MFSA 2026-55Security Vulnerabilities fixed in Focus for iOS / Klar 151.3.1
MFSA 2026-55Security Vulnerabilities fixed in Focus for iOS / Klar 151.3.1
2026-06-26 归档
今日共收录 1370 条安全情报，包含 648 个 CVE，378 篇安全通告，以及 115 篇研究论文。
← 返回归档列表MFSA 2026-56Security Vulnerabilities fixed in Firefox for iOS 152.0
MFSA 2026-56Security Vulnerabilities fixed in Firefox for iOS 152.0
Chrome Stable for iOS Update
Hi everyone! We've just released Chrome Stable 150 (150.0.7871.51) for iOS; it'll become available on App Store in the n
Chrome for Android Update
Hello Everyone! We've just released Chrome 150 (150.0.7871.46) for Android to a small percentage of users. It'll become
Chrome Beta for iOS Update
Hi everyone! We've just released Chrome Beta 150 (150.0.7871.52) for iOS; it'll become available on App Store in the nex
Chrome for Android Update
Hi, everyone! We've just released Chrome 149 (149.0.7827.200) for Android. It'll become available on Google Play over th
Chrome Dev for Android Update
Hi everyone! We've just released Chrome Dev 151 (151.0.7910.0) for Android. It's now available on Google Play.You can se
Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees
该论文研究了LLM代理长期记忆面临的内存投毒攻击问题。在LLM代理系统中，持久化长期记忆存储了来自多个会话的信息，攻击者可以在一个会话中注入恶意内容，从而影响后续会话中的关键操作（如支付、设置更改或数据泄露）。现有防御措施通常基于内容（检测
An Approach for a Supporting Multi-LLM System for Automated Certification Based on the German IT-Grundschutz
该论文提出了一种基于多大型语言模型系统（MLS）与混合检索增强生成（HybridRAG）的方法，用于半自动化执行德国BSI IT-Grundschutz认证。研究背景是欧盟NIS2指令带来的新要求，导致对安全认证的需求急剧增加，同时面临专家
Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents
本文从数据视角对LLM Agent的隐私问题进行了全面综述。随着LLM Agent从简单的问答系统演变为能够操作敏感数据的自主系统（包括查询数据库、检索文档集合、调用外部API、记忆历史交互以及代表用户执行操作），隐私保护变得愈发困难。Ag
Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Models
本文是一篇跨模态对抗性扩散的融合综述，系统整合了四个原本分散的研究方向：针对文本和大语言模型的扩散攻击、针对图像分类器的扩散攻击、针对视觉-语言模型的越狱管线，以及基于扩散的输入净化防御。这些方向各自发展出了独立的词汇、威胁模型和基准测试，
Probabilistic Agents in Deterministic Audits: Evaluating Multi-Agent Systems for Automated Audits Based on the German IT-Grundschutz
该论文针对NIS-2指令要求中小企业实施风险管理，而德国IT-Grundschutz（IT-GS）认证过程资源密集、依赖人工的问题，提出了一种结合多智能体系统（MAS）与混合检索增强生成（HybridRAG）的架构，用于部分自动化IT-GS
Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
本文是一篇关于检索增强生成（RAG）系统安全与隐私的综合性综述。RAG通过将检索机制与生成模型（如大型语言模型）结合，能够利用外部知识库提升回答的事实准确性和领域适应性，已成为大模型落地的重要范式。然而，检索管道的引入带来了传统语言模型所没
Decoupling Reconnaissance and Exploitation: Measuring the Capability Boundaries of LLM-Based Web Penetration Testing
该论文针对大型语言模型（LLM）在自动化渗透测试中的应用，提出了一种解耦评估框架，旨在更准确地衡量基于LLM的Web渗透测试代理的能力。现有端到端黑盒评估容易受到错误级联影响：早期侦查阶段的失败可能掩盖代理实际利用漏洞的能力。为此，作者将评
Speculative Decoding at Temperature Zero: A Scoped Safety-Invariance Screen with a 48,072-Sample Expansion
本文研究了在温度零（greedy decoding）设置下，投机解码（speculative decoding）是否会对大型语言模型的安全评分输出产生负面影响。投机解码通过让一个轻量级的草稿模型为大型目标模型提议令牌，从而加速推理，但一个关
FirmCure:Towards Autonomous and Adaptive Rehosting of Linux-Based Firmware
该论文提出 FirmCure，首个基于大语言模型（LLM）的全系统重托管框架，旨在实现对 Linux 固件的自主自适应重托管。针对现有方法在定制化设备上因专用架构和硬件依赖配置导致的初始化与运行时障碍，以及过度依赖专家干预的瓶颈，FirmC
Poisoned Playbooks: Demystifying Knowledge Poisoning Effects on AI Security Agents
本文研究了AI安全智能体在依赖检索增强生成（RAG）技术时，面临的一种新型威胁：知识投毒（knowledge poisoning）。随着AI安全智能体越来越多地使用RAG从外部安全知识源（如漏洞分析、CTF题解）中获取信息，攻击者可以通过投
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise