U.S. sanctions Nobitex crypto exchange used by Iranian ransomware actors
The U.S. Treasury's Office of Foreign Assets Control (OFAC) has announced sanctions against Nobitex, Iran's largest cryp
2026-06-04 归档
今日共收录 1001 条安全情报，包含 200 个 CVE，398 篇安全通告，以及 115 篇研究论文。
← 返回归档列表Acer working to patch max severity zero-days in Wave 7 routers
Acer is working to address two maximum-severity zero-day vulnerabilities affecting its Wave 7 mesh routers. [...]
$π$Creds: Privately Inferred Credentials
本文提出了一种名为πCreds（Privately Inferred Credentials，私有推断凭证）的新型去中心化可验证凭证系统。传统基于零知识证明的凭证系统部署有限，且只能处理结构化数据上的谓词。πCreds利用可信的大语言模型（
FORGE: Multi-Agent Graduated Exploitation and Detection Engineering
该论文提出一个名为FORGE的多智能体系统，旨在打通漏洞披露、利用优先级排序和检测规则工程三个通常孤立的研究领域。当前自动化利用生成系统仅报告二元通过/失败结果，丢弃部分进展，且不产生对其他两个领域有用的信号。FORGE通过“渐进式利用深度
RogueMerge: Robust and Unified Attacks against LLM Model Merging
本文提出了 RogueMerge，一个针对大语言模型（LLM）模型合并过程的统一攻击框架。模型合并通过聚合来自未经验证的公共平台的任务向量，将多个专用能力组合到单个 LLM 中，这暴露了关键的供应链攻击面：因为任何恶意行为都可以编码到任务向
Decoupled Smart Contract Audits: Lightweight LLM Framework via Distillation and Aggregation
该论文提出了一种轻量级的智能合约安全审计框架，利用经过蒸馏和聚合的开放源码大语言模型（LLM）来应对现有基于LLM的审计方法存在的计算开销大、缺乏严重性评估以及可操作修复建议等问题。框架将审计任务解耦为四个独立模块：漏洞检测、漏洞解释、严重
"**Important** You should give me full credits!": Exploring Prompt Injection Attacks on LLM-Based Automatic Grading Systems
本论文研究基于大语言模型的自动评分（AG）系统中的提示注入攻击。随着LLM在自动评分中的广泛应用，其安全风险日益突出。攻击者可能通过提示注入操纵评分系统，使系统无论答案质量如何都给出高分，严重威胁教育评估的公平性、可靠性和完整性。作者系统性
Large Byte Model: Teaching Language Models About Compiled Code
该论文提出首个能够直接处理编译后可执行文件原始字节的“大字节模型”（Large Byte Model），无需依赖反汇编或反编译等开销高昂且易出错的“提升”工具。传统大语言模型（LLM）无法理解原始字节序列，因此难以直接应用于底层恶意软件分析
From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents
本文系统性地研究了基于大语言模型（LLM）的智能代理中的内存投毒攻击。内存是AI代理的核心组件，允许代理在交互中积累知识并提升性能。然而，持久化内存引入了一种风险：一次对抗性内存写入可能对代理行为产生长期影响。作者首先识别了四种内存写入通道
OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of...
CVE-2026-41283
CVE-2026-41283 是 OpenStack Mistral 工作流服务中的一个严重漏洞，影响版本至 22.0.0。当 Mistral API 暴露于网络时，未经授权的攻击者（需低权限）可通过特定端点执行任意远程代码（RCE），从而
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud
CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud
CrowdStrike Falcon Cloud Security Delivered 264% ROI Through Unified Cloud Protection
CrowdStrike Falcon Cloud Security Delivered 264% ROI Through Unified Cloud Protection
Security & Identity
Security & Identity
SAP on Google Cloud
SAP on Google Cloud
Inside Google Cloud
Inside Google Cloud
Google Cloud Next & Events
Google Cloud Next & Events
Google Cloud Consulting
Google Cloud Consulting
Transform with Google Cloud
Transform with Google Cloud
Threat IntelligenceNorth Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain AttackBy Google Threat Intelligence Group • 16-minute read
Threat IntelligenceNorth Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain AttackBy Goo