Skip to main content

TrendAI™
資安部落格

TrendAI 資安部落格

熱門文章

Two Critical PHP Flaws Leaked Before the Patch
Exploits & Zero-Days
兩大 PHP重大高風險漏洞 CVE-2026-109618／109619 修補前遭外洩：企業與 IT 團隊當前應對指南

2026 年 10 月 20 日，兩個可導致遠端程式碼執行（RCE）的 PHP 重大漏洞在官方修補前於 Hacker News 遭披露。貼文雖已被移除，但截圖已在 X 與 Mastodon 上流傳。本文整理兩大高風險漏洞（CVE-2026-109618 與 CVE-2026-109619）的詳細資訊、潛在影響以及企業當前應採取的七步驟緊急應對與防禦措施。

2026年10月22日
TrendAI™ Research
Read article
Two people talking in front of the workstation
Exploits & Zero-Days
eMudhra 8 組 CA 私鑰遭破解：企業 TLS 憑證風險與 6 大應變措施

eMudhra 8 組中繼 CA 憑證私鑰遭破解，金鑰最短僅 3 位元。TrendAI™ 說明 SSL 憑證與程式碼簽章風險、受影響的 Chrome、Linux、Go、Node.js 等環境，以及企業資安團隊現在應採取的 6 項修補行動與威脅追蹤指標。

2026年10月21日
TrendAI™ Research
Read article
What a Week for CISOs: PHP, eMudhra, and the Questions Your Board Will Ask
Exploits & Zero-Days
CISO 驚魂一週：PHP 重大漏洞、eMudhra 憑證金鑰外洩，以及董事會一定會問的五個問題

兩個 PHP 重大漏洞在修補程式釋出前遭外洩，同一天 Mozilla 揭露 eMudhra 憑證授權中心（CA）金鑰強度不足。趨勢科技TrendAI™ 全球資安長 Sundari Parekh 為資安領導者提供一套實務行動指南。

2026年10月21日
Sundari Parekh
Read article

搜尋部落格文章

Cloud security
Serverless Applications: What They Mean in DevOps

Analysis of over 1,000 open-source serverless applications revealed that 21% of them have critical vulnerabilities or were misconfigured. What does this mean for DevOps?

April 13th, 2018 3 min read TrendAI™ Research
Read Article
Cyber crime
Tesla and Jenkins Servers Fall Victim to Cryptominers

Vulnerable enterprise servers are being compromised by individuals or groups looking for resources to mine cryptocurrency. The latest victims are automobile-maker Tesla and users of Jenkins servers.

February 21st, 2018 3 min read TrendAI™ Research
Read Article
Malware
New AndroRAT Exploits Allow for Permanent Rooting

A new variant of Android Remote Access Tool can inject root exploits to perform malicious tasks such as silent installation, shell command execution, WiFi password collection, and more. It targets CVE-2015-1805, a vulnerability disclosed in 2016.

February 13th, 2018 3 min read Veo Zhang, Jason Gu, Seven Shen
Read Article
Exploits & Zero-DaysTargeted attacks
North Korean Hackers Allegedly Exploit Adobe Flash Player Vulnerability (CVE-2018-4878) Against South Korean Targets

In a security alert posted on its website on January 31, The South Korean Computer Emergency Response Team (KR-CERT) warned of a zero-day vulnerability in Adobe Flash player that could be maliciously exploited.

February 2nd, 2018 3 min read TrendAI™ Research
Read Article
Google’s DoubleClick Abused to Deliver Miners

On January 24, 2018, we observed that the number of Coinhive web miner detections tripled due to a malvertising campaign. Attackers seem to have abused Google’s DoubleClick, which provides internet ad serving services, for traffic distribution.

January 26th, 2018 2 min read Chaoying Liu, Joseph C Chen
Read Article
Exploits & Zero-Days
Meltdown and Spectre Intel Processor Vulnerabilities: What You Need to Know

Microsoft, Linux, Google, and Apple started rolling out patches addressing design flaws in processor chips that security researchers named Meltdown and Spectre. What are they, and how can they affect users?

January 4th, 2018 3 min read TrendAI™ Research
Read Article
Cyber threats
Digmine Miner Spreading via Facebook Messenger

A new cryptocurrency-mining bot is spreading through Facebook Messenger. We named this Digmine based on the moniker (비트코인 채굴기 bot) it was referred to in a report of recent related incidents in South Korea.

December 21st, 2017 5 min read Lenart Bermejo, Hsiao-Yu Shih
Read Article
Cloud
Data on 123 Million US Households Exposed Due to Misconfigured AWS S3 Bucket

A year that saw major data breaches, including some notable ones from companies like Uber and Equifax, just saw another breach that will likely rank as among 2017’s most notable incidents.

December 20th, 2017 2 min read TrendAI™ Research
Read Article
Exploits & Zero-Days
17-Year Old MS Office Flaw (CVE-2017-11882) Actively Exploited in the Wild

Several threat actors are actively exploiting CVE-2017-11882 to deliver a plethora of threats, including the information-stealing Loki, Pony/FAREIT, and a lockscreen with a ransom note that resembles Bad Rabbit's.

December 8th, 2017 3 min read
Read Article
Uber Breach Exposes the Data of 57 Million Drivers and Users

In a highly publicized data breach incident, rideshare application Uber announced that the personal information of 57 million customers and drivers were potentially compromised in October 2016.

November 22nd, 2017 4 min read TrendAI™ Research
Read Article