ONCALL://19

参考资料

19 份报告引用的全部来源，可以按关键字和域名筛选。

这里汇总了 19 份报告引用的全部来源，按事故分组。编号和报告正文里的角标一致，例如 INC-06 的 [1] 就是 LiteLLM 报告正文里的 [1]。

来源以一手资料为主，包括厂商安全公告、CVE 和 NVD 记录、GitHub 安全公告、发行版安全跟踪页、Bugzilla 讨论和项目提交记录。点击上方的域名标签，可以只看来自某个网站的来源。

显示 165 条来源

INC-01CVE-2026-99999：PwnEscape 虚拟机逃逸12
  1. [1]CVE-2026-99999 CVE Recordcve.org
  2. [2]Red Hat CVE-2026-99999access.redhat.com
  3. [3]Debian Security Tracker CVE-2026-99999security-tracker.debian.org
  4. [4]PWNAI PwnEscape Guest-to-Host KVM Escapepwn.ai
  5. [5]Linux upstream patch commit 6785011f8b16api.github.com
  6. [6]Findings from the 1M Vercel Sandbox challengevercel.com
  7. [7]AlmaLinux PwnEscape patched kernels announcementalmalinux.org
  8. [8]oss-security PwnEscape disclosureopenwall.com
  9. [9]Linux Kernel Checksum Offloads documentationdocs.kernel.org
  10. [10]CISA Known Exploited Vulnerabilities catalog JSONcisa.gov
  11. [11]Ubuntu CVE-2026-99999ubuntu.com
  12. [12]GitHub Advisory Database searchgithub.com
  13. 查看这些来源在报告中的引用位置
INC-02PingCAP 内部系统遭入侵（TiDB Cloud）13
  1. [1]Security Incident Report: Unauthorized Access to PingCAPpingcap.com
  2. [2]TiDB Cloud Release Notes in 2026docs.pingcap.com
  3. [3]The Easiest Way to Run TiDB at Scalepingcap.com
  4. [4]THE PingCAP / TiDB Cloud LEAKSfulcrumsec.vg
  5. [5]PingCAP / TiDB Cloud Data Breachsocradar.io
  6. [6]PingCAPbreachsense.com
  7. [7]TiDB Breach Exposes Flawed Cloud Security Assumptionsdarkreading.com
  8. [8]Security Incident: Recommended Customer Actionspingcap.com
  9. [9]不正アクセスによる情報漏洩に関するお詫びとご報告pingcap.co.jp
  10. [10]PingCAP 遭大规模数据泄露！黑客声称窃取 10.6TB 数据（InfoQ）163.com
  11. [11]Hackmanac: PingCAP confirmed a data breach affecting up to 50,000 personal records in Japanx.com
  12. [12]谢家印（Bitget）关于 TiDB Cloud 泄漏的回应x.com
  13. [13]Hacker News: PingCap TiDB Leaksnews.ycombinator.com
  14. 查看这些来源在报告中的引用位置
INC-03PHP 双 RCE：CVE-2026-109618 与 CVE-2026-1096196
  1. [1]PHP 2026年安全公告归档php.net
  2. [2]CERT-EU Security Advisory 2026-018cert.europa.eu
  3. [3]Google Cloud: Responding to core PHP vulnerabilitiescloud.google.com
  4. [4]Canadian Centre for Cyber Security Alert AL26-026cyber.gc.ca
  5. [5]PHP Upcoming Critical Security Releasenews-web.php.net
  6. [6]PHP 8.3.36 Releasednews-web.php.net
  7. 查看这些来源在报告中的引用位置
INC-04Zeabur 两次被入侵后宣布停运5
  1. [1]Zeabur 停止运营公告及服务迁移安排zeabur.com
  2. [2]Zeabur October 2026 security incident (preliminary report)zeabur.com
  3. [3]Migrating off Zeabur: hand this guide to your coding agentzeabur.com
  4. [4]Zeabur shutting down after second security breach in two monthsbleepingcomputer.com
  5. [5]Zeabur is shutting down: what happens nextzeabur.com
  6. 查看这些来源在报告中的引用位置
INC-05eMudhra 8 个中间 CA 私钥可被恢复21
  1. [1]Mozilla：保护 Firefox 用户免受 eMudhra 中间证书失陷影响blog.mozilla.org
  2. [2]Mozilla Bug 2083449：eMudhra 中间证书私钥失陷bugzilla.mozilla.org
  3. [3]Python 社区：eMudhra／emSign CA 事故信息discuss.python.org
  4. [4]Google：保护 Chrome 和 Android 用户blog.google
  5. [5]GHSA-6q48-6c7w-9gw2：移除 emSign 根证书github.com
