# 安全 · 日跟踪 · 2026-10-05

> 日期：2026-10-05（Asia/Shanghai，周一）。专题正文：`intel/topics/security.md`。原料：`/workspace/intel/archive/2026-10-05/`（窗口 10-02 早报后→10-05 早；周末无 archive）；对照 2026-10-02 日跟踪。抓取：Saved 266 / skipped 29 / errors 40；blocked_hosts：blocksandfiles.com、docs.redhat.com、e.huawei.com、support.huawei.com、www.nextplatform.com、www.reddit.com、www.theregister.com。

## 摘要
- **NEW（厂商内容）· VMware Cybersecurity Awareness Month：** 10 月 **22 篇博文 + 4 场技术 webinar（10-08 / 10-15 / 10-22 / 10-29）+ 11-04 Designing Secure VCF**；Day1 观点：AI 是攻防"force multiplier"，攻击端大量用 GPU 上的开源模型；零信任/MFA/passkey/补丁等老办法依然有效——**排期≠已发布**。
- **NEW（厂商博客）· Security Starts with Hardware：** BMC/BIOS 在 hypervisor 之下即攻击面；引 **NIST SP 800-147B**；OEM 加固指南（Lenovo/Cisco/HPE iLO 6/Dell iDRAC9）；**VCF Readiness** 经 Redfish 审计（"over 50"/"55+" 审计项——厂商自称，照录）；供应链验证（Dell SCV / HPE PCVT）；TPM 2.0 + Secure Boot。
- **NEW（厂商思想领导力）· Red Hat CRA 系列 2 篇：** EU CRA **漏洞报告 2026-09-11 起、主要要求 2027-12-11 生效**；SBOM→"dependency intelligence"；Akrites（共享漏洞响应）/ Lightwell（无法升级时修复第三方 OSS）。文中「商业代码库 >84,000 文件、约 1,180 个开源组件、+30% YoY」**未注明来源，标厂商引述**。
- **轻 ·** RH Friday Five：CTO Chris Wright「securing AI agents requires securing the systems around them」。
- **续档 ·** Thales Quantum & AI（10-02 中强 NEW）；Joey security debt；Express Patching。

## 原文摘录

### VMware · Security is a Way of Thinking（厂商博客，安全月 Day 1）
- 归档：`vmware/security-is-a-way-of-thinking-78ef83aa.*`
- URL：https://blogs.vmware.com/cloud-foundation/2026/10/01/security-way-of-thinking/

> … there is no doubt that AI is a force multiplier, both for good and for evil. … it's also the open-source models, running on GPUs everywhere, that are doing the attacking.  
> Zero trust, when meaningfully implemented, seriously hinders attacks and lateral movement.  
> Register for the technical webinar series… Thursday, October 8 … October 15 … October 22 … October 29 …

### VMware · Security Starts with Hardware（厂商博客，安全月 Day 2）
- 归档：`vmware/security-starts-with-hardware-cd0b9488.*`
- URL：https://blogs.vmware.com/cloud-foundation/2026/10/02/security-starts-with-hardware/

> An unhardened BMC or misconfigured BIOS represents a backdoor that operates completely below the hypervisor. NIST publishes a general protection guideline for this found here: NIST SP 800-147B…  
> … VCF Readiness can be used to audit the posture of the BIOS settings, and BMC configuration using Redfish APIs. … over 50 built in BMC Hardware Security Audit Findings…  
> Supply Chain Verification – Allows verification that the hardware has not been tampered with. Dell's version of this is SCV, but HPE has HPE Platform Certificate Verification Tool (PCVT)…

### Red Hat · What enterprises need to know about the software they depend on / …Cyber Resilience Act…（系列 Part 1/2）
- 归档：`redhat/what-enterprises-need-to-know-about-the-software-they-depend-on-522a0b21.*`、`redhat/what-enterprises-need-to-know-about-the-cyber-resilience-act-and-softw-38fd40ed.*`

> Vulnerability reporting began September 11, 2026, with the main requirements taking effect December 11, 2027.  
> The average commercial codebase contains approximately 1,180 open source components, up 30% year over year.（**厂商引述，未注明来源**）  
> Akrites is designed to address this coordination problem by providing a shared security incident response team…

### Red Hat · Friday Five — October 2, 2026（周汇总）
- 归档：`redhat/friday-five-october-2-2026-red-hat-9fb32757.*`
- URL：https://www.redhat.com/en/blog/friday-five-october-2-2026-red-hat

> As AI agents gain authority to act on enterprise systems, model safeguards alone are not enough. Red Hat CTO Chris Wright explains how Red Hat is delivering defense in depth…