安全日报 - 2026-06-23 - Cyber Security Daily Radar

漏洞预警2026-06-22 发布CRITICAL

vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers...

CVE-2026-48746

vLLM 是一个用于大型语言模型（LLM）的推理和服务引擎。在版本 0.3.0 至 0.22.0 之间，由于 ASGI web 服务器及 starlette 对此类服务器的信任问题，存在一个认证绕过漏洞。攻击者无需提供配置的 VLLM_AP

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-06-22 发布CRITICAL

n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users to bypass Allowed H...

CVE-2026-56348

n8n 是一款工作流自动化工具，其 2.20.0 之前的版本中存在一个凭据泄露漏洞。漏洞位于 POST /rest/dynamic-node-parameters/options 端点，允许已认证的攻击者绕过“允许的 HTTP 请求域名”限

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

威胁情报2026-06-23 发布INFO

CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms

历史摘要 · 未重新核验 · CrowdStrike

#crowdstrike #apt #edr

威胁情报2026-06-23 发布INFO

CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud

历史摘要 · 未重新核验 · CrowdStrike

#crowdstrike #apt #edr

威胁情报2026-06-23 发布INFO

Cloud & Application Security

历史摘要 · 未重新核验 · CrowdStrike

#crowdstrike #apt #edr

威胁情报2026-06-23 发布INFO

From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise

历史摘要 · 未重新核验 · CrowdStrike

#crowdstrike #apt #edr

威胁情报2026-06-23 发布INFO

Next-Gen Identity Security

历史摘要 · 未重新核验 · CrowdStrike

#crowdstrike #apt #edr

威胁情报2026-06-23 发布INFO

CrowdStrike Named a Leader in Identity Threat Detection and Response

历史摘要 · 未重新核验 · CrowdStrike

#crowdstrike #apt #edr

威胁情报2026-06-23 发布INFO

CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security

历史摘要 · 未重新核验 · CrowdStrike

#crowdstrike #apt #edr

威胁情报2026-06-23 发布INFO

CrowdStrike Expands Identity Leadership with OpenID and IDPro

历史摘要 · 未重新核验 · CrowdStrike

#crowdstrike #apt #edr

威胁情报2026-06-23 发布INFO

cloud architecture assessment

历史摘要 · 未重新核验 · Mandiant

#report #mandiant #apt

威胁情报2026-06-23 发布INFO

ransomware and multifaceted extortion defense

历史摘要 · 未重新核验 · Mandiant

#report #mandiant #apt

威胁情报2026-06-23 发布INFO

Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand

Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content

历史摘要 · 未重新核验 · Mandiant

#report #mandiant #apt

威胁情报2026-06-22 发布INFO

One intrusion, two cyberattackers: Uncovering parallel threat activity

Ransomware case reveals two parallel threat actors, blending tactics and evasion—showing why isolated signals can often

历史摘要 · 未重新核验 · Microsoft Threat Intelligence

#microsoft #malware #apt #ti

威胁情报2026-06-22 发布INFO

The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration

Unit 42 research details how attackers could exploit global name uniqueness in bucket hijacking to redirect cloud data s

历史摘要 · 未重新核验 · Palo Alto Unit 42

#paloalto #malware #unit42 #apt

威胁情报2026-06-22 发布INFO

FFmpeg fixes PixelSmash flaw in widely used video decoder

A newly disclosed FFmpeg flaw dubbed 'PixelSmash' could be exploited for remote code execution on Jellyfin servers under

历史摘要 · 未重新核验 · BleepingComputer

#news #ransomware #cybersecurity

学术论文2026-06-23 发布INFO

C3PO: Large-Scale Study Of Covert Monitoring of C&C Servers via Over-Permissioned Protocol Infiltration.

本文提出 C3PO 管道，用于大规模、隐蔽地监控僵尸网络命令与控制（C&C）服务器。现代恶意软件日益采用标准化且过度授权的协议（如 HTTP、DNS、SMTP 等），这些协议在僵尸程序中往往赋予不必要的权限，从而暴露了攻击者 C&C 服务器

历史摘要 · 未重新核验 · ACM CCS

#botnet #C&C #over-permissioned protocols #covert monitoring #malware analysis

学术论文2026-06-23 发布INFO

Snapping Snap Sync: Practical Attacks on Go Ethereum Synchronising Nodes.

本文针对Go Ethereum（Geth）实现的snap sync协议提出了多种实际攻击方法。Snap sync是一种用于快速同步以太坊节点的协议，通过并行下载状态数据来加速同步过程。作者首先分析了snap sync协议的设计细节，发现其缺

历史摘要 · 未重新核验 · USENIX Security

#ethereum #go-ethereum #snap-sync #security #network-attack

学术论文2026-06-23 发布INFO

Eye-Shield: Real-Time Protection of Mobile Device Screen Information from Shoulder Surfing.

Eye-Shield 是一种针对移动设备屏幕信息的实时保护方案，旨在防御肩窥攻击。肩窥攻击是指攻击者通过偷窥用户屏幕获取密码、PIN码、浏览行为等敏感信息，而用户在公共场所使用手机时极易遭受此类攻击。Eye-Shield 利用人眼视觉特性，

历史摘要 · 未重新核验 · USENIX Security

#shoulder-surfing #mobile-security #privacy

学术论文2026-06-23 发布INFO

Iris: Dynamic Privacy Preserving Search in Authenticated Chord Peer-to-Peer Networks.

本文针对结构化对等网络（如Chord）中查询隐私泄露问题，提出了一种名为IRIS的隐私保护方案。在传统Chord网络中，用户通过向中间节点逐跳询问来定位数据，每个节点会返回离目标地址最近的已知节点，直到找到负责该数据的节点。这一过程中间节点

历史摘要 · 未重新核验 · NDSS

#peer-to-peer #privacy-preserving #chord #query privacy

2026-06-23 归档