跳到正文
10月6日周二
  3. Truesec8

    Truesec 如何从组件存储损坏中恢复 900+ 台 Windows 11 设备

    Truesec 通过端点管理平台对近 1,000 台 Windows 11 设备执行就地升级，修复了严重损坏的 CBS 组件存储并恢复 Windows Update 功能。该问题始于 2025 年 8 月，在 5,000+ 台由 Microsoft Intune 管理的云优先终端中，受影响设备持续无法应用更新，常规修复手段均告失败。恢复后设备重回正常补丁节奏，补丁合规性与安全暴露面同步改善。

  5. Redwood Research64

    Redwood Research 研究发现前沿模型会根据提问者身份给出不同的决策理论偏好

    Redwood Research 的 Alex Kastner 发布研究，发现当前前沿模型在被直接询问时几乎总是偏好 FDT/UDT，但当提问线索暗示用户来自主流学术哲学背景时，Claude Fable 5.1 有约 30%-100% 的概率转而回答 CDT。

    推荐理由：研究用100次采样量化了用户线索如何改变模型的立场表述，提醒读者在无共识领域解读态度评测时需谨慎。

10月5日周一
  1. BurpSuite官方71

    PortSwigger 研究：用重叠片段把 CSS 注入可窃取的 token 长度推至 640 字符

    PortSwigger 研究员 Alex 在 Gareth Hughes 原始 CSS 注入窃取 token 技术基础上，用图论方式把大量短片段按重叠关系拼接，无需递归加载样式表即可重建完整 token。

    推荐理由：原文用图论重叠片段思路把 CSS 注入窃取 token 的成本压低三个数量级，并给出可复现的实验数据与 Burp AT 技能，读者可直接迁移该方法。

  2. Import AI (Jack Clark)62

    Import AI 475：智能体群体扩展、SynthID Bio 生物水印与自动化科学经济

    Jack Clark 在 Import AI 475 中评述了 Toby Ord 关于智能体群体（swarm）作为新型推理扩展的分析：4 个智能体的群体达到相同性能约需两倍总 token，但因并行可将耗时减半；群体规模扩大 10 倍带来的性能提升约为 3x 到 5x，存在类似经济学中踩脚效应的收益递减，但 Ord 认为这反而可能提高 RSI 驱动的智能爆炸概率。

10月3日周六
  1. Redwood Research58

    Redwood Research：能力研究同样会推动安全-有用性帕累托前沿

    Redwood Research 的 Alex Mallen 发文论证，仅以“提升安全且不显著损害有用性”定义安全研究并不成立，因为开发者最终要在帕累托前沿上选择具体一点，而能力研究通常把前沿推向“更有用但更不安全”的方向，诱导开发者牺牲安全换取有用性。

10月2日周五
  2. Cloudflare70

    Cloudflare 为 Quick Tunnels 推出 --allowed-mail 邮箱白名单保护

    Cloudflare 从 cloudflared 2026.9.3 起为 Quick Tunnels 新增 --allowed-mail 参数，可限定访问者邮箱或域名，访客通过 Cloudflare Access 发送的一次性 PIN 验证身份，全程无需 Cloudflare 账号。

    推荐理由：原文拆解了无账号场景下策略存放位置的设计取舍，读者可迁移这种认证与授权分离的思路到自家工具。

10月1日周四
9月30日周三
  3. Hugging Face Blog

    Open TTS Leaderboard: Scalable Evaluation for Multilingual Text-to-Speech and Voice Cloning

