Notes

Google安全工程：我的面试学习笔记 作者 nolang 我是Google的一名安全工程师，这些是我准备面试时做的笔记。这是我的第一份安全工作，很多人问过我是如何学习的。我的笔记主要由一系列需要学习的术语和技术组成，外加一些帮助我记住某些细节的小贴士。我还包含了面试技巧和学习策略，这些与了解要学习哪些主题同样重要。 我会不定期更新笔记以涵盖更多主题。列表中包含很多很多主题和术语。请仔细思考你申请的职位，并针对性地学习。没人期望你成为所有领域的专家。 如果你的编码能力较弱：...

CVE-2017-0213

CVE-2017-0213：Windows COM 特权提升漏洞 描述 作者： Google 安全研究团队 CVE： 2017-0213 EDB-ID： 42020 参考： Project-Zero Microsoft Exploit-Database 视频： Youtube 受影响的产品 产品| 版本| 更新| 内部版本| 已测试 ---|---|---|---|--- Windows 10| 1511| | 10586| √ Windows 10| 1607| | 14393| √ Windows 10| 1703| | 15063| √ Windows 7| | SP1| | √...

Investing Together: Wiz Defend and Google Security Operations

Continuing to deepen the integration between Wiz Defend and Google Security Operations, helping teams work faster wherever they choose to investigate...

CVE-2026-15587

CVE-2026-15587 affects Google SecOps (Chronicle SOAR) prior to version 6.3.85 on Google Cloud Platform. An authenticated attacker could escalate to system-level admin via a crafted internal authentication header. The issue is mitigated by upgrading to 6.3.85; Google notes no customer action is re...

Top Google Security Staff Warn Search Data Could Be Hacked if EU Rules Change

Europe’s pro-competition proposals could see Google Search and Android systems opened up. The company claims there are serious privacy flaws...

security-research

Security Research This project hosts security advisories and...

security-research

Security Research This project hosts security advisories and...

Inside a fake Google security check that becomes a browser RAT

A website styled to resemble a Google Account security page is distributing what may be one of the most fully featured browser-based surveillance toolkits we have observed in the wild. Disguised as a routine security checkup, it walks victims through a four-step flow that grants the attacker push...

Google SecOps SOAR Server 安全漏洞

Google SecOps SOAR Server is a security platform from Google, Inc USA. A security vulnerability exists in Google SecOps SOAR Server that stems from insufficient code validation of uploaded Python packages, which could lead to remote code execution...

MAL-2025-190978 Malicious code in nanoreset (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d98d973ab73f5753f101bf681c2916dd61b81ae036a3519f76e17321ba9e2ef The package nanoreset was found to contain malicious code. Source: ghsa-malware fc12f8a503d7dbf0bae6b335d8ea61ae3e1c8e6ec42e415cc48b4ab536180c8e Any...

EUVD-2025-18662

Malicious code in bioql PyPI...

CVE-2025-9918

CVE-2025-9918 describes a Path Traversal vulnerability in the archive extraction component of Google SecOps SOAR Server, affecting version 6.3.54.0, 6.3.53.2 and earlier. An authenticated attacker with import-use-case permissions can achieve Remote Code Execution by uploading a malicious ZIP arch...

How to spot the latest fake Gmail security alerts

Security alerts from tech companies are supposed to warn us when something might be amiss—but what if the alerts themselves are the risk? Scammers have long impersonated tech companies' security and support staff as a way to sniff out users' login credentials, and reports suggest that they're doi...

Google ChromeOS Out-of-Bounds Read Vulnerability

Google ChromeOS is an operating system from the American company Google. Google ChromeOS suffers from an out-of-bounds read vulnerability that can be exploited by an attacker to cause a virtual machine to escape...

security-research

Security Research This project hosts security advisories and...

Empowering SecOps in the cloud: enhancing threat detection with Wiz and Google Security Operations

Wiz announces integration with Google Security Operations to help SecOps teams identify critical cloud security issues...

Google Fixes Nearly 100 Android Security Issues

Plus: Apple shuts down a Flipper Zero Attack, Microsoft patches more than 30 vulnerabilities, and more critical updates for the last month of 2023...

New Malvertising Campaign Distributing PikaBot Disguised as Popular Software

The malware loader known as PikaBot is being distributed as part of a malvertising campaign targeting users searching for legitimate software like AnyDesk. "PikaBot was previously only distributed via malspam campaigns similarly to QakBot and emerged as one of the preferred payloads for a threat...

Vulnerability Researchers: Check out The Critical Thinking Podcast

Today, The Wordfence Bug Bounty Program was featured on an episode of the Critical Thinking Podcast, a top resource and community for bug bounty researchers. Critical Thinking is a podcast focused on ethical hacking and security analysis and is described as a “by Hackers for Hackers podcast focus...

Google Android suffers from an unspecified vulnerability (CNVD-2023-9767435)

Google Android is a Linux-based open source operating system from Google. Google Android has a security vulnerability that can be exploited by attackers to cause denial of service attacks...