Skip to main content

TrendAI™
資安部落格

TrendAI 資安部落格

熱門文章

Two Critical PHP Flaws Leaked Before the Patch
Exploits & Zero-Days
兩大 PHP重大高風險漏洞 CVE-2026-109618／109619 修補前遭外洩：企業與 IT 團隊當前應對指南

2026 年 10 月 20 日，兩個可導致遠端程式碼執行（RCE）的 PHP 重大漏洞在官方修補前於 Hacker News 遭披露。貼文雖已被移除，但截圖已在 X 與 Mastodon 上流傳。本文整理兩大高風險漏洞（CVE-2026-109618 與 CVE-2026-109619）的詳細資訊、潛在影響以及企業當前應採取的七步驟緊急應對與防禦措施。

2026年10月22日
TrendAI™ Research
Read article
Two people talking in front of the workstation
Exploits & Zero-Days
eMudhra 8 組 CA 私鑰遭破解：企業 TLS 憑證風險與 6 大應變措施

eMudhra 8 組中繼 CA 憑證私鑰遭破解，金鑰最短僅 3 位元。TrendAI™ 說明 SSL 憑證與程式碼簽章風險、受影響的 Chrome、Linux、Go、Node.js 等環境，以及企業資安團隊現在應採取的 6 項修補行動與威脅追蹤指標。

2026年10月21日
TrendAI™ Research
Read article
What a Week for CISOs: PHP, eMudhra, and the Questions Your Board Will Ask
Exploits & Zero-Days
CISO 驚魂一週：PHP 重大漏洞、eMudhra 憑證金鑰外洩，以及董事會一定會問的五個問題

兩個 PHP 重大漏洞在修補程式釋出前遭外洩，同一天 Mozilla 揭露 eMudhra 憑證授權中心（CA）金鑰強度不足。趨勢科技TrendAI™ 全球資安長 Sundari Parekh 為資安領導者提供一套實務行動指南。

2026年10月21日
Sundari Parekh
Read article

搜尋部落格文章

Malware
Fake Banking App Found on Google Play Used in SMiShing

As users start to look for apps and other services from their banks, opportunities for scammers also increase. One recent example of this is the app Movil Secure, part of a SMiShing scheme targeting Spanish-speaking users.

November 7th, 2018 4 min read Echo Duan
Read Article
Exploits & Zero-Days
Virtual Patching: Patch Those Vulnerabilities before They Can Be Exploited

The average organization takes over 30 days to patch operating systems and software, and longer for more complex business applications and systems. This infographic shows how virtual patching solutions can help mitigate threats from vulnerabilities.

October 25th, 2018 4 min read TrendAI™ Research
Read Article
Targeted attacks
LoJax UEFI Rootkit Used in Cyberespionage

Security researchers came across a Unified Extensible Firmware Interface (UEFI) rootkit in the wild being used for cyberespionage. Named LoJax, the rootkit is reportedly packaged with other tools that modifies the system’s firmware to infect it with malware.

October 1st, 2018 3 min read TrendAI™ Research
Read Article
Cyber crime
.EGG Files in Spam Delivers GandCrab v4.3 Ransomware to South Korean Users

We discovered spam mails abusing EGG (.egg) files to deliver the GandCrab v4.3 ransomware. Additionally, the operators behind the spam mails appear to be specifically going after South Korean users, as evidenced by the use of Hangul in the spam mails.

August 20th, 2018 2 min read Donald Castillo
Read Article
Exploits & Zero-Days
Over 200,000 MikroTik Routers Compromised in Cryptojacking Campaign

Security researchers uncovered a cryptojacking campaign that exploits a vulnerability in MikroTik routers to inject a malicious version of Coinhive. Here’s what you need to know.

August 3rd, 2018 3 min read TrendAI™ Research, TrendAI Rese
Read Article
Malware
Fileless Malware PowerGhost Targets Corporate Systems

A new fileless malware utilizes Powershell and EternalBlue via WMI for propagation, infecting workstations and servers connected to a local server with a cryptocurrency miner and a DDos tool. Significant infections have been detected in North America and Europ

July 30th, 2018 2 min read TrendAI™ Research
Read Article
Phishing & BEC
FBI Report: Global BEC Losses Exceeded US$12 Billion in 2018

The Federal Bureau of Investigation (FBI) issued a public service announcement (PSA) regarding the continued increase of Business Email Compromise (BEC) scams, which total global losses have already reached over US$12 billion in 2018.

July 18th, 2018 2 min read TrendAI™ Research
Read Article
Cloud security
Security by Design: A Checklist for Safeguarding Virtual Machines and Containers

Here are some considerations and best practices that developers, IT operations professionals, and system administrators should take into account in securing the infrastructures that power the applications they use.

May 22nd, 2018 5 min read TrendAI™ Research
Read Article
FacexWorm Abuses Facebook Messenger for Propagation

Our Cyber Safety Solutions team identified a malicious Chrome extension we named FacexWorm, which uses a miscellany of techniques to target cryptocurrency trading platforms accessed on an affected browser and propagates via Facebook Messenger.

April 30th, 2018 6 min read Joseph C Chen
Read Article
Cyber crime
Curbing the BEC Problem Using AI and Machine Learning

Due to BEC’s evolving and treacherous nature, run-of-the-mill best practices and security solutions have become weak to withstand attacks. Find out how advanced solutions that utilize artificial intelligence and machine learning help in defending against BEC.

April 16th, 2018 5 min read TrendAI™ Research
Read Article