資安指南
從真實事件學習，守護你自己的網站。
不是教你如何攻擊，而是教你如何防禦——取材自真實發生過的入侵事件。即使沒有資安背景，也有今天就能著手的實用防禦做法。
從哪裡開始
01最新 / 資安新聞
現在需要確認的資訊。
關於事件與漏洞的即時報導、正在積極遭利用的缺陷，以及近期揭露的嚴重漏洞。漏洞資訊來源最後更新 2026-11-12 02:01 JST清單取得時間 2026-11-12 02:46 JST
即時報導附來源
- First report英文Fireworks AI Security Incident (October 2026): Billing Data and Some Datasets and Model Weights Affected, Company Says Cloud Provider Breach Was Involved. What Customers Should Do
- First report英文NEAR AI Breached Through an Inference Engine Flaw (Account Details of About 100 Users): What Was Confirmed and What Users and AI Infrastructure Operators Should Do
- First report英文SAP Security Patch Day, November 2026: four CVSS 10.0 flaws. Patch internet-facing Web Dispatcher and ICM first; how to check if you are affected and what to do today
- First report英文Unauthorized access to Sharefull's internal management system (up to about 7.5 million accounts): names, bank details, emergency contacts and more may have leaked — what workers should do
- First report英文Unauthorized access to Sumitomo Life's Vitality application system (about 80,000 people): names, addresses, phone numbers and partly masked card numbers leaked — what users should do
即時報導以英文和日文發布。
查看全部即時報導正遭積極利用CISA KEV 新增
- CVE-2026-125350CVSS 8.8有解析Google ChromeGoogle Chrome 157.0.8103.50 之前版本中的 XML 處理存在 Use after free（釋放後使用）漏洞，遠端攻擊者可透過精心設計的 HTML 頁面，於沙箱內執行任意程式碼。（Chromium 安全嚴重性：高）
- CVE-2026-116606CVSS 9.3有解析Barracuda Email Security Gateway 9.4.0.030 之前的版本存在驗證繞過漏洞，未經驗證的遠端攻擊者可呼叫設定匯入功能，並還原經過特製、相容的備份封存檔，進而未經授權修改設備的全域設定。
- CVE-2026-20320CVSS 7.5有解析正如上述要求，以下為繁體中文翻譯： Cisco BroadWorks 的開放式客戶端介面（OCI）XML 解析器存在一項漏洞，可能讓未經驗證的遠端攻擊者讀取受影響系統上的敏感設定資訊。 此漏洞的成因是 XML 條目解析不當，原因在於預設允許解析外部實體。攻擊者可透過向開放式客戶端介面—佈建（OCI-P）服務傳送經過特製的 XML 訊息來利用此漏洞。成功利用後，攻擊者可能以 Cisco BroadWorks 使用者的權限檢視檔案系統中的敏感檔案。
- CVE-2026-111560CVSS 8.6跨站與設定處理相關的命令注入漏洞說明：在特定 Barracuda 設備產品中，時區設定欄位對 shell 元字元的過濾不當（improper neutralization）。該問題存在於多款產品共用的 Barracuda 程式碼中。已通過身分驗證的管理員可注入作業系統命令，且當惡意構造的時區值於後續被處理時，這些命令將以 root 權限執行。
- CVE-2026-124194CVSS 6.5有解析Microsoft Office Outlook 的使用者介面未對不安全的操作發出警告，允許未經授權的攻擊者透過網路執行欺騙（Spoofing）攻擊。
近期揭露的嚴重缺陷CVSS 8.8+
- CVE-2026-123710CVSS 9.8A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags.
- CVE-2026-89324CVSS 9.8The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerability exists because a missing-quotes coding error in the defined() call for SECURE_AUTH_SALT inside BASEL_Auth::get_config() causes PHP to evaluate the constant's value rather than its name, making the check always fail and permanently falling back to the static hardcoded salt 2NlBUibcszrVtNmDnxqDbwCOpLWq91eatIz6O1O that is publicly visible in the theme source code; because this salt is static and known, an attacker can compute a valid Opauth signature entirely offline and submit a forged ?opauth callback to the unauthenticated init hook endpoint processed by register_or_login. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, by forging a callback tied to a known target account email address — bypassing all password verification, multi-factor authentication, and ownership checks, and receiving a fully authenticated session cookie via wc_set_customer_auth_cookie(). Exploitation requires WooCommerce to be active and at least one Basel social-login provider (Facebook, Google, or VKontakte) to be configured with a valid app_id and app_secret in the theme settings.
- CVE-2026-121908CVSS 9.9Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- CVE-2026-121906CVSS 9.9Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
- CVE-2026-121904CVSS 9.6Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
利用狀態來自 CISA KEV，嚴重性來自 NVD。請務必在各廠商公告中確認修補版本與受影響範圍。
01 — Sections
從哪裡開始
依目標挑選入口。全部免費，免註冊。
02 — Field notes
重大資安事件與漏洞
Capital One、Log4Shell、MOVEit 等——公開的入侵事件與漏洞，轉化為你的防禦之道。
03 — Our stance
本站堅持的原則
資安產品必須先把自家的事做好。
We don't hold secrets
We never store your real API keys — only metadata. The safest secret is the one we can't leak.
Scan only what you own
Diagnostics run on verified domains only. Internal IPs and metadata endpoints are blocked — SSRF defense is built in.
Minimal blast radius
Isolation so one breach can't cascade. This site itself runs on a dedicated, isolated host.
We test on ourselves
This site watches its own dependencies for CVEs. The incident that started this never gets missed by a human again.