KDZONE 情報站

上週列印管理系統供應商PaperCut提出警告，旗下的PaperCut NG與PaperCut MF系統存在零時差漏洞CVE-2026-82078、CVE-2026-81578，且已有客戶遭到攻擊，本週美國要求政府機關著手修補。

當AI打破漏洞修補節奏，過往資安團隊尚有餘裕應對的漏洞修補時程，如今正被大幅壓縮，如何在漏洞被發現或遭AI加速利用之前重新調整應對策略，已成為產業界迫切需要解決的課題，最近FIRST國際資安應變組織宣布，將於9月23日至25日召開VulnOptiCON 2026，將原本的Vuln4Cast研討會更名並擴大舉辦，不僅將會期拉長為3日，議程主軸也從原本以漏洞預測技術為核心，擴大納入漏洞追蹤、CVE計畫前景，以及AI如何改變漏洞發現及利用等議題，以涵蓋更廣泛的漏洞生態系統主題。

"We could really be facing the great filter."

Article URL: https://mvakde.github.io/blog/44-on-arc-1/ Comments URL: https://news.ycombinator.com/item?id=49519939 Points: 228 # Comments: 63

研究調查機構Gartner預估，全球AI安全市場規模將從2026年的28.35億美元成長至2027年的47.83億美元，年增68.7%，2028年更將接近77億美元。

Google公布Android 17新一波網路隱私與連線安全措施，重點防範網路追蹤、App未經授權存取區域網路，以及偽基地臺攻擊等風險。

雲端原生運算平臺Kubernetes正式發布Kubernetes 1.37，其中Pod憑證（Pod Certificates）與叢集信任套件（Cluster Trust Bundles）同時升為穩定版（Stable）。新機制讓Pod可透過Kubernetes取得X.509憑證，並由Kubelet處理私密金鑰與憑證生命週期，提供服務帳號JWT（Service Account JWT）之外的工作負載身分驗證方式。

美國網路安全暨基礎設施安全局（CISA）公布2024至2025會計年度漏洞分析結果。近兩年CVE新增數量快速攀升，但實際遭利用的漏洞仍反覆涉及長年存在的軟體弱點，其中41.5%的已知遭利用漏洞（KEV）涉及MITRE長期追蹤的弱點。

勒索軟體Aurora（Aur0ra）從今年4月開始積極活動，資安公司CloudSEK透露攻擊者使用AI程式碼助手Cursor規畫攻擊行動，並使用俄語與AI對話，並排除獨立國家國協（CIS）地區與國家，截至7月已有超過20家企業組織受害。有另一家資安公司也發現駭客暴露的基礎設施並著手調查，發現駭客不只濫用Cursor，也借助Claude Sonnet來從事活動。

Anthropic調整AI程式開發工具Claude Code的每周用量上限，9月14日起，Pro、Max、Team及按席位計費的Enterprise方案，標準額度將比原本提高25%。不過目前使用者享有50%的臨時加碼，在新制上路後，實際可用額度會比現在減少約17%。

Article URL: https://restroomarchive.com Comments URL: https://news.ycombinator.com/item?id=49517624 Points: 187 # Comments: 47

Article URL: https://www.gpuworld.org/ Comments URL: https://news.ycombinator.com/item?id=49517584 Points: 226 # Comments: 110

OpenAI周一（8/31）宣布，旗下廣告業務ChatGPT Ads上線約200天以來，受到數萬家廣告主的青睞，年化收入已突破10億美元。

負責制定國際金融監理標準的金融穩定委員會（Financial Stability Board，FSB）主席Andrew Bailey周一（8/31）警告，指出隨著具備高自主性的「前沿AI模型」崛起，結合市場日益高漲的槓桿，正讓全球金融體系的風險版圖更趨複雜，恐衝擊市場信心與金融穩定。

資安公司CloudSEK與TRM Labs聯手，揭露勒索軟體Aurora（Aur0ra）的攻擊活動，他們根據駭客錯誤配置的伺服器，發現攻擊工具、AI輔助的攻擊規畫，以及與受害者對贖金進行談判的介面。該組織從今年4月開始積極活動，截至7月已有超過20家企業組織受害，這些受害組織分布於9個國家，其中17家駭客取得網域層級的互動存取權限，其中4家被列入Aurora的資料外洩網站。

Article URL: https://fastpotify.rocks/ Comments URL: https://news.ycombinator.com/item?id=49517448 Points: 214 # Comments: 91

本日新聞焦點 ● AI生成詐騙內容成新威脅，數發部與四大平臺聯手建立源頭阻詐防線 ● 臺灣成網攻最頻繁亞洲國家，7月每週遭遇攻擊次數達全球1.84倍 ● Microsoft 365驗證異常擴大，Exchange Online等多項服務受影響

美國戰爭部（Department of War，DoW）周一（8/31）宣布，OpenAI的ChatGPT Mil與Grok for Gover

See how Gilbert + Tobin combines CEO-led commitment, rigorous governance, and human accountability to scale ChatGPT Enterprise and Codex across the firm.

Apple says it has evidence that a former employee destroyed evidence of data theft after learning he was under investigation.

Introducing wrapture New from Graham Dumpleton (of wrapt , mod_wsgi, and New Relic's Python agent fame), who describes Wrapture as taking the monkeypatching ideas from wrapt and extending them to apply to testing and tracing at the same time. Wrapture ( full documentation here ) …

Article URL: https://datacolada.org/138 Comments URL: https://news.ycombinator.com/item?id=49516199 Points: 223 # Comments: 152

Article URL: https://tmpout.sh/5/ Comments URL: https://news.ycombinator.com/item?id=49516059 Points: 191 # Comments: 38

It's the lightest Bentley in 85 years.