  6. [6]eMudhra：近期证书安全事故声明emudhra.com
  7. [7]eMudhra：全球 TLS CA 处置声明emudhra.com
  8. [8]eMudhra 中间 CA 私钥失陷追踪页emudhra.we-have-a-problem.com
  9. [9]Mozilla 开发者安全策略论坛：受损 eMudhra 中间证书groups.google.com
  10. [10]受影响中间证书和交叉签名清单emudhra.we-have-a-problem.com
  11. [11]Go 1.27.3 和 1.26.10 安全发布groups.google.com
  12. [12]NVD：CVE-2026-111943services.nvd.nist.gov
  13. [13]Go 漏洞报告 GO-2026-6809pkg.go.dev
  14. [14]Microsoft：Windows 证书和信任learn.microsoft.com
  15. [15]Firefox Android 158.0.2 发行说明firefox.com
  16. [16]GHSA-hq85-5cpj-mr62：移除 emSign 根证书github.com
  17. [17]webpki-roots 1.0.10 发行说明github.com
  18. [18]webpki 0.103.16 发行说明github.com
  19. [19]Node.js 24.22.1 发行说明github.com
  20. [20]Red Hat：eMudhra 证书失陷公告access.redhat.com
  21. [21]Help Net Security：eMudhra 弱 CA 密钥报道helpnetsecurity.com
  22. 查看这些来源在报告中的引用位置
INC-06LiteLLM 1.107.0 发布流水线被劫持6
  1. [1]Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromiseddocs.litellm.ai
  2. [2]Datadog Security Labs: LiteLLM supply chain compromisesecuritylabs.datadoghq.com
  3. [3]StepSecurity: litellm 1.107.0 Compromised on PyPIstepsecurity.io
  4. [5]LiteLLM Security Update: Suspected Supply Chain Incident, March 2026docs.litellm.ai
  5. [6]PyPI Incident Report: LiteLLM and Telnyx supply-chain attacksblog.pypi.org
  6. [7]Snyk: How a Poisoned Security Scanner Became the Key to Backdooring LiteLLMsnyk.io
  7. 查看这些来源在报告中的引用位置
INC-07Node.js 10 月安全发布：TLS 主机名绕过与 Brotli 越界写5
  1. [1]Wednesday, October 21, 2026 Security Releasesnodejs.org
  2. [2]Node.js 24.22.1 LTSnodejs.org
  3. [3]Node.js 22.23.4 LTSnodejs.org
  4. [4]Node.js 26.12.1 Currentnodejs.org
  5. [5]NVD CVE-2026-111497nvd.nist.gov
  6. 查看这些来源在报告中的引用位置
INC-08Railway 加密环境变量被访问并部分解密7
  1. [1]Security Disclosure: Wednesday October 21stblog.railway.com
  2. [2]Railway Platform Outage 状态页status.railway.com
  3. [3]Security Disclosure Recommendation: Check for Unexpected Usage in Stripeblog.railway.com
  4. [4]Using Variablesdocs.railway.com
  5. [5]Developer Links $370,000 Theft to Railway Secrets Exposurethedefiant.io
  6. [6]Security Disclosure Recommendation: Check for Anomalous AWS Accessblog.railway.com
  7. [7]Security Disclosure Recommendation: Check for Anomalous GCP Accessblog.railway.com
  8. 查看这些来源在报告中的引用位置
INC-09NGINX 1.23.0 落在多个 2026 年高危漏洞范围内4
  1. [1]nginx security advisoriesnginx.org
  2. [2]K000162097: NGINX map directive and regex matching vulnerability CVE-2026-42533my.f5.com
  3. [3]K000162608: NGINX ngx_http_core_module vulnerability CVE-2026-97205my.f5.com
  4. [4]K000161616: NGINX ngx_http_v3_module vulnerability CVE-2026-42530my.f5.com
  5. 查看这些来源在报告中的引用位置
INC-10Go net/http 与 HTTP/2 代理路径漏洞6
  1. [1]Go 1.27.2 and Go 1.26.9 are releasedgroups.google.com
  2. [2]Go vulnerability report GO-2026-6609pkg.go.dev
  3. [3]Go vulnerability report GO-2026-6611pkg.go.dev
  4. [4]Go vulnerability report GO-2026-6610pkg.go.dev
  5. [5]Red Hat CVE-2026-78667access.redhat.com
