Home 資訊安全訊息 【電算中心】2026年8月資安與防詐電子報：防範釣魚、強化網站與AI安全[Computer Center] August 2026 Cybersecurity & Anti-Fraud Newsletter: Phishing Prevention, Website & AI Security

【電算中心】2026年8月資安與防詐電子報：防範釣魚、強化網站與AI安全[Computer Center] August 2026 Cybersecurity & Anti-Fraud Newsletter: Phishing Prevention, Website & AI Security

資訊安全訊息

1. 【釣魚防範】小心公務機關郵件！官方網域也可能遭利用發送釣魚信

  • 摘要：國家資通安全研究院發現，部分公務機關網站的「文章轉寄／分享」功能遭濫用，攻擊者可在留言中放入偽冒催繳、罰款等訊息及釣魚連結，再透過公務機關官方網域寄出，增加郵件的可信度。
  • 建議行動：收到公務機關、學校或其他重要單位的通知時，不要只因寄件者使用官方網域就直接信任。若涉及催繳、罰款、帳號異常或要求登入、付款，請勿直接點擊信件連結，建議改由官方網站或既有服務入口查證。
  • 參考連結： 國家資通安全研究院｜資安週報－第56期

2. 【網站安全】WordPress 近期連續發布安全更新，網站管理人員請儘速確認版本

  • 摘要：WordPress 近期接連發布 7.0.3、7.0.4 安全更新，修補多項安全問題。其中 7.0.4 修補可能導致遠端程式碼執行的漏洞。由於校內網站若使用 WordPress，外掛、佈景主題及核心版本若長期未更新，可能成為攻擊者入侵的入口。
  • 建議行動：網站管理人員請確認 WordPress 核心、外掛及佈景主題是否為最新版本，並定期檢查是否有安全更新。若網站由廠商維護，也應確認廠商已完成相關修補。
  • 參考連結： WordPress 官方｜WordPress 7.0.4 Security Release

3. 【AI 資安】駭客開始利用 AI Agent 協助攻擊，資安威脅更快速

  • 摘要：數位發展部指出，近期發現境外駭客針對政府機關發動攻擊，並出現結合 AI Agent 協助攻擊的情況。AI 可協助攻擊者快速進行資訊蒐集、弱點分析及多階段攻擊，使攻擊速度與規模增加。
  • 建議行動：使用 AI 工具處理公務時，仍應遵守資料安全規範，避免將學生個資、未公開研究資料、機密文件、帳號密碼等敏感資訊直接輸入不明或未經核准的 AI 服務。
  • 參考連結： 數位發展部資通安全署｜境外駭客發動 AI Agent 攻擊政府機關

4. 【系統更新】微軟 8 月安全更新修補 419 個漏洞，請確認電腦是否完成更新

  • 摘要：國家資通安全研究院轉知微軟 8 月安全性更新，共修補 419 個漏洞，其中包含 61 個高風險漏洞及 1 個已遭利用的漏洞。未更新的 Windows、Microsoft 365 及其他微軟產品可能面臨攻擊風險。
  • 建議行動：請教職員定期確認 Windows Update 及 Microsoft 365 是否完成更新。若電腦收到重新啟動或安裝更新的通知，請儘速完成更新，不要長時間延後。
  • 參考連結： 國家資通安全研究院｜微軟釋出115年8月份安全性更新

5. 【網站防護】網站漏洞仍是常見攻擊入口，校內網站應落實更新與權限控管

  • 摘要：國家資通安全研究院最新資安週報指出，公務機關對外網站的「元件高風險漏洞」仍是主要資安風險之一，同時也發現網站檔案管理及權限控管不足，可能造成網站內容遭竄改或敏感檔案被讀取。
  • 建議行動：校內網站管理人員應定期更新網站核心、外掛及第三方元件，並確認網站管理功能只有授權人員可以使用。若網站委由廠商維護，也應要求定期進行漏洞修補與安全檢查。
  • 參考連結： 國家資通安全研究院｜資安週報－第59期

1. [Phishing Prevention] Beware of Official Emails! Government Domains Can Also Be Abused for Phishing

  • Summary: Taiwan’s National Institute of Cyber Security (NICS) found that the “article forwarding/sharing” functions on some government websites were abused. Attackers could insert fake payment, fine, or phishing messages and send emails through official government domains, making scams appear more trustworthy.
  • Action: Do not trust an email simply because it comes from an official domain. If a message asks you to pay, log in, provide personal information, or resolve an account issue, do not click its links. Instead, access the official website or service through a trusted entry point to verify the request.
  • Reference: NICS | Cybersecurity Weekly Report No. 56

2. [Website Security] WordPress Releases Security Updates — Website Administrators Should Check Their Versions

  • Summary: WordPress recently released security updates 7.0.3 and 7.0.4 to address multiple security issues. Version 7.0.4 fixes a vulnerability that could potentially lead to remote code execution. Outdated WordPress core, plugins, or themes may become entry points for attackers.
  • Action: Website administrators should ensure that WordPress core, plugins, and themes are up to date. If the website is maintained by a vendor, confirm that security patches have been applied.
  • Reference: WordPress | WordPress 7.0.4 Security Release

3. [AI Security] Hackers Are Using AI Agents to Assist Cyberattacks

  • Summary: Taiwan’s Ministry of Digital Affairs reported that overseas attackers have targeted government agencies and begun using AI agents to assist cyberattacks. AI can help attackers quickly conduct reconnaissance, vulnerability analysis, and multi-stage attacks.
  • Action: When using AI tools for work, avoid entering student personal data, unpublished research, confidential documents, passwords, or other sensitive information into unapproved AI services.
  • Reference: MODA | Overseas Hackers Use AI Agents in Attacks Against Government Agencies

4. [System Updates] Microsoft August Security Updates Fix 419 Vulnerabilities

  • Summary: NICS reported that Microsoft’s August security updates fixed 419 vulnerabilities, including 61 high-risk vulnerabilities and one vulnerability already exploited in attacks. Unpatched Windows, Microsoft 365, and other Microsoft products may be exposed to cyber threats.
  • Action: Staff should regularly check that Windows Update and Microsoft 365 are fully updated. If your computer prompts you to install updates or restart, complete the update as soon as possible.
  • Reference: NICS | Microsoft August 2026 Security Updates

5. [Website Protection] Website Vulnerabilities Remain a Common Attack Entry Point

  • Summary: NICS reported that high-risk vulnerabilities in components used by public-facing government websites remain a major security concern. Poor file management and access controls may also allow websites to be modified or sensitive files to be accessed.
  • Action: Website administrators should regularly update website components, plugins, and third-party software, and ensure that administrative functions are limited to authorized users. Vendor-maintained websites should also undergo regular security updates and checks.
  • Reference: NICS | Cybersecurity Weekly Report No. 59

Comments are closed.