// Blog
Author: mirrorspeed@mirrorquant.com
Practical guides on speed, connectivity, privacy and networking.
EN
迟到 9 + length 字节的检查：CVE-2026-88975，http4s Ember HTTP/2 帧校验为何形同虚设
CVE-2026-88975（CVSS 3.1 7.5，CWE-400）是 http4s Ember HTTP/2 实现的未认证资源消耗漏洞：读循环在缓冲完整 9 + length 字节之前不做任何帧大小校验，对端可以在 9 字节帧头里声明一个接近 24 位上限的单帧长度，并持续发送接近 16 MiB、但仍不足额的负载，使当前未完成帧的累积缓冲 acc 驻留约 16 MiB——约为 16…
EN
从 ZCode Trust Folder Bypass 0day 漏洞看 Coding Agent 的 Trust Folder 安全问题
算是一个 ZCode 都 0day，通过打开恶意的目录触发
EN
New Release: Tor Browser 15.0.24
Tor Browser 15.0.24 is now available from the Tor Browser download page and also from our distribution directory. This version includes important…
EN
New Release: Tails 7.14
Changes and updates Update Tor Browser to 15.0.24. Update the Tor client to 0.4.9.13. Update the Linux kernel to 6.12.111. Fixed problems…
404 Media
Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation
Authorities in the Netherlands have arrested a 23-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific…
EN
Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft
Cryptocurrency exchange Bitget on Wednesday confirmed that attackers who stole $387.5 million last week exploited a zero-day flaw in third-party security products,…
AT&T
U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions
A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more…
EN
MetaMask Security Incident Prompts Exit of Affected Ethereum Validators
MetaMask on Thursday said it's responding to what it described as an "ongoing security incident" impacting part of its infrastructure. "We are…