Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
2026-07-01 归档
今日共收录 1573 条安全情报，包含 770 个 CVE，406 篇安全通告，以及 100 篇研究论文。
← 返回归档列表The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
NAIC says public data stolen in ShinyHunters' PeopleSoft breach
The National Association of Insurance Commissioners (NAIC) says the ShinyHunters extortion group stole only publicly ava
What’s new in Microsoft Security: June 2026
This month’s updates help security and IT teams strengthen identity and multicloud foundations, protect data wherever it
Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector
Attackers can exploit LLM domain hallucinations through phantom squatting to target supply chains. Read the analysis to
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Lessons from the Underground: How to Combat Business Email Compromise
Business Email Compromise is more than an email scam. It's a coordinated operation involving compromised accounts, finan
Double and Nothing: Understanding and Detecting Cryptocurrency Giveaway Scams.
该论文系统性地研究了加密货币赠品诈骗（Cryptocurrency Giveaway Scams），这是一种利用社交媒体平台（如Twitter/X）冒充知名人士或项目方，声称发放免费加密货币以诱骗用户转入小额验证费用的欺诈行为。作者首先通过
CacheWarp: Software-based Fault Injection using Selective State Reset.
该论文提出了一种名为CacheWarp的新型软件故障注入方法，核心思想是通过选择性重置处理器状态来诱导系统出现可控的错误行为。与传统物理故障注入（如激光、电磁）不同，CacheWarp完全基于软件实现，无需接触硬件。其原理是利用处理器缓存行
Alexa in Phishingland: Empirical Assessment of Susceptibility to Phishing Pretexting in Voice Assistant Environments.
本文针对亚马逊Alexa等语音助手环境下的网络钓鱼社会工程学攻击（pretexting）进行了实证评估。研究通过设计模拟攻击场景，测试用户在语音交互中对钓鱼 pretexting 的敏感性。实验招募了参与者，在受控环境中与Alexa互动，并
Learning Differentially Private Mechanisms.
该论文提出了一种学习差分隐私机制的框架，旨在自动化设计满足差分隐私保护的数据发布机制。传统上，差分隐私机制（如拉普拉斯机制、指数机制）需要人工设计，且针对特定查询或统计量。本文作者将机制设计问题转化为学习问题：给定一组查询和工作负载，通过优
Security and Privacy Measurements in Cellular Networks: Novel Approaches in a Global Roaming Context.
本研究聚焦于蜂窝网络在全球漫游场景下的安全与隐私测量问题。随着移动用户跨国漫游日益频繁，运营商之间的信令交互带来了新的攻击面，例如位置泄露、身份伪造、中间人攻击等。现有测量方法多针对单一网络，缺乏对漫游链路全局视角的刻画。本文提出一套新颖的
SecurityNet: Assessing Machine Learning Vulnerabilities on Public Models.
该论文提出了一个名为 SecurityNet 的框架，旨在系统性地评估公开机器学习模型的安全性弱点。随着预训练模型在开源社区（如 Hugging Face）广泛发布，攻击者可能利用这些模型中的后门、对抗性扰动等漏洞。SecurityNet
Don't Waste My Efforts: Pruning Redundant Sanitizer Checks by Developer-Implemented Type Checks.
该论文针对当前软件安全中广泛使用的消毒器（sanitizer）存在的冗余检查问题展开研究。消毒器通过插入运行时检查来检测内存错误、未定义行为等漏洞，但大量检查是冗余的，因为开发者已在代码中通过类型检查（如显式的类型转换或条件判断）隐含地保证
DARKFLEECE: Probing the Dark Side of Android Subscription Apps.
本论文《DARKFLEECE: Probing the Dark Side of Android Subscription Apps》聚焦于Android平台上的订阅型应用（subscription apps）中的安全与欺诈问题。研究者提出
Towards Automatic and Precise Heap Layout Manipulation for General-Purpose Programs.
该论文研究通用程序的堆布局操纵（Heap Layout Manipulation, HLM）自动化问题。堆布局操纵是漏洞利用中的关键步骤，攻击者通过控制堆内存的分配和释放顺序，将关键对象放置在可被利用的内存位置。传统方法依赖于专家手动构造，
Do Not Give a Dog Bread Every Time He Wags His Tail: Stealing Passwords through Content Queries (CONQUER) Attacks.
本文提出一种名为CONQUER的新型侧信道攻击，通过利用内容查询（如浏览器自动填充或密码管理器查询）的响应时间或行为特征来窃取用户密码。研究背景：现代浏览器和密码管理器广泛使用内容查询功能，例如在用户输入时自动填充密码或提供提示，但这些查询
Assessing the Impact of Interface Vulnerabilities in Compartmentalized Software.
本论文针对分拆化（compartmentalized）软件中的接口漏洞影响进行了系统评估。分拆化软件通过将程序划分为多个隔离的组件（如利用进程级隔离、沙箱或微内核架构）来增强安全性，但组件间的接口（如系统调用、RPC、共享内存）可能引入新的
Demo: Security of Deep Learning based Automated Lane Centering under Physical-World Attack.
该论文演示了深度学习驱动的自动车道居中（ALC）系统在物理世界攻击下的安全性问题。ALC是高级辅助驾驶系统的关键功能，依赖深度学习模型进行车道线检测和车辆横向控制。作者提出了一种物理世界对抗性攻击方法，通过在车辆前方道路放置精心设计的贴纸图