  6. [6]Go release historygo.dev
  7. 查看这些来源在报告中的引用位置
INC-11Linux 内核 c6e50df8：引入 PwnEscape 的那次提交14
  1. [1]CVE-2026-99999cve.org
  2. [2]tun: Allow GSO using virtio_net_hdrgithub.com
  3. [3]ipv4: validate checksum_start before completing checksumgithub.com
  4. [4]PATCH net v4 0/2: prevent partial checksums from modifying IPv4 headerslists.openwall.net
  5. [5]PwnEscape: Guest-to-Host KVM Escapepwn.ai
  6. [6]Findings from the $1M Vercel Sandbox challengevercel.com
  7. [7]CISA Catalog of Known Exploited Vulnerabilitiescisa.gov
  8. [8]Linux 6.1.190 ChangeLogcdn.kernel.org
  9. [9]Ubuntu CVE-2026-99999ubuntu.com
  10. [10]Red Hat CVE-2026-99999access.redhat.com
  11. [11]Debian Security Tracker CVE-2026-99999security-tracker.debian.org
  12. [12]PwnEscape patched kernels available in testingalmalinux.org
  13. [13]SUSE CVE-2026-99999suse.com
  14. [14]CloudLinux PwnEscape mitigation and kernel updateblog.cloudlinux.com
  15. 查看这些来源在报告中的引用位置
INC-12Sectigo 交叉签名卷入 eMudhra 事件15
  1. [1]eMudhra: Private key compromise of Intermediate Certificatesbugzilla.mozilla.org
  2. [2]Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA Certificatesblog.google
  3. [3]Protecting Firefox users following the compromise of eMudhra intermediate certificatesblog.mozilla.org
  4. [4]eMudhra impacted intermediates inventoryemudhra.we-have-a-problem.com
  5. [5]Go 1.27.3 and Go 1.26.10 are releasedgroups.google.com
  6. [6]Node.js 24.22.1 Krypton LTS releasegithub.com
  7. [7]eMudhra Intermediate CA Compromiseemudhra.we-have-a-problem.com
  8. [8]CA Browser Forum TLS Baseline Requirements 2.3.1cabforum.org
  9. [9]2026 updates that affect certificate issuance validation trust and renewalssectigo.com
  10. [10]Sectigo TLS Certification Practice Statement 6.1.5sectigo.com
  11. [11]Sectigo DV SSL Certificatessectigo.com
  12. [12]Sectigo Certificate Subscriber Agreement 2.1sectigo.com
  13. [13]200-day certificates are starting to expiresectigo.com
  14. [14]NSS 3.131.1 Release Important Security Updatesgroups.google.com
  15. [15]NVD CVE-2026-111943 lookupnvd.nist.gov
  16. 查看这些来源在报告中的引用位置
INC-13Vyper 编译器错误编译与常量篡改缺陷7
  1. [1]Vyper 官方安全公告列表github.com
  2. [2]Ternary expressions misread nested arrays with different inner boundsgithub.com
  3. [3]Optimizer replaces msg.value or len(msg.data) expression in ternary branchesgithub.com
  4. [4]Multi-byte identifier characters can silently change literal valuesgithub.com
  5. [5]Line-separator characters can silently change literal values and typesgithub.com
  6. [6]Function variables can replace imported constant values and default argumentsgithub.com
  7. [7]Vyper 官方发行版本记录github.com
  8. 查看这些来源在报告中的引用位置
INC-14Docker Engine 29.x 授权插件绕过与 docker cp 漏洞9
  1. [1]Moby v29.5.1 发布公告github.com
  2. [2]Docker Engine 29 发行说明docs.docker.com
  3. [3]AuthZ 插件绕过 GHSAgithub.com
  4. [4]归档上传触发宿主机代码执行 GHSAgithub.com
  5. [5]docker cp 创建宿主机空文件竞态 GHSAgithub.com
  6. [6]docker cp bind mount 重定向竞态 GHSAgithub.com
