Inside Google Cloud
Inside Google Cloud
2026-05-30 归档
今日共收录 1277 条安全情报，包含 517 个 CVE，386 篇安全通告，以及 105 篇研究论文。
← 返回归档列表Google Cloud Next & Events
Google Cloud Next & Events
Google Cloud Consulting
Google Cloud Consulting
Transform with Google Cloud
Transform with Google Cloud
Threat IntelligenceNorth Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain AttackBy Google Threat Intelligence Group • 16-minute read
Threat IntelligenceNorth Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain AttackBy Goo
Google Cloud Products
Google Cloud Products
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike FalconID Brings Phishing-Resistant MFA to Falcon Next-Gen Identity Security
CrowdStrike FalconID Brings Phishing-Resistant MFA to Falcon Next-Gen Identity Security
CrowdStrike Named a Leader in Identity Threat Detection and Response
CrowdStrike Named a Leader in Identity Threat Detection and Response
Typosquatted npm packages used to steal cloud and CI/CD secrets
The Mini Shai-Hulud campaign used malicious npm packages to target cloud and CI/CD credentials across developer environm
Secure Transformer Inference Made Non-interactive.
随着ChatGPT等大型语言模型的兴起，安全Transformer推理成为一个重要研究方向。现有的安全推理方案大多采用交互式协议，客户端与服务器之间需要多轮通信，导致通信负载和延迟较高。本文提出了NEXUS，这是首个非交互式安全Transf
Hitchhiking Vaccine: Enhancing Botnet Remediation With Remote Code Deployment Reuse.
该论文提出了一种新型僵尸网络清除方法，核心思路是劫持恶意软件自身的更新机制，通过远程代码部署复用来分发修复载荷，从而在感染设备上隐蔽且及时地移除前端僵尸程序。与传统的DNS沉洞或C&C基础设施查封相比，该方法无需数月准备，且能绕过攻击者恢复
Misdirection of Trust: Demystifying the Abuse of Dedicated URL Shortening Service.
本文系统性地研究了专用URL缩短服务（DUSS）被滥用的“误导攻击”（Misdirection Attack）问题。DUSS广泛应用于大型企业，用于将受信任的长URL转换为短链接以优化用户体验，尤其是移动端。然而，攻击者可利用DUSS将其恶
BARBIE: Robust Backdoor Detection Based on Latent Separability.
本文提出了一种名为BARBIE的鲁棒后门检测方法，旨在解决深度学习模型共享中的安全风险。后门攻击会使模型在正常样本上表现正常，但在含有特定触发器的样本上产生恶意行为。现有检测方法利用良性模型与后门模型在潜在表示上的可分离性（latent s
RadSee: See Your Handwriting Through Walls Using FMCW Radar.
本文提出并实现了一种名为 RadSee 的 6 GHz 调频连续波 (FMCW) 雷达系统，能够穿透墙体检测人的手写笔迹。与现有的基于射频的人体活动识别研究不同，手写笔迹幅度极小（毫米级），且需穿透墙壁，因此极具挑战性。RadSee 采用软
stigmem-node: Auth-disabled deployments may grant broad anonymous access outside loopback
### Impact Stigmem nodes configured with authentication disabled could grant the anonymous identity broad read/write/fed
CAPM3 vulnerable to Cross-Namespace resource access
## Summary CAPM3 is Metal3's Cluster API (CAPI) provider for baremetal provisioning in Kubernetes. Multiple cross-names
无人机开源飞控 PX4-Autopilot堆栈溢出漏洞 CVE-2025-15150
CVE-2025-15150
无人机开源飞控 PX4-Autopilot堆栈溢出漏洞 CVE-2025-15150