    TLDR 👉 new TTS leaderboard focused on open-source and multilingual The pace of open-source text-to-speech (TTS) model releases has been incredible. On the Hugging Face Hub (as of Sep 30, 2026) there are more than 8K TTS models available 🚀 Evaluation, however, hasn't kept pace: it remains fragmented and unstandardized. The gold standard is human preference scores such as MOS or MUSHRA (more on metrics ). To this end, several arena-based leaderboards have established themselves as useful reference points for the community: TTS Arena v2 Artificial Analysis Voice Arena These arenas compare models by presenting users with TTS outputs from two models, and asking them to choose one over the other. After collecting a sufficient number of votes, an Elo score is computed to rank models, typically with the Bradley–Terry model (see Voice Arena methodology ). While human preference is the ultimate decider, arenas cannot scale to keep up with the pace of TTS releases . This may partly explain why open-source models are underrepresented on arena-style leaderboards: as of Sep 30, 2026, only 16 of the 92 models on Artificial Analysis are open-weights, with a similar skew on Voice Arena . This likely reflects practical factors: adding an API model requires little more than an API key, whereas an open model must be hosted and served by the arena operator, and commercial providers have more reason to seek placement than open-source authors. Another limitation with arena-style evaluation is voter consistency: no arena can ensure that the same voters with the same criteria of “better” can consistently evaluate models over time. Even the preferences of a single person change over time (“A man cannot step into the same river twice” as famously said by Heraclitus). To this end, we've built the Open TTS Leaderboard , which uses objective metrics to evaluate models on complementary aspects of performance: Intelligibility : word/character error rate (WER and CER) between the prompt and the generated audio's transcript, using Qwen3 ASR (top ranking open-source model on the Open ASR Leaderboard ). Speed : inverse real-time factor (RTFx) for batched offline inference on an H200 GPU, and time-to-first-audio (TTFA) for quantifying streaming batch size 1 latency on an H200 GPU and CPU. Speaker similarity by computing the cosine similarity (SIM) between WavLM speaker embeddings of the generated audio and the reference clip. By relying on objective metrics evaluating a model drops from a couple weeks (for collecting votes) to a couple hours ⚡ Importantly, the Open TTS Leaderboard does not replace human preference ranking. ASR-based WER provides a proxy for intelligibility, while speaker similarity estimates voice identity preservation. Neither directly measures naturalness, expressiveness, or listener preference. Nevertheless, they can even inform voting-based leaderboards which models to include in their evaluations. Our intention with this leaderboard is for it to be shaped by the community ; we want to hear your feedback so the evaluations stay relevant and insightful. The next few sections give an overview of main features of the Open TTS Leaderboard. Multilingual + voice cloning evaluation From the default view of the leaderboard, models are ranked by macro-average WER on the English splits of Seed TTS Eval ( paper ) and CV3 Eval (zero shot) ( paper ). hexgrad/Kokoro-82M , Supertone/supertonic-3 , and fishaudio/s2-pro lead the pack on English WER when averaged on these two splits, while the Pareto plots visualize which models strike a good balance between WER, batched inference (RTFx), and size. English performance doesn't necessarily translate to other languages. Multiple languages can be toggled to rank models on multilingual performance. Seed TTS Eval only has audio for English and Chinese, so the other languages are simply the score on CV3 Eval (zero shot). Note that Chinese, Japanese, and Korean are character-based languages and so character error rate (CER) is reported, and the “Average WER” across languages is a macro-average across languages. k2-fsa/OmniVoice , fishaudio/s2-pro , and FunAudioLLM/Fun-CosyVoice3-0.5B-2512 are strong multilingual models. By toggling “Voice cloning”, the models that support this functionality (on the selected languages) can be compared. Moreover, a SIM column for speaker similarity now appears in the table, as well as two more Pareto plots for visualizing the tradeoff between SIM, batched inference, and size. The average WER of some models, such as bosonai/higgs-tts-3-4b and openbmb/VoxCPM2 , improve under voice cloning, namely when a reference audio is provided. Compare and vote on TTS outputs Numbers only tell part of the story, and as mentioned earlier human preference is the ultimate decider . From the “Listen” tab, you can compare the generated outputs that are behind the metrics, to find which model(s) you prefer! Pick the language/dataset you're interested in, whether you want to compare voice cloning , and optionally pick the models or listen to outputs from a random selection. The “Listen” tab fills an important gap in existing TTS leaderboards: a space to explore model outputs of various models. You can even give feedback on the generated outputs. As we collect more votes from the community, we may include this data on the leaderboard. So vote! But please login with your HF account to help us weed out spam/bots. Streaming performance The “Streaming” tab compares the streaming capabilities. Models are ranked by TTFA (time-to-first-audio), which quantifies how long a user waits after probing a model in order to obtain audio that can be played. This is important for voice agents and other interactive apps. For streaming models (✅ under “Streaming API”) it's the time until the first audio chunk arrives. For non-streaming models, it's the time until the whole utterance is generated, because playback can't start any earlier. Every model runs one audio at a time (batch size 1), on the same 50 English prompts from CV3-Eval, on the same hardware and in its default voice. We drop the first 3 runs as warm-up and report the median TTFA across the rest. The default view compares performance on an H200 GPU. Results are also available for CPU for a small (but growing) set of models! kyutai/pocket-tts is a great model for streaming on both GPU and CPU! Conclusion The goal of the Open TTS Leaderboard is not only to keep up with the incredible pace of TTS model releases, but to be shaped by the community; we want to hear your feedback so the evaluations stay relevant and insightful. Let us know which datasets, models, and metrics you want to see! For now, we've focused on: Open-source models , to put forward many great models that have been neglected by arena-style evaluations. Multilingual , since English performance is not a suitable proxy for other languages. We will soon open-source the evaluation scripts, much like the Open ASR Leaderboard repo , so that you can directly provide your feedback and suggestions via GitHub Issues and PRs! Let's shape TTS evaluations together 🤗

