2026年10月24日 技术热点总结

项目简介：Offline FairPlay App Store IPA decryption with independent key derivation

技术栈：C

核心介绍：Decrypt FairPlay-encrypted apps using a 16-byte credential for the account that owns each IPA. Credential retrieval gets it from a supported jailbroken device and writes credential.bin to the chosen output directory. Decryption runs on macOS and Linux. Supports version-3 and version-5 SUPF, 448-byte and 440-byte SINF priv records, and encrypted arm64 Mach-O slices. A 440-byte record must end in From this directory, with Python 3.9+ and a C compiler: python3 -m venv .venv

项目数据：⭐ 1,560…

项目简介：A php2shell exploit that requires no modifications to the official version, and does not require display_errors or limit_memory.

技术栈：Python

核心介绍：中文 | English | 日本語 PHP 的约束下，一条命令拿到 RCE： 理论上只要你计算出所有php版本的偏移，然后利用这些偏移批量去fuzz，总有一条fuzz是能rce的。反正worker崩了也会重启，不怕目标打挂。 关于 worker：官方 prefork 的 MaxRequestWorkers=150 也已打通。脚本先占住 149 个 worker 的未完成请求，再把 A1/B1/A2/B2 固定到剩下的同一个 child；单 worker 只是早期的调试形态（–workers 1 仍可复现）。 git clone https://github.com/9bie/php2shell-bypass-aslr-exp.git cd php2shell-bypass-aslr-exp python3 exploit.py –port 18110 不编译 PHP/Apache、不 build 镜像、不挂 gdb、不改目标 ini。 pure/r…

技术栈：JavaScript

核心介绍：Get a version-based PHP2Shell warning from a website’s PHP headers or local installation. To install both skills, ask Codex: $skill-installer install both skills from https://github.com/openai/php2shell-checker Use phpcheck-server when you have server access, or phpcheck-url when you only have a URL: $phpcheck-url check https://example.com $phpcheck-server check the PHP version serving my site node phpcheck.js “https://example.com” Use –json for machine-readable output. patch_status is ok,

项目数据：⭐ 1,163 Stars，🍴 115 Forks

技术栈：C

核心介绍：hardware and runs the unmodified iOS 16.5 user space on top of it: launchd → backboardd → SpringBoard → apps. Our own EFI loader, our own replacements for Apple’s closed drivers, a UEFI port, and a Linux Wi-Fi driver on a compatibility layer make that possible. It runs in two places: the whole system lives in RAM, and after a reboot the phone is back in Android; This repository is half of the project:

项目数据：⭐ 1,081 Stars，🍴 186 Forks

Recursive self-improvement (RSI) relies on evaluation feedback to assess progress and guide further research, yet repeatedly running complex benchmarks is costly and slows iteration. Human experts reduce this cost by selecting benchmark subsets or designing compact suites. We ask whether AI agents can automate this design process and introduce EvalResearchBench (ERB), a benchmark for autonomous evaluation research. Given target materials, development references, candidate APIs, and fixed time and API budgets, an agent called the researcher selects or synthesizes tasks, implements graders, a…

Diffusion language models can write several tokens in one forward pass, and they decide during generation how many passes to spend. Two outputs of the same token length can therefore vary a lot in cost. To understand the underlying factors of this cost variation, we analyze two diffusion models across 10 tasks. We find that the number of forward passes per token depends heavily on the task. Text copied or lightly edited from the input is cheap, while open-ended writing is costly. In DiffusionGemma, generating a token for story writing requires more than three times as many forward passes as…

Diffusion Language Models (DLMs) introduce unique quantization challenges due to their iterative denoising process. In this work, we reveal that quantization sensitivity is both taskand time-dependent, with different downstream tasks exhibiting distinct precision requirements across denoising steps. We further show that these patterns can be predicted without groundtruth labels or task-specific evaluation metrics. Building on these findings, we introduce T 2Quant, a task and time-aware mixedprecision quantization framework that uses a label-free sensitivity signal to optimally allocate acti…

Effective test-time personalization requires LLM agents to adapt to query-dependent user preferences from lightweight interaction. We study persona selection with binary comparisons between candidate responses as the online signal. We present ID-TAP, a scalable, IDS-inspired neural dueling-bandit framework for large discrete persona spaces. ID-TAP combines a query-conditioned neural utility model with a lightweight Bradley-Terry explorer, and transfers comparison evidence across related queries through similarity-weighted warm starts. The neural model shares statistical strength across quer…

Improving every agent in an LLM-based multi-agent system can be prohibitively costly, making it important to identify which agent should be prioritized to achieve the greatest system-level gain with limited resources. Failure attribution can inform this decision, but an agent's responsibility for failures does not directly reveal the system-level gains achievable by improving it. We therefore introduce IF-MAP, an influence-function-inspired method for identifying agents with high potential for system-level improvement. For each agent, IF-MAP measures end-to-end loss changes under controlled…

Modern LLM agents can retrieve information from accessible documents, and then disclose a sensitive conclusion assembled from them. This mosaic effect creates a critical risk for agents operating over confidential data. We quantify its realization with 30 synthetic cybersecurity, medical, and military examples, yielding 10,800 final answers from three LLM agents in controlled simulation and 1,440 answers from live agents in two open-source harnesses. Even under benign queries designed to be answerable from one document, GPT-5.6-Sol, the best performing model tested, discloses forbidden comp…