The post-quantum EO is an important milestone. Now it’s time to get to work
The new post-quantum executive order sets a 2030 migration deadline and establishes a powerful foundation for post-quant
2026-06-25 归档
今日共收录 1364 条安全情报，包含 629 个 CVE，391 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Google releases new privacy controls for activity history, personalization
Google is rolling out new privacy controls for Search services and Google Play, giving you more control over saved histo
DraftKings hacker 'Snoopy' sentenced to 18 months in prison
A 21-year-old using the alias "Snoopy" was sentenced to 18 months in prison for his role in hacking DraftKings accounts
CISA warns of max severity Ubiquiti flaws exploited in attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of hackers actively exploiting flaws in Ubiq
Amadey, StealC malware operations disrupted in Operation Endgame action
Microsoft, Europol, and international partners have disrupted infrastructure used by the Amadey and StealC malware opera
Securing the service desk: Why social engineering attacks keep succeeding
Service desks have become a favored target for attackers seeking password resets, MFA changes, and access to corporate a
Stealthy Mistic backdoor linked to ransomware access broker KongTuke
A new backdoor dubbed Mistic has been observed in financially motivated attacks targeting organizations in the insurance
Tata Electronics confirms cyberattack as hackers leak data
Tata Electronics has confirmed in a statement to BleepingComputer that it was the target of a cyberattack that impacted
Windows 11 KB5095093 update rolls out new Point-in-Time restore feature
Microsoft has released the KB5095093 preview cumulative update for Windows 11 24H2 and 25H2, which fixes numerous bugs
Healthtech firm Xolis suffers data breach impacting 1.4 million people
Healthcare technology company Xsolis says that sensitive data belonging to nearly 1.4 million individuals was compromise
New macOS ClickFix attack silently mounts DMGs to push infostealer
A new macOS ClickFix campaign is using Terminal commands to silently download, mount, and launch info-stealing malware f
Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered
A coordinated law enforcement operation, in partnership with private sector companies, including Bitdefender, Bitsight,
Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks
Cybersecurity researchers have flagged a new class of CI/CD workflow weakness that allows attackers to hijack workflows
DoJ Seizes Huione Cloud Account Tied to Cyber Scam Money Laundering
The U.S. Department of Justice (DoJ) on Tuesday announced the seizure of a cloud computing account put to use by subsidi
Exclusive: Meet AIVEX, a New Triage Model Built to Reduce Supply Chain Threat and Risk
The new framework seeks to help security teams identify which software supply chain vulnerabilities pose the greatest op
New ‘Mistic’ RAT Opens Door to Several Ransomware Families
Mistic is used by Woodgnat, an initial access broker working with Qilin, Interlock, Rhysida, Akira, 8Base, and Black Bas
Exploitable CI/CD Vulnerabilities Expose Millions of Repositories to Hijacking
The security defects allow unauthenticated users to take control of the open source software supply chain. The post Expl
Detect, Unlearn, Restore: Defending Text Summarization Models Against Data Poisoning
该论文研究了针对大型语言模型（LLMs）在抽象文本摘要任务微调阶段的数据投毒攻击与防御。在微调过程中，小型任务特定数据集对模型行为产生不成比例的影响，攻击者可以通过操纵微调数据来诱导持久的摘要失败（例如生成有偏见或有害的摘要），同时保持标准
Detecting Malicious Agent Skills in the Wild using Attention
本文针对LLM智能体在加载第三方技能（skill）时面临的安全威胁展开研究。技能是以自然语言指令编写的文件包，由第三方开发者编写并通过市场分发，执行时拥有用户特权。恶意技能可窃取数据、劫持智能体或在供应链中持久化，使技能市场成为新的攻击面。
Inside Crypter-as-a-Service: An Ecosystem Analysis of the exploit.in Underground Forum Research Talks
本文通过对俄语网络犯罪论坛 exploit.in（同时存在于明网和暗网）上约100万个帖子进行纵向分析，结合关键词过滤、LLM辅助标注和人工验证，提取了2020年1月至2025年8月间491个线程和2949篇帖子，对加密器即服务（CraaS