Representation Matters: An Empirical Study of Program Representations for LLM Vulnerability Reasoning
本论文针对大语言模型（LLM）用于自动化漏洞检测时，程序结构与语义信息的表示方式这一关键问题进行了实证研究。作者指出，当前的提示工程方法通常直接提供原始源代码，但这一做法缺乏理论支撑，且可能引入冗余信息导致推理效果下降。为此，论文构建了Re
2026-06-27 归档
今日共收录 1218 条安全情报，包含 478 个 CVE，392 篇安全通告，以及 115 篇研究论文。
← 返回归档列表CORE-BREW: LLR-Based Soft Decoding for Robust Multi-Bit LLM Watermarking
本文针对大型语言模型（LLM）输出的多比特水印鲁棒性问题，提出一种基于对数似然比（LLR）的软判决解码方法CORE-BREW。现有基于纠错码（ECC）的LLM水印多采用硬判决解码，丢弃了令牌级别的可靠性信息，导致在编辑攻击（如词汇替换、改写
pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
## Summary `pnpm` accepts package names from the env lockfile `configDependencies` section and uses those names directl
pnpm: `patch-remove` could delete project-selected files outside the patches directory
## Summary The `patch-remove` deletion-scope issue tracked as GHSA-72r4-9c5j-mj57 / CAND-PNPM-030 has been addressed in
pnpm: Hoisted install imports lockfile alias outside node_modules
## Summary The hoisted dependency alias issue tracked as GHSA-fr4h-3cph-29xv / CAND-PNPM-059 has been addressed in both
ex_aws_sns: Trusted-attacker `SigningCertURL` permits complete SNS signature bypass
### Summary `ExAws.SNS.verify_message/1` fetches the signing certificate from the `SigningCertURL` field of the incomin
Blnk has an API key authorization bypass in owner and scope enforcement
Blnk API key endpoints had an authorization issue that allowed non-master API keys to perform key-management actions out
SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings
## Summary Four authorization bypass vulnerabilities in Symfony LiveComponent actions allow any authenticated user with
[分享]全平台IDAPro 9.4 beta1+汉化补丁+新版注册机
[分享]全平台IDAPro 9.4 beta1+汉化补丁+新版注册机
[原创]CVE-2022-0847 Dirty Pipe 漏洞原理深度分析 近年来最"干净"的内核提权漏洞之一
CVE-2022-0847
[原创]CVE-2022-0847 Dirty Pipe 漏洞原理深度分析 近年来最"干净"的内核提权漏洞之一
Beyond IOCs: AI-enabled threat intelligence
In this week’s newsletter, Martin considers how AI will help threat intelligence by creating an easily queryable data so
New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries
CVE-2026-46331
A flaw in the Linux kernel's traffic-control subsystem can let a local unprivileged user gain root on affected systems.
New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets
CVE-2026-43503
DirtyClone is a new Linux kernel privilege escalation in the DirtyFrag family. JFrog Security Research published a worki
First-Ever Exploitation of PTC Windchill Vulnerability Discovered in the Wild
CVE-2026-12569
CISA has added the remote code execution flaw CVE-2026-12569 to its Known Exploited Vulnerabilities catalog. The post Fi
Can Machine Learning Break Wi-Fi Privacy? A Study on MAC Address Randomization
本文研究MAC地址随机化在Wi-Fi网络发现阶段作为被动跟踪防御手段的有效性。作者通过实验证明，尽管设备采用随机MAC地址，攻击者仍可利用机器学习指纹识别方法对设备进行去匿名化。核心贡献在于提出了一种基于高位吞吐量(HT)能力信息字段的比特
Chai: Agentic Discovery of Cryptographic Misuse Vulnerabilities
该论文提出了 Chai，一个基于 AI 的自动化系统，用于发现和验证加密误用漏洞。传统的漏洞检测工具在内存安全等领域有成熟的插桩手段，但对于加密误用这类缺乏运行时信号的问题效果不佳。Chai 重新审视了差分测试技术，利用 AI 提升检测精度
Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem
本文对ERC-8004去中心化AI代理信任协议进行了首次实证研究。ERC-8004旨在为跨组织交易的AI代理提供无许可信任层，包含身份、声誉和验证三个链上注册表。研究者从协议部署至2026年5月13日，爬取了以太坊、BNB智能链（BSC）和
Decoherence as Defence and the Magnitude of Noise Regularisation: A Rigorous N -Qubit Theory of Stochastic Quantum Neural Networks for Adversarially Robust Network Intrusion Detection
本文提出了一种基于随机量子神经网络（SQNN）的对抗鲁棒网络入侵检测方法。作者首先通过随机主方程和向量化的Liouvillian形式给出了N量子比特的严格理论框架，证明了退相干-收缩定理：在L层纠缠层上强度为γ的去极化通道会使每个权重为w的
ComputeFHE: A Privacy-Preserving General-Purpose Computation Library
全同态加密（FHE）允许在加密数据上直接执行计算，同时保护数据机密性，但其实际应用受到高计算成本和开发复杂性的限制。本文提出 ComputeFHE，一个基于 TFHE 密码系统的开源 C++ 库，旨在简化隐私保护应用的开发。该库提供加密整数
The Observer World: A Cryptographic Extension of Impagliazzo's Five Worlds
该论文对Impagliazzo的五世界模型进行了密码学扩展。Impagliazzo的五世界按照计算假设的存在性（如单向函数、公钥密码等）将计算复杂性分类，但所有世界都隐含假设所有参与方（包括敌手）都能观测到完整输入，即观测者始终为顶级观测者