每日安全快讯 2026-07-30

cwj
cwj

蔡文姬的安全小屋

2026年7月30日 17:49
浙江

在小说阅读器读本章

去阅读

每日安全快讯 2026-07-30

以下为今日精选安全资讯，内容基于公开来源整理。建议结合自身资产范围判断影响。

一、安全新闻

1. Toy Ghouls’ new toy: the GenieLocker ransomware

来源：Securelist
时间：2026-07-30 16:00
影响：勒索风险、广泛使用产品

摘要：Kaspersky experts dissect GenieLocker: new custom ransomware variants for Windows, Linux, and ESXi systems. We found this family in attacks by Toy Ghouls, a financially motivate...

原文链接：
https://securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/

2. Amazon identifies North Korean hacker group behind open-source supply chain attacks

来源：AWS Security Blog
时间：2026-07-30 05:00
影响：高危漏洞、供应链影响

摘要：Amazon is sharing new findings about how a threat actor linked to the Democratic People’s Republic of Korea (DPRK) is targeting open source software libraries, the shared buildi...

原文链接：
https://aws.amazon.com/blogs/security/amazon-identifies-north-korean-hacker-group-behind-open-source-supply-chain-attacks/

3. Supply chain challenges loom large in quantum race, White House official says

来源：CyberScoop
时间：2026-07-30 04:22
影响：供应链影响、广泛使用产品

摘要：Brad Blakestad, director of the National Quantum Coordination Office, also said encryption and measuring progress would pose challenges. The post Supply chain challenges loom la...

原文链接：
https://cyberscoop.com/white-house-quantum-supply-chain-challenges/

4. Tame Dependabot: Group your updates, slow the cadence, keep security fast

来源：GitHub Blog Security
时间：2026-07-30 00:00
影响：高危漏洞、广泛使用产品

摘要：Dependabot keeps your dependencies current, but its defaults can flood your repository with pull requests. Here's how grouping updates, slowing the cadence, and keeping security...

原文链接：
https://github.blog/security/supply-chain-security/tame-dependabot-group-your-updates-slow-the-cadence-keep-security-fast/

5. Secure your npm and pip package updates in Amazon Linux

来源：AWS Security Blog
时间：2026-07-29 22:53
影响：供应链影响、广泛使用产品

摘要：If you use and install packages from npm or PyPI, the first hours after a package is published are the riskiest because scanners can’t analyze packages before publication. Recen...

原文链接：
https://aws.amazon.com/blogs/security/secure-your-npm-and-pip-package-updates-in-amazon-linux/

二、漏洞与风险通告

1. CVE-2026-54727 / proot-distro has a Container Isolation Bypass via Crafted Restore Archive

来源：GitHub Security Advisories
时间：2026-07-30 00:42
影响：涉及CVE、高危漏洞、广泛使用产品

摘要：GitHub Advisory: GHSA-7h3g-4w2f-fj2f；严重性：high；## Affected Component - \\Package:\\ proot-distro - \\Affected command:\\ restore - \\Attack surface:\\ Host-side Termux CLI proc...

原文链接：
https://github.com/advisories/GHSA-7h3g-4w2f-fj2f

2. CVE-2026-54705 / mathlive's Lack of Escaping of HTML allows for XSS

来源：GitHub Security Advisories
时间：2026-07-30 01:21
影响：涉及CVE、高危漏洞

摘要：GitHub Advisory: GHSA-fm7p-gw32-828p；严重性：medium；### Summary Despite the 0.104.0 patch escaping attribute-bearing constructs (\\htmlData, \\href), text-content reflection was m...

原文链接：
https://github.com/advisories/GHSA-fm7p-gw32-828p

3. CVE-2026-63077: Critical unauthenticated remote code execution in JetBrains TeamCity

来源：Rapid7 Blog
时间：2026-07-30 00:16
影响：涉及CVE、高危漏洞

摘要：Overview On July 27, 2026, JetBrains published a security advisory for CVE-2026-63077 , a critical unauthenticated vulnerability affecting all versions of TeamCity On-Premises....

原文链接：
https://www.rapid7.com/blog/post/etr-cve-2026-63077-critical-unauthenticated-remote-code-execution-in-jetbrains-teamcity

4. USN-8623-1: Linux kernel (NVIDIA) vulnerabilities

来源：Ubuntu Security Notices
时间：2026-07-29 21:53
影响：涉及CVE、广泛使用产品

摘要：Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystem...

原文链接：
https://ubuntu.com/security/notices/USN-8623-1

5. USN-8621-1: Samba vulnerabilities

来源：Ubuntu Security Notices
时间：2026-07-28 19:50
影响：涉及CVE

摘要：It was discovered that Samba's pam\_winbind incorrectly handled home directory ownership when mkhomedir was enabled. A local attacker could possibly use this issue to cause a den...

原文链接：
https://ubuntu.com/security/notices/USN-8621-1

声明：本文为公开信息整理，不复现攻击细节，不构成漏洞利用指导。