SAP on Google Cloud
SAP on Google Cloud
2026-05-12 归档
今日共收录 1165 条安全情报，包含 386 个 CVE，425 篇安全通告，以及 70 篇研究论文。
← 返回归档列表Inside Google Cloud
Inside Google Cloud
Google Cloud Next & Events
Google Cloud Next & Events
Google Cloud Consulting
Google Cloud Consulting
Transform with Google Cloud
Transform with Google Cloud
Threat IntelligenceNorth Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain AttackBy Google Threat Intelligence Group • 16-minute read
Threat IntelligenceNorth Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain AttackBy Goo
Threat IntelligenceRansomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat LandscapeBy Google Threat Intelligence Group • 53-minute read
Threat IntelligenceRansomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat LandscapeBy Googl
Google Cloud Products
Google Cloud Products
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike FalconID Brings Phishing-Resistant MFA to Falcon Next-Gen Identity Security
CrowdStrike FalconID Brings Phishing-Resistant MFA to Falcon Next-Gen Identity Security
Why we use CAPTCHAs, (Mon, May 11th)
A few months ago, I implemented Cloudflare&#;x26;#;39;s Turnstile CAPTCHA on some pages. The reason for implementing the
Splitting the Difference on Adversarial Training.
本文提出了一种新颖的对抗训练方法，称为“分裂差异”（Splitting the Difference）。标准的对抗训练通常在提升模型鲁棒性的同时牺牲自然准确率，且试图为每个类别学习一个统一的决策边界来同时覆盖干净样本和对抗样本。作者反其道而
Reining in the Web's Inconsistencies with Site Policy.
该论文针对现代 Web 应用中因浏览器与服务器之间对相同安全策略（如 Cookie 作用域、CSP、同源策略等）理解不一致而导致的安全漏洞问题，提出了一种称为“站点策略（Site Policy）”的防御机制。核心思路是由网站服务器在 HTT
"I Don't Know If We're Doing Good. I Don't Know If We're Doing Bad": Investigating How Practitioners Scope, Motivate, and Conduct Privacy Work When Developing AI Products.
该论文通过半结构化访谈和调查等方法，深入探究了AI产品开发中从业者如何界定隐私工作的范围、驱动动机以及实际操作方式。研究发现，从业者在隐私工作中面临显著的不确定性（例如，对合规性要求理解模糊、缺乏统一实践指南），且动机往往混合了合规压力、道
OPTIKS: An Optimized Key Transparency System.
该论文提出OPTIKS，一种优化的密钥透明度系统，旨在解决现有系统（如CONIKS）中存在的信任模型弱点和效率问题。OPTIKS引入了一种新的数据结构——密钥历史树（Key History Tree），结合聚合节点（Aggregator N
A Friend's Eye is A Good Mirror: Synthesizing MCU Peripheral Models from Peripheral Drivers.
该论文针对微控制器（MCU）外设建模困难的问题，提出了一种从现有外设驱动程序中自动合成外设模型的方法。核心思想是利用驱动程序对外设寄存器的读写操作序列作为“镜像”，通过分析驱动代码中的寄存器访问模式，逆向推导出外设的行为规范，并生成可用于仿
Hunting the Haunter - Efficient Relational Symbolic Execution for Spectre with Haunted RelSE.
本文针对Spectre微架构安全漏洞的检测问题，提出了一种名为Haunted RelSE的高效关系符号执行优化方法。Spectre漏洞自2018年公开以来，允许攻击者通过利用处理器的推测执行机制窃取秘密信息，其检测对加密库尤为重要。现有软件
Emilia: Catching Iago in Legacy Code.
这篇论文研究了在可信执行环境（如Intel SGX）中安全运行遗留代码时面临的Iago攻击威胁。Iago攻击是指恶意操作系统通过控制系统调用的返回值来欺骗应用程序，但在TEE中，由于假设操作系统不可信，这种攻击的威胁更加突出。作者通过分析发