iThome 新聞
iThome 最新新聞
【2026 企業資安大調查】一張圖看2026年一般製造業企業資安風險
The 2026 iThome CIO & CISO survey reveals that general manufacturing enterprises face more high-impact, high-risk threats than high-tech manufacturers, with 11 items in the first quadrant. The sector is rapidly adopting generative AI but lacks corresponding governance frameworks, making LLM-related risks particularly acute. Phishing, BEC, and ransomware remain top threats, while LLM data leakage has newly entered the critical risk zone.
cPanel重大漏洞出現濫用的概念驗證框架，全球網際網路尚有兩萬多臺伺服器遭駭
WebPros在4月28日修補cPanel/WHM的9.8分重大漏洞CVE-2026-41940，該漏洞允許未經身分驗證的攻擊者透過HTTP標頭CRLF注入獲取root權限。CISA隨即將其列入KEV清單，並於5月1日出現概念驗證框架cPanelSniper。Shadowserver基金會監測顯示，受影響IP位址從4月30日的4.4萬個降至5月1日的2萬餘個，美國、法國、德國為重災區。
對抗先進AI模型帶來的資安威脅態勢急速惡化，AI紅隊平臺新創廠商Armadin與兩大資安公司宣布合作
AI紅隊新創公司Armadin宣布與CrowdStrike及Palo Alto Networks策略合作，以應對先進AI模型（如Mythos與GPT-Cyber）帶來的急速惡化資安威脅態勢。合作重點分別聚焦於企業內部環境防護與外部攻擊面掌控，整合AI驅動的自主攻擊模擬與評估能力，協助企業在機器速度下完成過去需數週的滲透測試工作。
Ubuntu與Canonical網站疑似遭遇DDoS攻擊而停擺
2025年5月1日，親伊朗駭客組織「伊拉克伊斯蘭網路抵抗組織—313團隊」對Canonical與Ubuntu多個網站發動DDoS攻擊，導致服務中斷超過24小時。攻擊波及ubuntu.com、canonical.com等十餘個網站，涵蓋開發工具、資安API及入口網站。此次攻擊對全球開發者、雲端服務供應商及企業用戶造成重大影響。
Linux系統核心存在高風險漏洞Copy Fail，本機使用者能藉此奪取root權限，廣泛影響多個主流Linux版本
A high-severity Linux kernel vulnerability dubbed 'Copy Fail' (CVE-2026-31431) has been disclosed by security firm Theori, scoring 7.8 on the severity scale. The flaw, existing for 9 years, allows unprivileged local users to gain root privileges via a 4-byte controlled write exploit. It affects all Linux versions released since 2017, with patches available in versions 7.0, 6.19.12, and 6.18.22.
OpenAI推出進階帳號安全機制，為ChatGPT與Codex導入實體金鑰登入並支援用戶退出模型訓練
OpenAI於4月30日宣布推出「進階帳號安全」機制，為ChatGPT與Codex用戶提供實體金鑰登入、縮短登入執行階段及自動退出模型訓練等功能。同時，OpenAI執行長Sam Altman宣布即將向關鍵安全夥伴開放專為資安設計的GPT-5.5-Cyber模型。此舉亦伴隨OpenAI與Anthropic之間的公開競爭言論。
蘋果財報超越預期，iPhone 17與MacBook Neo熱銷
Apple reported record Q2 FY2026 revenue of $111.2 billion, a 17% year-over-year increase, driven primarily by strong iPhone 17 series demand and the surprisingly popular MacBook Neo. All geographic regions posted double-digit growth, with Greater China leading at 28.1%. Apple's stock rose 2.68% after-hours to $278.46 following the earnings beat.
讓世界再次看見臺灣AI資安實力，奧義兩款產品列入OWASP AI 安全地圖
Taiwan-based cybersecurity firm CyCraft (奧義智慧) announced that two of its AI security products, XecGuard and XecART, have been listed in OWASP's latest AI Security Solutions Map. XecGuard is an AI firewall security module focused on real-time LLM protection, while XecART specializes in automated AI red teaming evaluation. This marks a significant milestone for CyCraft as a Taiwan-founded cybersecurity startup gaining global AI security recognition.
英國生物樣本庫經由內部研究人員外洩，50萬筆記錄流入阿里巴巴兜售
全球最大生物樣本資料庫UK Biobank發生重大資安事件，50萬筆匿名化生物資料遭具合法存取權的內部研究人員外洩，並被放上阿里巴巴平臺兜售。在英中兩國政府介入下，相關資料已下架且未被出售，UK Biobank已暫停所有存取並強化安全管控措施。
蘋果App Store驚見假錢包，FakeWallet攻擊竊取助記詞
Kaspersky researchers uncovered a campaign called FakeWallet, identifying at least 26 fraudulent cryptocurrency wallet apps in Apple's App Store, primarily targeting China's regional store. These fake apps impersonate popular wallets like MetaMask and Trust Wallet, intercepting seed phrases and private keys to steal crypto assets. The attack employs multiple techniques including malicious code injection and iOS configuration profiles to evade detection.
Cloudflare代理人能自主建帳號、註冊網域、部署程式
Cloudflare宣布與Stripe合作，推出能自主建立帳號、註冊網域及部署應用程式的AI代理人服務。此合作基於新協定Stripe Project，涵蓋發現、授權與支付三個階段，讓代理人能在無需人類手動操作的情況下完成整個雲端部署流程。人類仍會全程收到通知並保有最終許可權。
全球最大網攻演習落幕，41國演練戰時守護電網與軍事系統
Locked Shields 2026, the world's largest live-fire cyber defense exercise organized by NATO CCDCOE, concluded on April 24th with 41 nations, 16 teams, and over 4,000 participants. The exercise simulated wartime cyberattacks on critical infrastructure including power grids, air defense, and military systems of a fictional country called Berylia. Latvia+Singapore, Germany+Austria+Luxembourg+Switzerland, and France+Sweden were the top three performing teams.