Stable Channel Update for ChromeOS / ChromeOS Flex
The ChromeOS Stable channel is being updated to OS version 16667.47.0 (Browser version 149.0.7827.153) for most ChromeOS
2026-06-19 归档
今日共收录 997 条安全情报，包含 210 个 CVE，375 篇安全通告，以及 115 篇研究论文。
← 返回归档列表Beta Channel Update for ChromeOS / ChromeOS Flex
The Beta channel is being updated to OS version 16700.20.0 (Browser version 150.0.7871.32) for most ChromeOS devices.If
Chrome Dev for Android Update
Hi everyone! We've just released Chrome Dev 151 (151.0.7896.3) for Android. It's now available on Google Play.You can se
A Layered Security Framework Against Prompt Injection in RAG-Based Chatbots
该论文提出一种针对基于检索增强生成（RAG）聊天机器人的提示注入攻击的分层安全框架。提示注入被OWASP LLM应用Top 10列为最关键的漏洞，但现有防御措施仅作用于孤立阶段，例如输入过滤器无法检查检索到的文档，输出监控器无法阻止恶意载荷
AutoTam: Specifying Secure Protocol Implementations with Tamarin Model Generation
形式化验证对于保证密码协议的安全性至关重要，但传统验证流程门槛高、与具体实现脱节。本文提出一种新颖的“语言优先”方法：设计一种领域特定语言（DSL）用于描述协议实现，并自动将其转换为 Tamarin 证明器可接受的模型，从而验证通用迹属性（
Heterogeneous LLM Debate Under Adversarial Peers: Honest Gains, Replacement Costs, and Resilience
本文研究异构大语言模型（LLM）辩论场景中，不同模型间的交互同时具有纠正和对抗两种影响。作者通过实验测量异构同伴如何改变诚实智能体的修正行为：即改变答案的频率以及这种改变是纠正性的还是有害的。实验对比了多种设置：同质基线（完全相同的模型）、
PYPILINE: Malicious PyPI Package Detection via Suspicious API Knowledge and Agent Workflow
开源软件供应链安全中，恶意PyPI包的检测至关重要。现有方法依赖规则或传统机器学习，存在可解释性差、难以适应新型攻击等问题。为此，本文提出PYPILINE，一种结合可疑API知识库与Agent工作流的新型检测方法。首先，PYPILINE对已
Evaluating Open-Source LLMs for Multi-Label ATT&CK Technique Classification on CTI Reports
该论文针对当前开源大规模语言模型（LLM）在复杂非结构化网络威胁情报（CTI）报告上进行多标签MITRE ATT&CK技术分类的性能进行评估。传统分类依赖人工标注，早期自动化方法难以处理非结构化文本中的复杂语言和多步攻击模式。LLM虽有潜力
Security and Privacy Prompts in the Wild: What Users Ask LLMs and How LLMs Respond
本研究首次系统性地收集并分析了用户向大型语言模型（LLM）提出的与数字安全与隐私（S&P）相关的真实问题。基于WildChat数据集（包含320万次用户-LLM对话），研究者识别出14,727条S&P提示，并将其归纳为9大类主题，涵盖账户安
Conflict-Aware Retriever Editing for Knowledge Injection Attacks on LLM-Based RAG Systems
该论文提出了一种名为CAREATTACK的模型中心检索器攻击框架，用于在基于检索增强生成（RAG）的大型语言模型中实施恶意知识注入。现有RAG注入攻击主要依赖于操作外部知识库（如构造恶意语料），但这种数据驱动的方法生成的合成文本可能被检测，
SoK: AI-Augmented Binary Reversing
二进制逆向工程是软件理解、漏洞发现、恶意软件分析和固件审计的基础，但由于编译过程中语义信息的不可逆丢失，该任务具有本质上的挑战性。近年来，机器学习、大型语言模型（LLM）和智能体AI系统的进展加速了AI增强二进制逆向的采用，但相关研究工作在
Improper input validation in AVer PTC500S, PTC115, PTC500+, and PTC115+ cameras may allow a remote, unauthenticated attacker to achieve arbitrary code execution via a speciall...
CVE-2026-40624
该漏洞影响AVer PTC500S、PTC115、PTC500+和PTC115+等网络摄像头，由不当的输入验证导致。攻击者无需认证，通过发送特制的Web请求即可远程触发任意代码执行，CVSS评分高达9.8（严重级别）。成功利用可导致设备完全
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud
CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Named a Leader in Identity Threat Detection and Response
CrowdStrike Named a Leader in Identity Threat Detection and Response
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro