[Claude/GPT] AI智能体对开源项目维护者钓鱼 只为逼迫维护者合并包含恶意代码的PR https://www.landian.news/archives/114209.html 非常糟糕的是,AI 智能体误以为某个真实的 GitHub 开源项目与测试靶场有关,于是尝试向该项目提交包含恶意代码的 PR。为了促使维护者合并代码,AI 智能体还研究维护者信息,创建多个虚假的 GitHub 身份,然后利用这些账号制造「已经有多人审查并认可代码」的假象。
Signed セミちゃん

Channel
@seminews
On this record: Growth · Engagement · What this channel posts · Reactions · Posts · Citations · Cite this entry
120subscribers
+0 since we began measuring on 5 August 2026
Risers and fallers across the register · movement among entries of Under 1,000.
| Telegram ID | -1001067886881 |
|---|---|
| Type | Channel |
| Username | @seminews |
| Description | 新闻并不能提供真相,只是一个看到真相的管道。不盲从,不狂热,对嘈杂世间,冷静以待。 对此频道有任何意见或建议,欢迎与 @Zerta_D 联系。 |
| Created | 1 May 2016 — measured — cross-checked against a third-party dataset (TGDataset) |
| First recorded | 9 August 2026 |
| Last confirmed live | 12 August 2026 |
| Measurements held | 2 |
| On Telegram | t.me/seminews |
| Measured (UTC) | Subscribers | Change |
|---|---|---|
| 9 Aug 2026, 04:16 | 120 | no change |
| 5 Aug 2026, 23:52 | 120 | first reading |
20 posts held, back to 25 May 2026 — the reader has not yet reached the start of this channel’s public history, so older posts may sit further back, unread. Read across 1 pageof Telegram’s post history, 20 posts per page.
ERR is average views per post over the last 30 days divided by subscribers, the definition TGStat uses, so this figure is comparable with the one you will see elsewhere. It falls structurally as a channel grows: a high ERR on a small channel and a low one on a large channel describe reach mathematics, not quality. We publish the figure and the sample it came from and pass no verdict on it.
ER is defined industry-wide as (forwards + reactions + comments) ÷ views— note the denominator is views, not subscribers. Telegram’s public web preview carries views and reactions but not forward or comment counts, so the reaction rate above is the reactions term only and is therefore a floor: the true ER for this channel is higher by an amount we have not measured and will not estimate. It is computed over the 2 of 9 measured posts that carry a reaction reading, and over those same posts' views.
| Window | Rolling 30 days · latest post in window 6 August 2026 |
|---|---|
| Posts held | 20 (25 May 2026 – 6 August 2026) |
| Views total | 330 |
| Reactions total | 2 |
| Forwards / comments | not exposed by the public surface — not measured, not estimated |
| Readings taken | 9 Aug 2026, 04:16 UTC |
Views are a single reading per post, taken at the time above. A post published in the last day or two is still accumulating views, which pulls the 30-day average down slightly. That is a property of the standard definition rather than a fault in it, so we keep the definition rather than “correcting” the number into something nobody can reproduce.
Precision. Telegram publishes view counts on its public widget in short form — 8.12K, 3.7M — so any reading at or above 1,000 reaches us rounded to three significant figures, and only counts below 1,000 are exact. Averages and rates derived from them are shown to the same precision rather than to the unit: a figure like 3,701,250 would assert digits nobody measured.
Reaction counts are published per emoji and rounded the same way, so a total below 1,000 is exact and a larger one is a sum that may carry a rounded component from each emoji above 1,000. Because it is a sum, it does not look rounded — read a large reaction total as three significant figures per contributing emoji rather than as the figure it prints.
Lifetime counters from Telegram’s own channel header, read 9 August 2026 — not the date at the top of this page, which is when the subscriber count was last read. A count marked ≈ was rounded by Telegram before we ever saw it — t.me prints these counters in full below 1,000 and to three significant figures above, so ≈142,000 means somewhere between 141,500 and 142,499.
Measured directly from 2 videos with a duration reading, out of the posts we hold for this channel — not this channel’s whole posting history, only the sample this register has actually read. An exact reading to the second, taken from the post itself rather than from Telegram’s own rounded chrome, so it carries no ≈ mark.
