Threat IntelligenceSeeking Counsel: Ongoing Targeted Campaign Against US Law FirmsBy Mandiant • 19-minute read
Threat IntelligenceSeeking Counsel: Ongoing Targeted Campaign Against US Law FirmsBy Mandiant • 19-minute read
2026-06-06 归档
今日共收录 1443 条安全情报，包含 665 个 CVE，387 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Suspicious Polyfill login prompts pop up on Toshiba, Muji websites
Tech giant Toshiba and mega-retailer Muji warned visitors that suspicious sign-in screens popping up on their websites c
CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers
CISA warned today that hackers are now actively exploiting a recently patched high-severity SolarWinds Serv-U flaw to cr
Dark web Nemesis Market vendor gets 26 years for selling drugs
A California man was sentenced to more than 26 years in federal prison for trafficking fentanyl and methamphetamine thro
Over 900 US gas station tank gauge systems exposed to attacks
Over 900 automatic tank gauge (ATG) systems across the United States, used to monitor fuel and chemical storage tanks ac
What 2026 DBIR Confirms: Attacks Are Living in the Browser
Phishing, shadow AI, malicious extensions, and credential theft increasingly happen inside the browser. Keep Aware expla
Brave Software releases Origin for a paid, bloat-free browsing experience
Brave has announced the public release of Brave Origin, a paid minimalist version of its browser that strips out cryptoc
Credit card theft campaign abuses Stripe to host stolen payment info
A new Magecart campaign is using Stripe's API infrastructure to host the credit card-stealing payload and the data exfil
DentaQuest data breach exposed info of 2.6 million accounts
A data breach at the dental benefits administrator DentaQuest has reportedly exposed the sensitive data of 2.6 million a
IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks
Multiple software supply chain attacks have hit the npm ecosystem, with threat actors using both malicious and poisoned
PCPJack Hijacks 230 AWS, Google Cloud, and Azure Servers for Covert SMTP Relay Network
The threat actor known as PCPJack has hijacked cloud servers associated with Amazon Web Services (AWS), Google Cloud, an
In Other News: Anthropic Maps AI Threats, Unpatched Comodo Flaw, Palantir Chief Eyed for CISA
Other noteworthy stories that might have slipped under the radar: Ultrahuman data leak, The Gentlemen ransomware analysi
WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents
WebMCP 是一种新兴协议，允许网站直接将工具暴露给 AI 代理，绕过传统用户界面，从而引入新的安全风险。本文针对 WebMCP 协议提出了一种新的攻击类型——会话中工具注入（Mid-Session Tool Injection, MST
Description-Code Inconsistency in Real-world MCP Servers: Measurement, Detection, and Security Implications
本文针对大语言模型（LLM）与外部工具交互的关键协议——模型上下文协议（MCP）中的描述-代码不一致（DCI）问题进行了系统性研究。在MCP生态中，LLM依赖工具的自然语言描述来选择和执行函数，但该描述与底层代码实现之间的一致性并未得到强制
When Autoregressive Consistency Hurts Safety Alignment
本文研究了大型语言模型（LLM）安全对齐的脆弱性，提出其根本原因在于自回归一致性——即自回归模型在预测下一个token时倾向于保持并延续当前生成轨迹的特性。作者通过分析安全对齐微调的学习动态，发现对齐更新主要集中在输出序列的前几个token
From Attack Simulation to SIEM Rule: Deterministic Detection-as-Code Synthesis with Probe-Level Traceability
该论文提出了一种确定性的检测即代码合成方法，旨在将攻防模拟（Breach-and-Attack-Simulation, BAS）工具产生的发现结果自动转换为SIEM可用的检测规则。当前安全团队通常手动为每个发现编写Sigma规则（一种厂商中
An Embarrassingly Simple Detector for Model Extraction Attacks in Large Language Model API Traffic
该论文针对大型语言模型（LLM）以API形式部署时面临的模型提取攻击（Model Extraction Attacks）威胁，提出了一种异常简洁但有效的检测方法。背景上，模型提取攻击指攻击者通过向LLM API发送精心设计的查询，试图重建或
SecRL-Prune: Structured Reinforcement Learning-Based Pruning of CodeLLMs for Preserving Adversarial Code Mutation
本文提出 SecRL-Prune，一种针对代码大型语言模型（CodeLLM）的结构化剪枝框架，旨在研究在模型压缩后是否仍能保持其对抗性代码变异能力。大型代码语言模型能够生成和改写程序，实现功能保持的代码变异，这可能被用于创建多样化的恶意软件
Steering LLM Viewpoints through Fabricated Evidence Injection
本研究聚焦于大型语言模型（LLM）在对话系统中的应用，发现其存在一种关键认知脆弱性：当外部上下文包含伪造但看似可信的证据时，LLM会不加批判地信任该上下文。作者提出了名为 Ghostwriter 的两阶段攻击框架：第一阶段将误导性陈述与伪造
GenTI: Benchmarking LLMs for Autonomous IDPS Rule Generation for Unseen Attacks
论文《GenTI: Benchmarking LLMs for Autonomous IDPS Rule Generation for Unseen Attacks》由 Hassan Jalil Hadi 等人撰写，旨在解决基于规则的入侵检