Exploits & Zero-Days
Node2Shell（CVE-2026-111497）重大漏洞解析：Brotli 漏洞影響哪些系統？企業該如何修補？
2026年10月28日6 min read
TrendAI™ Research
2026年10月28日
6 min read
Read article
TrendAI™
資安部落格
熱門文章
Exploits & Zero-Days
兩大 PHP重大高風險漏洞 CVE-2026-109618／109619 修補前遭外洩：企業與 IT 團隊當前應對指南
2026 年 10 月 20 日，兩個可導致遠端程式碼執行（RCE）的 PHP 重大漏洞在官方修補前於 Hacker News 遭披露。貼文雖已被移除，但截圖已在 X 與 Mastodon 上流傳。本文整理兩大高風險漏洞（CVE-2026-109618 與 CVE-2026-109619）的詳細資訊、潛在影響以及企業當前應採取的七步驟緊急應對與防禦措施。
2026年10月22日
Read article
Exploits & Zero-Days
eMudhra 8 組 CA 私鑰遭破解：企業 TLS 憑證風險與 6 大應變措施
eMudhra 8 組中繼 CA 憑證私鑰遭破解，金鑰最短僅 3 位元。TrendAI™ 說明 SSL 憑證與程式碼簽章風險、受影響的 Chrome、Linux、Go、Node.js 等環境，以及企業資安團隊現在應採取的 6 項修補行動與威脅追蹤指標。
2026年10月21日
Read article
Exploits & Zero-Days
CISO 驚魂一週：PHP 重大漏洞、eMudhra 憑證金鑰外洩，以及董事會一定會問的五個問題
兩個 PHP 重大漏洞在修補程式釋出前遭外洩，同一天 Mozilla 揭露 eMudhra 憑證授權中心（CA）金鑰強度不足。趨勢科技TrendAI™ 全球資安長 Sundari Parekh 為資安領導者提供一套實務行動指南。
2026年10月21日
Read article
搜尋部落格文章
Site search
Filter by:
Malware
Bashlite Updated with Mining and Backdoor Commands
We uncovered an updated Bashlite malware designed to add infected internet-of-things devices to a distributed-denial-of-service (DDoS) botnet. Based on the Metasploit module it exploits, the malware targets devices with the WeMo UPnP API.
April 3rd, 2019 5 min read
Read Article
Phishing & BEC
Google and Facebook Fraudster Pleads Guilty to $100 million Scam
A business email compromise (BEC) scheme took more than $100 million from Facebook and Google. Legitimate-looking invoices, contracts and more fooled the two tech companies and they wired millions to the fraudsters over a period of years.
March 26th, 2019 2 min read
Read Article
Cyber crime
A Hacking Group is Stealing Popular Instagram Profiles
Social media influencers could be seen as trophies by hackers. This includes a photographer with more than 15,000 followers on Instagram who had her account stolen.
February 28th, 2019 5 min read
Read Article
IoT & smart devicesMalware
Beauty Camera Apps Send Users Porn, Collects Pictures
We discovered several beauty camera apps (detected as AndroidOS_BadCamera.HRX) on Google Play that are capable of accessing remote ad configuration servers that can be used for malicious purposes. Some of these have been downloaded millions of times.
January 30th, 2019 3 min read
Read Article
Malware
Google Play Apps Drop Anubis, Use Motion-based Evasion
We found malicious apps on Google Play trying to drop a banking malware payload on unsuspecting users. Motion sensor data was used to evade detection.
January 17th, 2019 4 min read
Read Article
Disguised Adware Infect 9 Million Google Play Users
We recently discovered an active adware family (detected by Trend Micro as AndroidOS_HidenAd) disguised as 85 game, TV, and remote control simulator apps on the Google Play store.
January 8th, 2019 3 min read
Read Article
Malware
Security 101: Defending Against Fileless Malware
Fileless threats aren’t as visible compared to traditional malware and employ a variety of techniques to stay persistent. Here's a closer look at how fileless malware work and what can be done to thwart them.
December 20th, 2018 12 min read
Read Article
Malware
Malicious Memes that Communicate with Malware
We recently discovered malicious actors using steganography on memes. It should be noted that the malware was not downloaded from Twitter and that we did not observe what specific mechanism was used to deliver the malware to its victims.
December 14th, 2018 3 min read
Read Article
Hacker Infects Node.js Package to Steal from Bitcoin Wallets
A Node.js module with nearly two million downloads a week was compromised after the library was injected with malicious code programmed to steal bitcoins in wallet apps.
November 29th, 2018 3 min read
Read Article
AutoIt-Compiled Worm Sends Fileless BLADABINDI/njRAT
BLADABINDI’s customizability and seeming availability in the underground make it a prevalent threat. Last week, we came across a worm (Worm.Win32.BLADABINDI.AA) that propagates through removable drives and installs a fileless version of BLADABINDI.
November 27th, 2018 4 min read
Read Article