Protocol Prying: Systematic Vulnerability Research in the Apple AirDrop and Android Quick Share Proximity Transfer Protocols
本文是对 Apple AirDrop 和 Google/Samsung Quick Share 这两个近距离文件传输协议的首个系统性安全研究。两种协议均无需预先配对即可从无线近距离范围内访问，且在特权守护进程中处理复杂的序列化内容（如二进制
2026-06-27 归档
今日共收录 1218 条安全情报，包含 478 个 CVE，392 篇安全通告，以及 115 篇研究论文。
← 返回归档列表Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Models
本文是一项跨模态的对抗性扩散综述研究，旨在统一整合当前在文本/大语言模型（LLM）、图像分类器、视觉-语言模型以及基于扩散的输入净化防御这四个相对独立的对抗性评估领域。作者指出，虽然去噪扩散模型已成为对抗性攻击与防御中的共享生成机制，但各社
An Approach for a Supporting Multi-LLM System for Automated Certification Based on the German IT-Grundschutz
本文提出了一种基于多大型语言模型系统（MLS）与混合检索增强生成（HybridRAG）的半自动化BSI IT-Grundschutz认证方法。针对欧盟网络与信息安全指令NIS2带来的认证需求激增、专业人才短缺及实施成本高昂等挑战，该方法通过
Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
检索增强生成（RAG）通过将外部知识库与大型语言模型（LLM）结合，显著提升了生成内容的事实准确性和领域适应性。然而，检索机制的引入带来了超越传统语言模型的全新安全与隐私风险：敏感信息可能通过检索索引、查询日志、上下文构建或联邦更新而泄露，
Decoupling Reconnaissance and Exploitation: Measuring the Capability Boundaries of LLM-Based Web Penetration Testing
该论文针对大语言模型（LLM）在自动化渗透测试评估中存在的错误级联问题，提出了一种两阶段解耦评估框架。现有端到端黑盒评测因早期侦察失败会掩盖代理的实际漏洞利用能力，导致评估结果无法准确反映模型真实水平。作者通过真实漏洞上下文注入（groun
Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents
本文从数据为中心的角度对大型语言模型（LLM）代理的隐私问题进行了综述。随着LLM代理从简单的问答系统演进为能够操作敏感数据的复杂工具，其隐私风险显著增加。代理通常需要查询数据库、检索文档、调用外部API、记忆历史交互并代表用户执行操作，这
Probabilistic Agents in Deterministic Audits: Evaluating Multi-Agent Systems for Automated Audits Based on the German IT-Grundschutz
本文基于欧盟NIS-2指令下中小企业面临的风险管理合规要求，针对德国联邦信息安全办公室（BSI）制定的IT-Grundschutz（IT-GS）认证过程资源密集、手工工作量大的问题，提出并实现了一种结合多智能体系统（MAS）与混合检索增强生
Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate arbitrary file syste...
CVE-2026-28701
该漏洞影响 Daktronics 控制器固件的多个版本。由于对用户输入路径验证不完善，未经身份验证和已认证的远程攻击者均可利用目录遍历技术，突破预期的目录限制，枚举任意文件系统路径。攻击者可读取控制器上的任意文件，包括敏感配置、凭据等，进而
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
Dissecting Nudges in Password Managers: Simple Defaults are Powerful.
该研究聚焦于密码管理器中的“助推”（nudge）设计对用户密码强度的影响。密码管理器通常内置密码生成器，但用户往往忽略或修改生成的强密码，选择自己记忆的弱口令。研究者设计并实施了一项在线用户实验（N=540），比较了四种不同的默认设置与助推