始思考「對的焦慮」。 他認為，錯誤的焦慮是問「我的工作會不會消失」，把注意力放在職位、名稱是否還存在；但正確的焦慮則是問「我還認得我的工作嗎？」，重點是要警覺工作內容正在發生質變。唐任威強調，這個時代的資安工作並沒有真的不見，只是正在變成許多人認不出的樣子。

7月20日韓國外交部發布新聞稿，說明所屬韓國國立外交院（Korea National Diplomatic Academy，KNDA）的線上教育系統遭到網路攻擊。外交部於2026年2月初接獲相關機關通報異常存取情況後，緊急關閉該系統，並與相關單位展開調查。 調查顯示，身分不明的攻擊者利用外交院線上教育系統伺服器軟體的零時差漏洞，以及系統安全設定缺失，於2025年4月至5月間取得伺服器控制權，並持續存取至2026年2月，歷時近10個月。

美國聯邦調查局（FBI）網路犯罪投訴中心（Internet Crime Complaint Center，IC3）周一（7/20）警告，有詐騙集團假冒FBI人員，鎖定曾經遭到詐騙的受害者，謊稱能協助追回失款，藉此再次騙取個人資料與金錢。 FBI表示，詐騙集團會透過電子郵件、電話、社交媒體及網路論壇接觸受害者，或建立假的FBI人員帳號與專頁。其中一名受害者在告知詐騙者準備向FBI報案後，隨即收到假冒FBI探員者透過Facebook Messenger聯絡，之後再轉往Telegram交談。

資安業者Pillar公開一系列AI程式代理安全研究，指出Cursor、OpenAI Codex CLI、Google Gemini CLI及Antigravity等開發工具，出現多條可跨越沙箱邊界的途徑。多數案例並非AI代理直接突破沙箱，而是先在程式專案資料夾內建立或修改檔案，再由沙箱外的開發工具或Git功能執行，另有案例是代理透過位於沙箱外的Docker服務，在特定設定下間接取得主機操作能力。

中國資安業者奇安信X實驗室上周五（7/17）揭露，一個名為NadMesh的新型殭屍網路正大規模掃描並入侵AI基礎設施與模型脈絡協定（Model Context Protocol，MCP）服務。它整合逾20種遠端程式碼執行（RCE）攻擊，可在幾乎無人介入下完成尋找目標、入侵、植入惡意程式及向外擴散。

Article URL: https://www.aclu.org/news/privacy-technology/tracking-alpr-cameras/flock-safety-credibility-lost-as-it-repeatedly-lies-to-city-councils-police-departments-and-public-across-the-country Comments URL: https://news.ycombinator.com/item?id=48986731 Points: 215 # Comments…

The final approval settles one case, but it doesn't resolve the broader issue of using copyrighted works to train AI models.

David Vélez and Robin Vince join the boards of the OpenAI Foundation and OpenAI Group PBC, bringing global leadership in finance, technology, and governance.

Article URL: https://forum.jellyfin.org/t-project-leadership-changes Comments URL: https://news.ycombinator.com/item?id=48986091 Points: 231 # Comments: 175

The director role for the Center for AI Standards and Innovation (CAISI) has become a revolving door since David Sacks left his position as czar.

Pennsylvania cop charged with oppression and obstruction.

California and XPRIZE competition tests whether drones can stop wildfires early.

Judge grants restraining order, saying merger "likely to violate antitrust laws."

The Trump administration is asking the Space Force to do a lot. This will require more launches.

The Trump administration is asking the Space Force to do a lot. This will require more launches.

Article URL: https://vincentwoo.com/3d/grace_cathedral/ Comments URL: https://news.ycombinator.com/item?id=48984254 Points: 237 # Comments: 51

X says the rebuilt version of its Android app is now available globally.

AT&T suffers setback but will keep asking court and FCC to preempt state rules.