3 reactions across 3 posts, in 3 distinct kinds. The most used accounts for 33.3% of them.
| Reaction | Count | Share | Share, drawn |
|---|---|---|---|
| 🕊 | 1 | 33.3% | |
| 🙏 | 1 | 33.3% | |
| 🤯 | 1 | 33.3% |
No sentiment is inferred, and none should be read in. This table is ordered by count and by nothing else. Emoji do not carry stable meaning across languages or communities — 🙏 is thanks in one channel and mourning in another — so we publish which ones were pressed and how often, and pass no judgement on what an audience meant by them.
Precision. Telegram publishes reaction counts per emoji and short-forms each one — 4.34K, 1.2M — so any single kind at or above 1,000 reaches us at three significant figures, and only counts below 1,000 are exact. The shares above are ratios of those figures and carry the same error. This is also why the total here can differ slightly from a reaction total printed elsewhere on the page: both are sums of the same rounded parts, taken over samples with different edges.
Coverage. Reactions were read on 3 of the 20 sampled posts in this sample. Summed by Telegram’s own count on each post — not by adding up the per-emoji breakdown above — those same posts carry 3reactions in total: the kind of figure the paragraph above means by “a reaction total printed elsewhere on the page”.
Measured over the 20 most recent posts we hold, published 25 May 2026 to 6 August 2026, using the newest reading held for each. Telegram Stars are excluded: they are a payment, not a reaction, and they have their own section.
[Claude/GPT] AI智能体对开源项目维护者钓鱼 只为逼迫维护者合并包含恶意代码的PR https://www.landian.news/archives/114209.html 非常糟糕的是,AI 智能体误以为某个真实的 GitHub 开源项目与测试靶场有关,于是尝试向该项目提交包含恶意代码的 PR。为了促使维护者合并代码,AI 智能体还研究维护者信息,创建多个虚假的 GitHub 身份,然后利用这些账号制造「已经有多人审查并认可代码」的假象。
Signed セミちゃん
https://fixupx.com/i/status/2084629319872299290
Signed セミちゃん
We discovered a privileged process arbitrary code execution vulnerability in Android 17. This vulnerability was patched in Android 17 QPR1 but was not included in any security bulletin. Combined with the dirty frag vulnerability (CVE-2026-43284), we achieved full root privilege escalation on Android 17.0. The DirtyFrag vulnerability was disclosed 3 months ago but is still exploitabe, because Google has delayed the r…
Signed セミちゃん
AUR 正遭遇新一轮投毒攻击。已知的投毒方式是在包中添加一个可执行文件(如配图所示),并在 PKGBUILD 中以 root 权限执行。 目前还没有官方通报,但可能有上百软件包被投毒。看起来官方正在清理被投毒的包,并暂时禁止了接管孤儿包(package adoption)。
Signed セミちゃん
开源路由系统OpenWrt发布紧急安全更新修复DHCPv6漏洞 内网设备可提权执行代码 https://www.landian.news/archives/114107.html 由于 ODHCPD 组件通常以 ROOT 权限运行,因此如果攻击者可以实现稳定代码执行,就可能直接取得设备最高权限。OpenWrt 团队在官方公告中也强调,部分嵌入式设备缺少完整的堆栈保护和地址空间随机化机制,因此不能将该问题只视为可能导致服务崩溃的拒绝服务漏洞 (DoS)。
Signed セミちゃん
日本作家东野圭吾因大肠癌去世,享年 68 岁 以《嫌疑人 X 的献身》等作品引领日本推理文坛的作家东野圭吾于 7 月 23 日因大肠癌去世,享年 68 岁。 东野圭吾出生于大阪市,1985 年凭《放学后》获江户川乱步奖出道,此后相继发表《秘密》《白夜行》等作品,2006 年以《嫌疑人 X 的献身》获直木奖。以物理学家为主角的「伽利略」系列等多部作品被影视化,其作品在中国、韩国等地也广泛翻译出版,日本国内累计发行超过 1 亿册。他于 2023 年获菊池宽奖,2025 年获日本推理文学大奖。 朝日新聞 | NHK 🌸 在花频道 · 茶馆水群 · 投稿通道
🙏1
Signed セミちゃん
谷歌工程师提议禁止安卓ADB本地连接 Shizuku等高级应用将受到严重影响 https://www.landian.news/archives/114073.html 这项功能请求原本是希望允许开发者选择 ADBD 监听的网络接口从而减少无线 ADB 的暴露面,但谷歌工程师则提到可以考虑让 ADBD 只绑定到 Wi-Fi 接口的 wlan0,这会限制 localhost 连接。
Signed セミちゃん
