Hackers abuse Google ads for GoDaddy ManageWP login phishing
A phishing campaign delivered through Google sponsored search results is targeting credentials for ManageWP, GoDaddy's p
2026-05-07 归档
今日共收录 722 条安全情报，包含 0 个 CVE，380 篇安全通告，以及 58 篇研究论文。
← 返回归档列表Critical vm2 sandbox bug lets attackers execute code on hosts
A critical vulnerability in the popular Node.js sandboxing library vm2 allows escaping the sandbox and executing arbitra
New Cisco DoS flaw requires manual reboot to revive devices
Cisco patched a Crosswork Network Controller and Network Services Orchestrator denial-of-service vulnerability that requ
Why ransomware attacks succeed even when backups exist
Backups don't fail because they're missing, they fail because attackers destroy them first. Acronis explains how ransomw
MuddyWater hackers use Chaos ransomware as a decoy in attacks
The MuddyWater Iranian hackers disguised their operations as a Chaos ransomware attack, relying on Microsoft Teams soci
Webinar: Why network incidents escalate and how to fix response gaps
Most network incidents don't escalate due to a lack of alerts; they escalate when response breaks down. This webinar exp
MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack
The Iranian state-sponsored hacking group known as MuddyWater (aka Mango Sandstorm, Seedworm, and Static Kitten) has bee
Your AI Agents Are Already Inside the Perimeter. Do You Know What They're Doing?
Analysts recently confirmed what identity security teams have quietly feared: AI agents are being deployed faster than e
Windows Phone Link Exploited by CloudZ RAT to Steal Credentials and OTPs
Cybersecurity researchers have disclosed details of an intrusion that involved the use of a CloudZ remote access tool (R
Government, Scientific Entities Hit via Daemon Tools Supply Chain Attack
While trojanized Daemon Tools versions were installed worldwide, a sophisticated backdoor was dropped only on a dozen sy
AFL-ICP: Enhancing Industrial Control Protocol Reliability via Specification-Guided Fuzzing
工业控制协议（ICP）对于工业基础设施的可靠性和稳定性至关重要，但其安全性受到规范盲点（specification-blindness）瓶颈的根本性影响。现代模糊测试工具受限于基于观测的推理，难以深入协议状态或检测微妙的语义偏差。本文提出了
SoK: Robustness in Large Language Models against Jailbreak Attacks
本文是一篇系统化知识综述（SoK），聚焦于大语言模型（LLM）针对越狱攻击的鲁棒性问题。越狱攻击通过精心构造的对抗提示，诱使模型生成有害、不道德或违反政策的输出，对高安全性应用中的信任、合规和安全构成实际威胁。现有评估实践通常仅依赖攻击成功
AgentTrust: Runtime Safety Evaluation and Interception for AI Agent Tool Use
现代AI代理通过工具调用（如文件操作、shell命令、HTTP请求和数据库查询）执行实际影响。单个不安全操作（如意外删除、凭证泄露或数据外泄）可能导致不可逆的损害。现有防御措施不完整：事后基准在执行后测量行为，静态护栏遗漏混淆和多步上下文，
Pen-Strategist: A Reasoning Framework for Penetration Testing Strategy Formation and Analysis
本文提出 Pen-Strategist 框架，旨在解决现有基于 LLM 的自动化渗透测试框架在策略制定、领域推理和工具选择方面的局限性。该框架由两个核心组件组成：一个领域特定的推理模型和一个基于语义的 CNN 分类器。推理模型通过逻辑推理推
An Evaluation of Chat Safety Moderations in Roblox
该研究对 Roblox 平台的聊天安全审核系统进行了首次独立评估。Roblox 拥有数亿每日活跃用户，其中大量为未成年人，这使其成为恶意用户通过实时聊天接触潜在受害者的高风险环境。研究者从四个不同年龄分组的公开游戏服务器中，遵循伦理、法律规
SWAN: Semantic Watermarking with Abstract Meaning Representation
SWAN（语义水印与抽象语义表示）是一种新颖的文本水印框架，它利用抽象语义表示（AMR）将水印签名直接嵌入句子的语义结构中。与现有方法在文本生成过程中通过调整令牌选择偏好来编码签名不同，SWAN将签名编码在语义表示层面，因此任何保留语义的释
Towards a Zero-Trust Supply-Chain Assurance Rubric for ORAN RIC Applications
本文提出了一种面向开放无线接入网（Open RAN）无线智能控制器（RIC）应用的零信任供应链保证评分标准（rubric）。Open RAN允许第三方xApps和rApps以运营节奏进行上线和更新，形成了跨越开发者、持续集成系统、注册表、上
Generating Proof-of-Vulnerability Tests to Help Enhance the Security of Complex Software
该论文针对现代软件开发中广泛使用第三方库（Lib）所带来的供应链安全风险问题，提出了一种名为PoVSmith的新方法，用于自动生成可执行的漏洞验证测试（PoV tests）。当前开发者通常需要具体的、可执行的证据来判断一个依赖漏洞是否对其应
网络安全信息与动态周报-2026年第12期
2026年第12期CNCERT网络安全信息与动态周报于2026年5月7日发布。该周报由国家计算机网络应急技术处理协调中心（CNCERT）编制，通常涵盖近期国内外网络安全动态、漏洞预警、恶意程序传播、网络攻击事件以及安全建议等内容。由于本期周
imageproc: integer overflow in kernel size check leads to out-of-bounds read
A bounds verification of a slice storage of a 2-dimensional matrix's coefficients (a kernel) would compare the total siz