  7. [7]Docker 安全公告docs.docker.com
  8. [8]Kubernetes 官方 CVE feedkubernetes.io
  9. [9]NVD CVE-2026-34040nvd.nist.gov
  10. 查看这些来源在报告中的引用位置
INC-15Traefik Ingress NGINX provider mTLS 认证绕过5
  1. [1]Traefik GHSA-j994-9gqj-9hwqgithub.com
  2. [2]NVD CVE-2026-85596nvd.nist.gov
  3. [3]Traefik v3.7.11 releasegithub.com
  4. [4]Traefik GHSA-9cr8-q42q-g8m7: HTTP/3 mTLS bypassgithub.com
  5. [5]Red Hat CVE-2026-85596access.redhat.com
  6. 查看这些来源在报告中的引用位置
INC-16ASP.NET Core Kestrel 请求走私与 Microsoft QUIC RCE8
  1. [1].NET and .NET Framework October 2026 servicing releases updatesdevblogs.microsoft.com
  2. [2].NET 10.0.13 Release Notesgithub.com
  3. [3]Microsoft Security Advisory CVE-2026-88092github.com
  4. [4]Microsoft Security Advisory CVE-2026-105016github.com
  5. [5]October 2026 Microsoft Patch Tuesdayisc.sans.edu
  6. [6]Microsoft Security Advisory CVE-2026-70188github.com
  7. [7]CVE-2026-88092 & CVE-2026-70188: Critical Kestrel Vulnerabilities in .NET 6herodevs.com
  8. [8]CVE-2026-108398 .NET Framework Security Feature Bypass Vulnerabilitymsrc.microsoft.com
  9. 查看这些来源在报告中的引用位置
INC-17根证书库：Go x509、webpki-roots、certifi 的 eMudhra 修复14
  1. [1]Google：保护 Chrome 和 Android 用户免受 eMudhra 中间 CA 泄露影响blog.google
  2. [2]Mozilla Bug 2083449：eMudhra 中间证书私钥泄露bugzilla.mozilla.org
  3. [3]Go 漏洞报告 GO-2026-6809pkg.go.dev
  4. [4]CVE-2026-111943 官方 CVE JSON 记录cveawg.mitre.org
  5. [5]RUSTSEC-2026-0381：webpki-roots 信任已撤销 emSign 中间证书rustsec.org
  6. [6]webpki-roots 拉取请求 133：删除 emSign 根github.com
  7. [7]GHSA-6q48-6c7w-9gw2：删除 emSign 根证书github.com
  8. [8]Python 用户 eMudhra 与 emSign CA 事件公告discuss.python.org
  9. [9]eMudhra 受影响中间证书和交叉签名清单emudhra.we-have-a-problem.com
  10. [10]eMudhra 中间 CA 泄露事件说明与修复矩阵emudhra.we-have-a-problem.com
  11. [11]webpki-roots 0.26.10 发布说明github.com
  12. [12]NVD 对 CVE-2026-111943 的查询结果nvd.nist.gov
  13. [13]certifi 2026.10.19 发布标签github.com
  14. [14]Go 1.27.3 和 1.26.10 安全发布公告groups.google.com
  15. 查看这些来源在报告中的引用位置
INC-18GitLab 正则编译器整数溢出 RCE（CVE-2026-110264）5
  1. [1]GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13docs.gitlab.com
  2. [2]Self-hosted GitLab CE 19.5.1 asks to update but it's already the latestforum.gitlab.com
  3. [3]GitLab warns of max severity code execution vulnerabilitybleepingcomputer.com
  4. [4]Detection: Onigmo native worker crashgitlab.com
  5. [5]Detection: Org mode render error burstgitlab.com
  6. 查看这些来源在报告中的引用位置
INC-19Chrome 156 稳定版：353 项安全修复，含 6 个 Critical3
  1. [1]Chrome Releases: Stable Channel Update for Desktop (2026-10-20)chromereleases.googleblog.com
  2. [2]Chrome Releases: Chrome for Android Updatechromereleases.googleblog.com
  3. [3]Chrome 156 Ships With 353 Security Fixes, Including Six Critical Vulnerabilitiessecurityonline.info
  4. 查看这些来源在报告中的引用位置

调研截止 2026-10-22 UTC+8 · 未验证的内容已在正文中标注 · 数字以原始来源为准

合并时间线

19 份报告的时间线合并成一条，统一换算为 UTC。可以按范围和事故筛选。

INC-01 CVE 99999

Linux IPv4 网络栈没有校验 csum_start。不可信虚拟机可借此泄漏宿主机内存，甚至在宿主机上执行代码。这个漏洞存在了约 18 年。