https://blog.1sec.day/tags/%E5%BC%80%E5%8F%91%E8%80%85%E5%AE%89%E5%85%A8/ Recent content in 开发者安全 on 思安录 | Thinking's Security Notes Hugo -- gohugo.io zh-cn Thinking Thinking Sat, 18 Jul 2026 00:00:00 +0000 https://blog.1sec.day/posts/2026-07-18-grok-cli-folder-trust-bypass-rce/ Sat, 18 Jul 2026 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2026-07-18-grok-cli-folder-trust-bypass-rce/ https://blog.1sec.day/posts/2026-07-16-grok-build-cli-claude-code-bypass-permissions-rce/ Thu, 16 Jul 2026 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2026-07-16-grok-build-cli-claude-code-bypass-permissions-rce/ https://blog.1sec.day/posts/2026-07-16-grok-cli-cargo-check-rce/ Thu, 16 Jul 2026 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2026-07-16-grok-cli-cargo-check-rce/ https://blog.1sec.day/posts/2026-07-15-grok-cli-codebase-exfiltration/ Wed, 15 Jul 2026 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2026-07-15-grok-cli-codebase-exfiltration/ https://blog.1sec.day/posts/2017-05-15-cve-2017-9841-phpunit-rce/ Mon, 15 May 2017 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2017-05-15-cve-2017-9841-phpunit-rce/ <p>PHPUnit 是 PHP 最主流的单元测试框架之一，但它的 <code>eval-stdin.php</code> 文件被设计为『通过 CLI 接受 PHP 代码』的工具——如果这个文件被意外部署到生产环境的 Web 目录下，攻击者通过简单的 POST 请求就能执行任意 PHP 代码，CVSS 9.8，无需认证。</p>