Article URL: https://xenaproject.wordpress.com/2026/07/20/human-mathematicians-are-being-outcounterexampled/ Comments URL: https://news.ycombinator.com/item?id=48983382 Points: 230 # Comments: 81

This week's Java roundup for July 13th, 2026, features news highlighting: a reintroduction of Value Objects (Preview); the GA release of WildFly 41; the July 2026 edition of Open Liberty 26.0.0.7; point releases of TornadoVM, Apache TomEE, Java Operator SDK and LangChain4j; a mai…

Article URL: https://blaizzy.github.io/nativ/ Comments URL: https://news.ycombinator.com/item?id=48982681 Points: 209 # Comments: 80

Article URL: https://cursor.com/blog/agent-swarm-model-economics Comments URL: https://news.ycombinator.com/item?id=48982535 Points: 236 # Comments: 104

Used discs are often cheaper than even deep digital discounts.

Article URL: https://www.kimi.com/products/kimi-work Comments URL: https://news.ycombinator.com/item?id=48981703 Points: 304 # Comments: 142

Who’s Afraid of Chinese Models? Interesting proposal from Ben Thompson that both addresses the hypocrisy of labs outlawing distillation against their models despite training on unlicensed data, and could help US open models compete more effectively with their Chinese counterparts…

Article URL: https://unslop.run/blog/measuring-ai-writing-on-arxiv Comments URL: https://news.ycombinator.com/item?id=48981206 Points: 226 # Comments: 156

Celebrating $100 million contributed by the community to the people who build and sustain open source every day. The post $100 million for open source: A milestone built by the community appeared first on The GitHub Blog .

Many will say Spa is the best racetrack on earth, but not for these F1 cars.

Article URL: https://refactoringenglish.com/blog/why-i-stopped-creating-content/ Comments URL: https://news.ycombinator.com/item?id=48980520 Points: 237 # Comments: 191

Adobe's Project Indigo can now remove all kinds of backgrounds from photos you snap using the app.

Online retailer AliExpress says it's shocked by largest DSA fine yet.

"Something's coming. Something we may not be able to deter."

Article URL: https://var0.xyz/posts/perfection-is-not-over-engineering.html Comments URL: https://news.ycombinator.com/item?id=48979120 Points: 198 # Comments: 89

Governments look at banning ransom payments in face of increasingly sophisticated threats.

DoorDash has developed Entity Cache, a transparent proxy caching platform built on Envoy and Valkey to reduce redundant service-to-service requests across its microservices architecture. Operating within DoorDash’s service mesh, the platform serves over 1.5M requests per second w…

Article URL: https://github.com/search Comments URL: https://news.ycombinator.com/item?id=48978835 Points: 189 # Comments: 46

Article URL: https://www.phoronix.com/news/Firefox-153-Downloads Comments URL: https://news.ycombinator.com/item?id=48978835 Points: 227 # Comments: 52

Article URL: https://satoshi7190.github.io/Shinjuku-indoor-threejs-demo/ Comments URL: https://news.ycombinator.com/item?id=48978792 Points: 225 # Comments: 50

Article URL: https://news.risky.biz/risky-bulletin-hacker-wipes-romanias-entire-land-registry-database/ Comments URL: https://news.ycombinator.com/item?id=48978605 Points: 277 # Comments: 170

Article URL: https://spectrum.ieee.org/led-light-pollution Comments URL: https://news.ycombinator.com/item?id=48978350 Points: 205 # Comments: 156

InfoQ has opened enrollment for three five-week online certification cohorts starting in August, each led by a senior practitioner applying QCon talk frameworks to participants' own work: architecture with Luca Mezzalira, engineering leadership with Michelle Brush, and AI securit…

Article URL: https://wren.wtf/shower-thoughts/stop-using-opencode/ Comments URL: https://news.ycombinator.com/item?id=48978112 Points: 251 # Comments: 171

Article URL: https://edri.org/our-work/the-eu-is-about-to-sell-our-most-sensitive-data-to-the-us-for-visa-free-travel/ Comments URL: https://news.ycombinator.com/item?id=48977711 Points: 259 # Comments: 142

Article URL: https://stratechery.com/2026/whos-afraid-of-chinese-models/ Comments URL: https://news.ycombinator.com/item?id=48977128 Points: 241 # Comments: 162