Google releases new privacy controls for activity history, personalization
Google is rolling out new privacy controls for Search services and Google Play, giving you more control over saved histo
2026-06-26 归档
今日共收录 1370 条安全情报，包含 648 个 CVE，378 篇安全通告，以及 115 篇研究论文。
← 返回归档列表DraftKings hacker 'Snoopy' sentenced to 18 months in prison
A 21-year-old using the alias "Snoopy" was sentenced to 18 months in prison for his role in hacking DraftKings accounts
Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access
Microsoft Threat Intelligence identified an active multi-stage intrusion campaign targeting hospitality organizations in
Microsoft a Leader in The Forrester Wave™ for Endpoint Management Platforms
Microsoft named a Leader in the Forrester Wave™: Endpoint Management Platforms, Q2 2026, with the highest scores in the
CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure
Government entities and critical infrastructure were targeted for espionage in SE Asia by attackers using a hybrid toolk
Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances
ESET Research analyzes Gamaredon’s new toolset and the group’s growing reliance on legitimate online services to hide it
Anthropic is testing desktop-like Claude Cowork for mobile
Anthropic appears to be testing Claude Cowork support on mobile, allowing you to manage long-running Claude tasks from y
Poland busts SIM-swapping gang tied to millions in crypto theft
Authorities in Poland have arrested four members of an organized cybercrime group accused of breaching telecommunication
Order-tracking app Shop abused to push callback phishing attacks
Threat actors are increasingly abusing Shop, the order-tracking app from Shopify, by adding fake purchase receipts in us
Microsoft quietly extends free Windows 10 ESU support to October 2027
Microsoft has quietly extended its free Windows 10 Extended Security Updates (ESU) program for consumers by an additiona
New macOS malware embeds fake errors to confuse AI analysis tools
A newly discovered macOS malware dubbed "Gaslight" is designed to confuse AI-assisted malware analysis tools by hiding p
PirloTV sports piracy network disrupted as 44 domains seized
A major sports piracy ring linked to the illegal PirloTV streaming platform has been disrupted in an action that targete
Bluekit phishing kit adopts browser-in-the-middle for login theft
The Bluekit phishing-as-a-service platform continues to evolve with nearly 70 new hostnames identified over the past wee
The Four Elevations of Effective Fraud Prevention
Fraudsters don't attack just one transaction. They target accounts, platforms, and entire ecosystems. IPQS explains the
Webinar: Why account takeovers remain one of the hardest threats to stop
Account takeover attacks continue to challenge security teams because attackers often operate through legitimate account
Red-Teaming the Agentic Red-Team
该论文首次对当前最广泛使用的用于进攻性安全操作的自主代理系统进行了深入的安全性分析。尽管社区已开发出越来越多功能强大的代理系统，但对其自身安全性的评估却相对不足。研究表明，大多数此类工具存在共同的设计缺陷，使得活跃攻击者能够窃取API密钥、
Inherited Circuits, Learned Semantics: How Fine-Tuning Creates Evasion Vulnerabilities Invisible to Standard Evaluation
该论文研究了大型语言模型（LLM）在针对安全分类任务进行微调后，可能引入的逃避漏洞。通常，微调后的模型仅在保留的同分布测试集上评估，但作者发现这种评估方式无法发现微调本身引入的漏洞：模型可能学习到基于指示符标记的语义，在规范输入上保持准确率
Empirical Software Engineering TerraProbe: A Layered-Oracle Framework for Detecting Deceptive Fixes in LLM-Assisted Terraform
Terraform基础设施即代码（IaC）中的安全配置错误是云部署中日益增长的风险，大型语言模型（LLM）越来越多地被用作自动修复代理。然而，现有评估通常仅以目标静态分析告警消失作为修复成功的标准，而未检查规划有效性、行为变化或安全意图。本
AutoSpec: Safety Rule Evolution for LLM Agents via Inductive Logic Programming
该论文提出 AutoSpec，一个基于归纳逻辑编程（ILP）的框架，用于自动演化大语言模型（LLM）智能体的安全规则。LLM 智能体通过集成外部工具和环境实现复杂任务自动化，但其自主性带来严重安全风险，如执行破坏性命令、泄露敏感数据或违反领
Detect, Unlearn, Restore: Defending Text Summarization Models Against Data Poisoning
本文针对大型语言模型（LLM）在抽象文本摘要微调阶段面临的数据投毒攻击，提出了一套统一的防御框架。研究动机在于，微调时使用的任务特定数据集规模较小，攻击者可以通过操纵微调数据植入后门，导致模型生成有偏或有害的摘要，同时保持标准评估指标（如R