West Pharmaceutical says hackers stole data, encrypted systems
West Pharmaceutical Services disclosed that it was the target of a cyberattack that resulted in data exfiltration and sy
2026-05-14 归档
今日共收录 1527 条安全情报，包含 720 个 CVE，444 篇安全通告，以及 62 篇研究论文。
← 返回归档列表Iranian hackers targeted major South Korean electronics maker
The Iran-linked hacking group MuddyWater (a.k.a. Seedworm, Static Kitten) launched a broad cyber-espionage campaign targ
New critical Exim mailer flaw allows remote code execution
A critical vulnerability affecting certain configurations of the Exim open-source mail transfer agent could be exploited
Windows BitLocker zero-day gives access to protected drives, PoC released
A cybersecurity researcher has published proof-of-concept (PoC) exploits for two unpatched Microsoft Windows vulnerabili
Webinar tomorrow: Why security alone won't stop modern attacks
Tomorrow's webinar examines why prevention alone is no longer enough against modern cyberattacks. The session explores h
Microsoft fixes BitLocker recovery issue only for Windows 11 users
Microsoft has addressed a known issue causing some Windows 11 systems to boot into BitLocker recovery after installing t
Microsoft fixes Windows Autopatch bug installing restricted drivers
Microsoft has fixed a Windows Autopatch bug that caused driver updates restricted by administrative policies to be deplo
Foxconn confirms cyberattack claimed by Nitrogen ransomware gang
Foxconn, the world's largest electronics manufacturer, says some of its North American factories are now working to resu
73 Seconds to Breach, 24 Hours to Patch: The Case for Autonomous Validation
Attackers can compromise systems in minutes while patching and response still take hours or days. Picus Security breaks
Microsoft says some users can't install Office on Windows 365 devices
Microsoft says some customers are experiencing issues downloading and installing Office on their Windows 365 devices. [.
[Webinar] How Modern Attack Paths Cross Code, Pipelines, and Cloud
TL;DR: Stop chasing thousands of "toast" alerts. Join experts from Wiz to learn how hackers connect tiny flaws to build
Foxconn Confirms North American Factories Hit by Cyberattack
The Nitrogen ransomware group claims to have hacked the company’s systems, stealing 8TB of data, including confidential
Sweet Security Launches Agentic AI Red Teaming to Counter ‘Mythos Moment’
New “Sweet Attack” platform uses runtime intelligence and continuous agentic red teaming to identify exploitable attack
Identifying AI Web Scrapers Using Canary Tokens
本论文提出一种新方法，通过部署动态网站并嵌入唯一诱饵令牌（canary tokens）来识别与大型语言模型（LLM）训练或查询相关的网络爬虫。网站为每个访问的爬虫分配一个独特令牌，随后研究人员向LLM提问关于网站内容的问题，若LLM输出中包
Model-Agnostic Lifelong LLM Safety via Externalized Attack-Defense Co-Evolution
大型语言模型（LLM）易受对抗性提示攻击，现有安全方法通常将红队测试与后训练耦合在封闭的策略循环中，导致攻击发现快速饱和，难以暴露新的失效模式，且防御效率低、僵化、难以跨模型迁移。为此，本文提出 EvoSafety，一种模型无关的终身 LL
No Attack Required: Semantic Fuzzing for Specification Violations in Agent Skills
LLM驱动的智能体在执行日常用户请求时，可能会无声地删除文档、泄露凭证或转移资金，这并非因为智能体受到攻击，而是因为所调用的技能违反了其自身声明的安全规则。论文将此类问题定义为“规范违反”（specification violation）：
Do Skill Descriptions Tell the Truth? Detecting Undisclosed Security Behaviors in Code-Backed LLM Skills
该论文研究大型语言模型（LLM）生态系统中以代码实现的技能（programmatic skills）的描述与实现不一致性问题。这类技能通常包含自然语言描述和可执行代码文件，用户或LLM依赖描述来理解其功能范围，但实现代码可能执行描述中未声明
Quantifying LLM Safety Degradation Under Repeated Attacks Using Survival Analysis
该论文提出了一种基于生存分析来量化大型语言模型（LLM）在重复攻击下安全性退化程度的新框架。现有的 LLM 越狱评估通常仅报告二元的成功/失败指标，无法捕捉在持续对抗压力下攻击如何随时间成功的动态过程。本文借鉴医学和可靠性工程中的生存分析方
Persona-Model Collapse in Emergent Misalignment
该论文研究了大型语言模型（LLM）在微调过程中出现的“新兴不对齐”（emergent misalignment）现象，即当模型在包含有害内容的狭窄数据上进行微调后，会在无关提示上产生广泛的不对齐行为。作者提出这一现象涉及“人格模型崩溃”（p
REALISTA: Realistic Latent Adversarial Attacks that Elicit LLM Hallucinations
本文针对大型语言模型（LLM）中的幻觉现象，提出了一种新颖的对抗性攻击框架REALISTA。幻觉是指模型生成看似合理但实际错误的内容，严重影响LLM的可靠性和安全性。现有攻击方法存在局限性：基于离散提示的攻击（如人工改写）搜索空间有限，而连