INTERPOL Warns Phishing, Ransomware, and AI Scams Are Rising Across Asia-Pacific
A new report from INTERPOL has revealed a "dramatic increase" in cybercrime in Asia and the South Pacific, fueled by rap
2026-06-23 归档
今日共收录 1003 条安全情报，包含 243 个 CVE，376 篇安全通告，以及 99 篇研究论文。
← 返回归档列表Guarding AI memory
What happens when threat actors target what AI remembers? Microsoft breaks down the risks and the defenses. The post Gua
WhatsApp phishing attack uses fake business docs to hack PCs
An ongoing malware campaign is targeting WhatsApp users in multiple countries with deceptive messages that push VBScript
JaredFromSubway MEV bot hacked in $15 million crypto theft
The JaredFromSubway Ethereum MEV (Maximal Extractable Value) bot suffered a $15 million loss after an attacker manipulat
Microsoft says Windows 11 26H2 is coming soon, details upgrade process
Microsoft has confirmed that Windows 11 version 26H2 will be the next feature update and that devices running Windows 11
Microsoft fixes AutoGen Studio flaw that enabled code execution
A vulnerability chain dubbed AutoJack in Microsoft's AutoGen Studio interface for prototyping AI agents could let attack
A Glimpse into the “Search Your Target” Market for Stolen Credentials
Attackers no longer need to sift through massive credential dumps. They can pay others to do it for them. Flare explores
ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack after unknown threat actors manag
Google Sets Sept. 30 Deadline for Android Developer Verification in Four Countries
Google has set September 30, 2026, as the day it begins enforcing Android developer verification in the first four count
⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More
It’s Monday again. This week’s threat list looks painfully familiar: abused integrations, fake tools, poisoned websites
North Korean Hackers Blamed for Mastra NPM Supply Chain Attack
A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extens
Revelio: Cost-Efficient Agentic Memory Safety Vulnerability Detection For Repository-Scale Codebases
本文提出 Revelio，一个面向仓库级代码库的内存安全漏洞检测智能体框架。内存安全漏洞（如缓冲区溢出、释放后使用等）即使在经过大量模糊测试和人工审计的项目中仍然存在。现有基于大型语言模型（LLM）的方法虽有潜力，但存在幻觉、不可靠且难以扩
What You See Is Not What You Execute: Memory-Based Runtime SBOM Generation for Supply Chain Security
现代软件开发高度依赖来自公共仓库的第三方组件，这扩大了软件供应链的攻击面。为此，美国联邦倡议推动了软件物料清单（SBOM）作为标准化机制，通过描述软件组件、依赖关系及其关联来提高透明度。然而，基于元数据或文件系统工件生成的SBOM无法捕获运
Safe to Check, Unsafe to Use: Relinking at the Compression Boundary of LLM Agents
该论文发现了一种针对大语言模型（LLM）代理的新型漏洞，名为“relinking”（重链接）。当前，许多LLM代理系统使用基于摘要的提示压缩技术来缩短长上下文，但在压缩边界上存在安全缺陷：安全过滤器检查的是压缩前的原始提示，而后端系统实际执
Agent-Assisted Side-Channel Attacks on Non-Prefix KV Cache in RAG
本文揭示了现代大语言模型（LLM）服务引擎中检索增强生成（RAG）和非前缀键值（KV）缓存融合机制存在的一类结构性安全漏洞。与以往需要严格线性前缀对齐的KV缓存侧信道攻击不同，本文发现基于分块感知内存调度的微架构机制会无意中泄露连续的“St
A Longitudinal Study of Android Apps Signing Key Protection
本文对Android应用签名密钥保护进行了纵向生态研究。Android应用签名依赖于开发者管理的凭据，因此密钥的安全保护对于软件供应链的完整性至关重要。近期两大OEM厂商的平台密钥泄露事件表明，即使是设计稳健的签名机制也可能因开发者的疏忽而
TROPT: An Open Framework for Unifying and Advancing Discrete Text Optimization
离散文本触发优化（Discrete text-trigger optimization）旨在搜索特定文本序列，使得模型在摄入这些序列后朝向预设目标行为，广泛应用于模型红队测试（如LLM越狱）、审计和可解释性。然而，当前离散优化器的状态阻碍了
An Automated Framework for Input Alphabet Construction in Stateful Protocol Implementation Learning
本文针对有状态协议实现分析中的状态机学习技术所面临的核心瓶颈——手工输入字母表问题展开研究。传统的手工定义字母表限制了输入探索的完整性，难以捕获异常的不符合规范的消息，从而遗漏潜在语义缺陷。为此，作者提出一种自动化输入字母表构建框架，利用大
Detecting Malicious Agent Skills in the Wild using Attention
该论文聚焦于 LLM 代理系统中恶意技能检测的新问题。LLM 代理越来越多地加载由第三方编写并通过市场分发的技能包，这些技能包本质上是自然语言指令文件，以用户权限执行。单个恶意技能可能导致数据泄露、代理劫持或供应链后门，技能市场因此成为代理
FlexServe: A Fast and Secure LLM Serving System for Mobile Devices with Flexible Resource Isolation
本文针对移动设备端大型语言模型（LLM）推理的安全性和性能问题，提出了一种名为FlexServe的快速且安全的LLM服务系统。移动设备上的LLM推理面临双重威胁：攻击者可能通过入侵操作系统内核窃取模型权重和用户数据。ARM TrustZon