GM agrees to $12.75M California settlement over sale of drivers’ data
California Attorney General Rob Bonta announced a proposed $12.75 million settlement agreement with General Motors (GM)
2026-05-12 归档
今日共收录 1165 条安全情报，包含 386 个 CVE，425 篇安全通告，以及 70 篇研究论文。
← 返回归档列表Official CheckMarx Jenkins package compromised with infostealer
Checkmarx warned over the weekend that a rogue version of its Jenkins Application Security Testing (AST) plugin had been
New GhostLock tool abuses Windows API to block file access
A security researcher has released a proof-of-concept tool named GhostLock that demonstrates how a legitimate Windows fi
Instructure confirms hackers used Canvas flaw to deface portals
Education technology giant Instructure has confirmed that a security vulnerability allowed hackers to modify Canvas logi
Why Changing Passwords Doesn’t End an Active Directory Breach
Resetting a password doesn't always remove attackers from Active Directory. Specops Software explains how cached credent
Google: Hackers used AI to develop zero-day exploit for web admin tool
Researchers at Google Threat Intelligence Group (GTIG) say that a zero-day exploit targeting a popular open-source web a
Webinar this week: Prevention alone is not enough against modern attacks
This upcoming webinar explores how organizations need to combine security, backups, and recovery planning to reduce the
TrickMo Android banker adopts TON blockchain for covert comms
A new variant of the TrickMo Android banking malware, delivered in campaigns targeting users across Europe, introduces n
TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks After KICS Supply Chain Attack
Checkmarx has confirmed that a modified version of the Jenkins AST plugin was published to the Jenkins Marketplace. "If
⚡ Weekly Recap: Linux Rootkit, macOS Crypto Stealer, WebSocket Skimmers and More
Rough Monday. Somebody poisoned a trusted download again, somebody else turned cloud servers into public housing, and a
Cloudflare Lays Off 1,100 Employees in AI-Driven Restructuring
The company topped revenue and earnings forecasts for the first quarter of 2026, but its shares plunged more than 20%. T
Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack
A malicious version of the plugin was published to the Jenkins Marketplace late last week. The post Checkmarx Jenkins AS
LITMUS: Benchmarking Behavioral Jailbreaks of LLM Agents in Real OS Environments
LITMUS 是一个针对基于 LLM 的自主智能体在真实操作系统环境中的行为安全性的基准测试平台。现有基准大多仅在语义层评估安全性，忽略了物理层的危害，并且测试用例之间缺乏隔离，导致污染问题。LITMUS 通过语义-物理双重验证机制和 OS
Usability as a Weapon: Attacking the Safety of LLM-Based Code Generation via Usability Requirements
该论文研究了大型语言模型（LLM）在代码生成场景下，可用性需求如何被用作攻击面，从而破坏安全编码实践。作者提出了一种名为UPAttack的新型威胁，并设计了自动化框架U-SPLOIT。其核心思想是：现实中的可用性需求（如添加新特性、满足性能
From Controlled to the Wild: Evaluation of Pentesting Agents for the Real-World
本文主要研究AI渗透测试代理在真实世界场景下的评估问题。当前学术界和工业界通常使用简化的基准（如CTF挑战、远程代码执行、漏洞复现或轨迹相似度）来评估这些代理的能力。然而，这些方法无法充分反映真实渗透测试中面临的复杂环境、开放性探索和战略决
LLMs for Secure Hardware Design and Related Problems: Opportunities and Challenges
这篇综述论文系统分析了大型语言模型（LLMs）在电子设计自动化（EDA）和硬件安全领域的应用机遇与挑战。随着半导体行业快速发展，LLMs在生成寄存器传输级（RTL）代码、自动化测试台以及弥合高层规范与硅实现之间的语义鸿沟方面展现出前所未有的
Can You Keep a Secret? Involuntary Information Leakage in Language Model Writing
该论文研究了前沿语言模型在写作任务中是否能够保守秘密。作者给每个模型一个秘密词，要求模型在写故事时不要泄露该词，然后使用另一个模型通过二分类测试来判断故事是否包含该秘密。尽管秘密词从未以字面形式出现在输出中，但所有五个测试的前沿模型都以显著
MATRA: Modeling the Attack Surface of Agentic AI Systems -- OpenClaw Case Study
随着大型语言模型（LLM）被部署为具备访问工具、数据库和外部服务能力的自主智能体（Agent），不同行业从业者缺乏系统的方法来评估已知威胁类别如何在特定智能体部署中转化为具体风险。本文提出MATRA，一个针对智能体AI系统的实用威胁建模框架
AutoSOUP: Safety-Oriented Unit Proof Generation for Component-level Memory-Safety Verification
内存安全错误是低级软件中零日漏洞的持续根源，尤其在嵌入式系统中，硬件保护有限且动态分析难以有效应用。内存安全验证可以通过证明不存在此类错误或暴露违规来提供更强保证，但当前验证工作流主要依赖手动操作，需要大量专业知识，限制了实际采用。本文提出
Re-Triggering Safeguards within LLMs for Jailbreak Detection
该论文提出了一种针对大型语言模型（LLM）的越狱提示检测方法，旨在防御越狱攻击。尽管当前LLM已内置安全机制，但攻击者仍可能构造绕过这些机制的越狱提示。作者认为此类越狱提示本质上具有脆弱性，因此引入了一种嵌入扰动（embedding dis