推荐先读Brotli exploitation warning: what AWS Lambda teams need to verify
A 29 October NCSC warning concerns CVE-2026-111497. Check affected Brotli branches, AWS rollout conditions and evidence that a runtime is patched.
Friday Works / 主题文章 / 06
网络安全
了解如何检查、修复并复测企业网站、应用、API 与数据的安全风险。
25 篇
在事故发生前发现风险
本主题文章
文章标题和正文以英文显示。进入文章页面后可切换到越南语。
推荐先读
Firefox 159 fixes high-impact flaws: check ESR branches too
Mozilla published its advisory on October 27. Distinguish origin-isolation flaws from memory bugs, select the right servicing branch and verify after restarting.
Apple patches iOS 26.7.2: review privacy exposure on managed iPhones and iPads
The October 26 update addresses privacy and memory issues. Check device eligibility, attack conditions and the installed version after updating.
Microsoft delivers the missing .NET Windows fix in an out-of-band update
The October 25 advisory delivers corrected packages for CVE-2026-70197. Self-contained Windows applications need rebuilding and redeployment, not only a machine-wide update.
Cloudflare Adds Emergency Brotli Rules: Log Defaults Do Not Replace Node.js Patching
Cloudflare’s October 25 CVE-2026-111497 rules default to Log. Inspect Block overrides, protect Next.js image delivery and verify patched Node.js runtimes.
GitLab Patches CVSS 10 RCE: Self-Managed Servers Need Another Update
GitLab published fixes on October 21 for CVE-2026-110264 affecting CE/EE since 7.0. Identify the correct release branch, upgrade and review self-managed server telemetry.
PHP Releases Patches for Two Critical RCE Flaws: Update the Web Runtime Now
PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21. The flaws can allow unauthenticated code execution; configuration changes or a WAF do not replace patching.
Firefox 158.0.1 Ships eMudhra Certificate Blocks: What Businesses Should Check
Mozilla’s October 20 update packages blocks for eight compromised intermediates. Review OneCRL delivery, Firefox ESR and applications using NSS separately.
Cloudflare Adds Precursor Monitor Mode Before Bot-Score Enforcement
Cloudflare announced Monitor on October 19: Precursor signals leave bot score and clearance unchanged. Interstitials remain separate and need checkout/API testing.
Cisco Secure Email AMP Exploitation: Check the CVE-2026-76519 Fix
An October 18 NCSA warning highlights Cisco’s October 14 advisory. Administrators should check File Reputation, Content Scanner Tools and potential compromise separately.
BeyondTrust Remote Support Exploitation: Apply BT26-05 and Review for Intrusion
Canada’s October 16 alert calls for action on CVE-2026-102764 in BeyondTrust Remote Support. Self-hosted deployments need a specific patch and separate intrusion review.
PAN-OS Flaw Is Being Exploited: Patch the Firewall Management Interface
Palo Alto Networks disclosed CVE-2026-0322 on October 14 with limited exploitation observed. Administrative credentials and management-interface access are required.
AhsayCBS Needs a New Hotfix: Check the Backup Server for Compromise
Ahsay says earlier patches did not fully address CVE-2026-105133 and CVE-2026-105134. Verify the new hotfix and investigate compromise separately.
Responsible Security Research: Public Evidence of Friday Works’ Authorised Testing Practice
A public record of how Friday Works records scope, validates evidence, stops at the right boundary and publishes safe lessons from security research.
Phishing Emails Now Sound Very Human: Where Should a Business Stop Them?
As phishing emails become more polished, telling employees to be careful is not enough. Businesses need to protect mailboxes, accounts and verification steps.
Your Website Looks Compromised: 6 Things to Do in the First 24 Hours
Unexpected redirects, strange content or unusual mail are not a cue to delete things in a panic. Six steps to preserve evidence, limit impact and recover safely.
Website vulnerability scans: how to read the results correctly
How to distinguish signals from confirmed vulnerabilities and decide what to do after a website security scan.
Website, Web App and API Security Assessment Cost
Budget a website, web app or API security assessment around assets, user roles, business flows, testing depth, reporting and retesting.
6 Website Security Assessment Providers in Ho Chi Minh City to Shortlist in 2026
A non-ranked list of six Ho Chi Minh City providers publishing website, web app security assessment or penetration-testing services, with a method for separating scope before requesting proposals.
Security Review vs Penetration Test: What Does Your Web App Need?
Compare security reviews, website security assessments and penetration tests by objective, scope, depth, evidence, operating risk and deliverables.
What Is the OWASP Top 10 2025? A Web App and API Checklist
Understand the OWASP Top 10 2025, turn awareness risks into verifiable controls and combine it with ASVS and contextual web app and API testing.
How to Choose a Website Security Assessment Provider
Evaluate a website, web app and API security assessment provider through scope, methodology, safety constraints, evidence, reporting and retesting.
Securing AI Agents: Prompt Injection, Permissions and Guardrails
Reduce risk when AI agents read untrusted content, call tools and act inside business systems.
What Is a Passkey? A Business Passwordless Roadmap
Understand phishing resistance, synced versus device-bound credentials and a risk-based enterprise rollout.
A Practical Website Security Checklist for Businesses
Ten foundational controls that reduce risk before a website becomes a weak point in the business.