Article URL: https://www.darlinghq.org/ Comments URL: https://news.ycombinator.com/item?id=49515830 Points: 201 # Comments: 66

325 #kakapo! The chicks from this year's record breeding season are now juveniles and so have been added to the population. In 1995 there were just 51 kākāpō left. Recovery of critically endangered species is possible with sustained effort. — Andrew Digby , providing the be…

The CDC has tallied nearly 30,000 confirmed and probable cases this summer.

You've read the stories. Now check out our forums.

Article URL: https://webiterate.dev/google-removed-extensions-ublock-origin-108/ Comments URL: https://news.ycombinator.com/item?id=49514878 Points: 192 # Comments: 148

Versions of OpenAI's ChatGPT and SpaceXAI's Grok will join Google's Gemini on the Pentagon's central portal for AI tools.

Director Dave Green's live action/animated hybrid captures smart, subversive weirdness of the classic cartoons.

As frustration over AI influencers has been growing, Instagram is limiting the reach of undisclosed AI profiles.

Trump furious at NBC's Kristen Welker for saying he had mixed results in primary endorsements.

The seed round for the app that provides real-time legal and policy guidance to officers was led by SignalFire and Las Olas VC.

ASCII City: Traffic and Detail Update - https://www.youtube.com/watch?v=DSRooHo_HSI ASCII City Update: Interiors, Elevation and Skyscrapers - https://www.youtube.com/watch?v=UCKEDWowc0o Comments URL: https://news.ycombinator.com/item?id=49512975 Points: 186 # Comments: 28

Lawsuit: Anthropic’s torrenting totally screwed songwriters as AI songs top charts.

Finding reveals an overlooked way that water can damage surfaces.

Article URL: https://jasontucker.blog/how-i-turned-my-security-cameras-into-an-automatic-bird-identification-system-with-birdnet-go/ Comments URL: https://news.ycombinator.com/item?id=49511856 Points: 199 # Comments: 60

In exchange for free stuff, devices make home connections part of a proxy network.

Article URL: https://ravynos.com/ Comments URL: https://news.ycombinator.com/item?id=49511534 Points: 185 # Comments: 105

“One more warning sign here of what we're facing in a warmer world.”

The three-year-old startup says it reached $15 million in ARR and profitability before raising its latest $15 million round.

Google rolled out the Lake America change on Saturday, while the official US government maps are still waiting.

Nvidia invests $3.5 billion into Taiwanese chipmaker MediaTek. The deal shows how Nvidia plans to stay essential to AI infrastructure as Big Tech begins to build its own AI chips.

Article URL: https://playaphone.com/ Comments URL: https://news.ycombinator.com/item?id=49510514 Points: 248 # Comments: 108

DoorDash has moved engineering agent workloads from developer laptops to its Flux cloud platform. The platform automated 130,000 engineering tasks in one month and supports more than 25,000 automated code reviews weekly. Flux uses isolated Firecracker microVMs, an MCP gateway, re…

Article URL: https://codex-tool-reference.simonw.chatgpt.site/ Comments URL: https://news.ycombinator.com/item?id=49510000 Points: 182 # Comments: 51

Explosive growth comes with a new regulatory burden in the European Union.

"We would need over half a million 4K TVs to fully display the single Roman image from our largest survey."

Bot operators have historically had the economic advantage, bypassing static, deterministic detection rules with cheap proxies and retooling. Cloudflare's new Adaptive Intelligence engine flips this dynamic by autonomously learning from the meta-signals of live traffic and deploy…

Circleback is also introducing new pricing plans starting from $14 per month

Article URL: https://www.macrumors.com/2026/08/30/apple-unexpected-mac-mini-and-studio-demand/ Comments URL: https://news.ycombinator.com/item?id=49508982 Points: 196 # Comments: 223

開源IaaS雲端平臺專案Apache CloudStack於8月18日發布資安公告，修補20個漏洞，包括可能導致跨租戶在KVM主機執行任意指令與OAuth權杖洩露的重大漏洞，受影響版本涵蓋4.0.0至4.20.3.0，以及4.21.0.0至4.22.1.0，用戶應儘速升級至已修補完成的4.20.3.1與4.22.1.1版。

Article URL: https://signalandsilence.substack.com/p/i-think-someone-hacked-the-commissary Comments URL: https://news.ycombinator.com/item?id=49508506 Points: 187 # Comments: 111

This week's Java roundup for August 24th, 2026, features news highlighting: the GA release of Atmosphere 4.0; point releases of GraalVM, Azul Payara and Quarkus; a maintenance release of WildFly 41; milestone releases of Jakarta Data and Eclipse JNoSQL; a beta release of the Sept…

Article URL: https://daniel.haxx.se/blog/2026/06/24/a-cve-dispute/ Comments URL: https://news.ycombinator.com/item?id=49508290 Points: 172 # Comments: 41

臺灣雲端部署平臺Zeabur上週透露發生資料外洩事故引發關注，該公司的環境變數外流，導致部分用戶串接的AI服務使用量異常。有駭客聲稱，他們從Zeabur竊得大批內部資料。

美國加州議會上周三（8/26）正式通過《數位年齡保障法》（Digital Age Assurance Act，DAAA）的修正案（AB-1856），明確將開源作業系統排除在適用範圍之外，讓開源社群暫時卸下了沉重的合規壓力。

資安業者Arctic Wolf揭露以Go語言撰寫的新型惡意軟體GoCaracal，今年6月已被用於攻擊委內瑞拉一家通訊組織。GoCaracal可遠端控制受害電腦、竊取資料，還能在無法連上主要命令與控制（C2）伺服器時，從以太坊智慧合約取得新的C2位址。Arctic Wolf研判相關攻擊與網路間諜組織Dark Caracal有關。