  5. 奇安信18

    奇安信助力香港警务处「耀冠」演练，筑牢国际重大活动网络安全屏障

    奇安信作为独家技术支撑单位，助力香港警务处网络安全及科技罪案调查科9月29日在警察总部举办代号「耀冠」的大型活动桌面演练暨网络安全研讨会。演练模拟钓鱼攻击、网站劫持、供应链风险、AI 深伪虚假信息传播及关键基础设施网络袭击等场景，共36个部门、逾100名代表参与。

9月29日周二
  5. Cloudflare80

    Cloudflare 宣布成为 CA 并将支持 Merkle Tree Certificates 签发

    Cloudflare 宣布将成为证书颁发机构（CA），并支持 Merkle Tree Certificates（MTC）签发，目标在 2027 年初被纳入 Chrome 新推出的 Quantum-resistant Root Store，标准 MTC 签发将免费提供。

    推荐理由：原文解释了 Web PKI 面临的后量子签名体积膨胀问题及 MTC 的应对架构，读者可据此理解证书透明体系的下一步演进方向。

  6. Cloudflare74

    Cloudflare 宣布进军公共 CA，收购 GlobalSign 根证书并布局后量子证书

    Cloudflare 宣布有意成为公共证书颁发机构（CA），已向 Chrome、Apple、Microsoft、Mozilla 根程序申请纳入，并签署协议从 GlobalSign 收购一个被广泛信任的既有根，以在开始签发首日即覆盖大量老设备。

    推荐理由：原文说明了新根与收购既有根并行的双路径策略，读者可据此理解根程序分发滞后与老设备兼容的实际约束。

  9. Anthropic88

    Anthropic 红队评估 GLM-5.3 的端到端漏洞利用能力与护栏绕过

    Anthropic 前沿红队发布对智谱 GLM-5.3 的评估，称其具备自主构建端到端网络漏洞利用的能力，且护栏可被简单手法绕过 64% 至 100%。

    推荐理由：Anthropic 红队实测 GLM-5.3 的端到端漏洞利用能力与护栏绕过率，可与 CAISI 的评估对照看开源权重模型的攻防落差。

  10. 奇安信20

    奇安信AI+代码卫士护航，湖北银行源代码安全获2026 IDC中国未来企业大奖

    湖北银行与奇安信基于“AI+代码卫士”打造的源代码安全检测平台获2026年IDC中国未来企业大奖优秀奖“安全与风控领军者”，从500多个参评案例中入选80个优秀奖。平台接入代码仓库120余个，日均检测超10万行，降噪率88.89%，单系统审计耗时减少83.63%，整体漏洞数量下降约80%。奇安信代码卫士已支持32种编程语言、可检测3500多种源代码安全缺陷。

9月28日周一
  1. Krebs on Security78

    荷兰警方逮捕涉嫌协助 ShinyHunters 数据盗窃与勒索的24岁黑客 Pepijn van der Stap

    荷兰警方逮捕24岁前网络罪犯 Pepijn van der Stap，怀疑其协助黑客组织 ShinyHunters 进行数据盗窃与勒索。Van der Stap 曾化名 Umbreon 从事数据盗窃与勒索，2023年被判四年监禁，2025年12月出狱后任 Neo Security 攻防安全主管，9月9日受访自称已改过自新，约9月16日被拘留。

  5. 深信服22

    深信服 AI 安全风险评估限时免费开放，覆盖红队检测、插件扫描与环境排查

    深信服「AI 安全风险评估」限时免费开放，面向准备上线或刚完成重大变更的 AI 应用提供一次安全检查。该服务包含三项核心检查：AI 红队检测模型内容安全、Skills / MCP 插件风险扫描、底层运行环境漏洞排查。区别于固定语料回放，由 AI 红队持续多轮追击并动态调整攻击策略，最终输出可回溯、可整改的安全风险报告。

9月26日周六
9月25日周五