安全研究员公布7-Zip远程代码执行漏洞 用户至少需要升级到26.02版 https://www.landian.news/archives/113976.html 安全研究员强调该漏洞并非零点击漏洞,因为黑客必须诱导用户打开精心构造的压缩包,只不过实际攻击方式仍然非常广泛,例如向目标用户发送附带恶意压缩包的钓鱼邮件,以订单等名义诱导用户下载和解压这个压缩包,这样就可以触发代码执行。
Signed セミちゃん
使用 amdgpu 与 linux 包的用户可能在近期遇到 mpv 卡死的情况,具体来说是当 mpv 配置了 vo=gpu-next 时,在使用 mpv 播放视频后一定概率会很快出现“窗口无响应”,并且 mpv 进程陷入 D 状态,运行 dmesg | grep --after-context=4 "#PF" 能看到类似以下内容的输出: #PF: error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP NOPTI CPU: 4 UID: 0 PID: 100 Comm: kcompactd0 Not tainted 7.1.1-2-cachyos #1 PREEMPT(full) RIP: 0010:amdgpu_hmm_invalidate_gfx+0x22/0xb0 [amdgpu] 除此以外,浏览器也可能突然出现上面的情况。该问题已有报告。受影响的用户…
🤯1
Signed セミちゃん
⭐ 高级格式化功能仅限 Premium 会员使用 在 Android 版 Telegram 12.9 Beta 版中,只有订阅了 Telegram Premium 的用户才能发送在高级文本编辑器中编辑的消息。 关于新编辑器界面的详细介绍请参阅此处。 #Android
Signed セミちゃん
? ??
Signed セミちゃん
Telegram中的扩展文本编辑器 在 iOS 版 Telegram 12.9.0 (33214) Beta 版中,“AI 编辑器”按钮已被 Markdown 编辑器入口取代。 当点击该按钮时,消息输入框会扩展至全屏高度,变为一个功能齐全的文章编辑器。 扩展的富文本消息支持在 Telegram 12.8 版本更新中推出,支持的格式包括各级标题、表格、文本块和剧透、LaTeX 数学公式、待办事项勾选列表,以及消息文本中间的附件,包括插图和轮播幻灯片等。 #iOS
Signed セミちゃん
Showing the 12 most recent of 20 posts we hold for @seminews. View and reaction counts are the latest single reading for each post, not a live figure, and a recent post is still accumulating both. A view count marked ≈ was rounded by Telegram before we ever saw it — t.me prints views in full below 1,000 and to three significant figures above, so ≈1,200,000 means somewhere between 1,150,000 and 1,249,999. Unmarked counts are exact. Text is reproduced from the public post preview and truncated for length.
Republishes
Channels on the register whose posts this channel has forwarded.
Built only from forwarded posts we have actually read, on both sides. Coverage is early and deliberately incomplete: a missing link means we have not read the post that would prove it, never that the relationship does not exist. Counts are distinct forwarded posts observed, so they only ever go up as we read more.
Names
Channels on the register whose handles appear in this channel's posts.
A mention is a weaker signal than a forward and is counted separately for that reason — naming a channel is not republishing it, and a handle in a post body is easy to place deliberately. The post counts beside each row below are distinct posts in which the handle appeared, from posts we have read on both sides — the “Named by N registered channels” figure above is a different count, of distinct NAMING CHANNELS rather than posts, and is not the sum of the rows under it.
A live page changes as we take new readings, so a citation should name the measurement it is based on, not just the URL. The line below cites the subscriber count as measured 9 August 2026 — this entry's latest reading, not the date you are reading this.
“SEMI Newspaper” (@seminews), 120 subscribers as measured 9 August 2026. Telegram Register, tgregister.com/channel/seminews.
Full measurement history, CC BY 4.0. Every reading this register holds for this entry, not just the latest one, as a dated, downloadable record: CSV · JSON. Free to use with attribution to tgregister.com. Each file carries its own generation timestamp, which is the figure to cite for exactly when the data was retrieved.