CrowdStrike FalconID Brings Phishing-Resistant MFA to Falcon Next-Gen Identity Security
CrowdStrike FalconID Brings Phishing-Resistant MFA to Falcon Next-Gen Identity Security
2026-05-15 归档
今日共收录 1277 条安全情报，包含 487 个 CVE，424 篇安全通告，以及 55 篇研究论文。
← 返回归档列表Defense in depth for autonomous AI agents
As AI agents gain autonomy, defense in depth must evolve, with application-layer design, identity, and human oversight a
Kazuar: Anatomy of a nation-state botnet
Kazuar, a sophisticated malware family attributed to the Russian state actor Secret Blizzard, has been under constant de
When configuration becomes a vulnerability: Exploitable misconfigurations in AI apps
Exposed UIs, weak authentication, and risky defaults could turn cloud-native AI apps on Kubernetes into potential target
OpenAI confirms security breach in TanStack supply chain attack
OpenAI says two employees' devices were breached in the recent TanStack supply chain attack that impacted hundreds of np
Cyber-Enabled Cargo Crime: How Cybercrime Tradecraft is Used to Steal Freight
Cargo theft now starts with phishing emails and stolen credentials, not hijackings, to reroute and steal freight from su
The Gates of Time: Improving Cache Attacks with Transient Execution.
该论文针对瞬态执行（如 Spectre 变体）与缓存侧信道攻击的结合展开研究。作者提出一种称为“The Gates of Time”的方法，利用瞬态执行指令来精确操控缓存状态，从而显著提升传统缓存攻击（如 Prime+Probe 和 Evi
QNBAD: Quantum Noise-induced Backdoor Attacks against Zero Noise Extrapolation.
该论文提出了一种名为QNBAD（量子噪声诱导后门攻击）的新型攻击方法，针对量子机器学习（QML）中的零噪声外推（ZNE）防御。ZNE是当前量子计算中广泛使用的错误缓解技术，旨在通过外推拟合和处理噪声，提高量子计算的可靠性。QNBAD利用量子
Work-From-Home and COVID-19: Trajectories of Endpoint Security Management in a Security Operations Center.
该论文研究了COVID-19疫情背景下远程办公（Work-From-Home, WFH）对安全运营中心（SOC）端点安全管理的影响。研究采用轨迹分析方法，追踪了疫情期间SOC在人员配置、技术工具、流程策略等方面的演变。作者通过访谈和案例研究
Rounding-Guided Backdoor Injection in Deep Learning Model Quantization.
该论文提出了一种名为QuRA的新型后门攻击方法，利用深度学习模型量化过程中的舍入操作来注入恶意行为。与传统的依赖训练数据投毒或模型训练操纵的后门攻击不同，QuRA仅通过量化操作即可实现攻击。具体地，QuRA首先采用一种新颖的权重选择策略，识
PGUS: Pretty Good User Security for Thick MVNOs with a Novel Sanitizable Blind Signature.
本文针对厚移动虚拟网络运营商（Thick MVNO）在5G环境下面临的安全与隐私挑战，提出了一种名为PGUS（Pretty Good User Security）的安全框架。该框架的核心创新是引入了一种新的密码学原语——可净化盲签名（San
Decentralization of Ethereum's Builder Market.
以太坊的构建者市场（builder market）在合并后成为区块生产的关键环节，但当前呈现出高度中心化的趋势：少数几个构建者主导了大部分区块的构建。这种中心化可能带来审查风险、单点故障以及对网络公平性的威胁。本文首先通过实证数据分析中心化
Janus: Enabling Expressive and Efficient ACLs in High-speed RDMA Clouds.
针对高速RDMA云环境下缺乏灵活且高效的访问控制列表（ACL）机制的问题，本文提出Janus系统。RDMA网络虽然性能极高，但现有安全方案（如基于软件的ACL或静态规则）无法同时满足表达能力和线速转发。Janus通过设计一种新的流规则表达语
无人机开源飞控 PX4-Autopilot堆栈溢出漏洞 CVE-2025-15150
CVE-2025-15150
无人机开源飞控 PX4-Autopilot堆栈溢出漏洞 CVE-2025-15150
MongoDB内存泄漏 CVE-2025-14847(MongoBleed)
CVE-2025-14847
MongoDB内存泄漏 CVE-2025-14847(MongoBleed)
1Panel 代理证书验证绕过导致任意命令执行漏洞(CVE-2025-54424)
CVE-2025-54424
1Panel 代理证书验证绕过导致任意命令执行漏洞(CVE-2025-54424)
ModelContext Inspector 未授权访问漏洞(CVE-2025-49596)
CVE-2025-49596
ModelContext Inspector 未授权访问漏洞(CVE-2025-49596)
llamaindex SQL 注入漏洞(CVE-2025-1750)
CVE-2025-1750
llamaindex SQL 注入漏洞(CVE-2025-1750)
Screen 本地权限提升漏洞(CVE-2025-23395)
CVE-2025-23395
Screen 本地权限提升漏洞(CVE-2025-23395)
Zabbix认证后SQL注入漏洞(CVE-2024-42327)
CVE-2024-42327
Zabbix认证后SQL注入漏洞(CVE-2024-42327)