Cyber Defense Summit 2026Register today to reserve your spot
Cyber Defense Summit 2026Register today to reserve your spot
2026-07-05 归档
今日共收录 754 条安全情报，包含 65 个 CVE，375 篇安全通告，以及 61 篇研究论文。
← 返回归档列表Cyber Defense Summit 2026Crafted to equip elite security professionals with the strategies, tools, and insights needed to outmaneuver increasingly sophisticated, AI-enabled adversaries and build resilient cyber ecosystems.Register now
Cyber Defense Summit 2026Crafted to equip elite security professionals with the strategies, tools, and insights needed t
Security TalksJoin our security experts in this ongoing series as they explore the latest AI innovations across our security product portfolio, threat intelligence best practices, and more.Watch on-demand
Security TalksJoin our security experts in this ongoing series as they explore the latest AI innovations across our secu
New Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Forever
New Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Forever
New Abuse of the ClickOnce Technology, Part 1: The Inner Workings of ClickOnce Application Deployment
New Abuse of the ClickOnce Technology, Part 1: The Inner Workings of ClickOnce Application Deployment
Browser Security: Zero-Days Are Only Part of the Problem
Browser Security: Zero-Days Are Only Part of the Problem
NetNut proxy network disrupted, 2 million infected devices cut off
A joint operation involving Google has disrupted NetNut, a residential proxy network that gave access to millions of com
New Avalon Malware Framework Packs CrownX Ransomware Capabilities
Cybersecurity researchers have discovered a previously undocumented modular malware framework codenamed Avalon that's di
JadePuffer ransomware used AI agent to automate entire attack
Researchers identified what they believe is the first documented case of a ransomware operation, JadePuffer, conducted e
U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case
A U.S. government entity paid about $1 million to keep stolen files from being leaked, according to a new case study by
North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign
The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing 108 unique pack
Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware
本文研究了LLM编码智能体（coding agent）在依赖第三方技能市场时面临的安全威胁。第三方技能以软件供应链形式引入攻击面：恶意技能可窃取凭证、泄露源码或安装后门。现有防御主要依赖静态扫描器（模式匹配或LLM-as-judge分析），
kNNGuard: Turning LLM Hidden Activations into a Training-Free Configurable Guardrail
该论文提出了一种名为 kNNGuard 的无需训练的护栏机制，用于检测大型语言模型（LLM）中的不安全、离题或对抗性提示。现有护栏主要依赖微调构建分类器，但通常泛化能力差且推理延迟高。kNNGuard 利用现成 LLM 的激活空间，仅需 5
Black-Box Inference of LLM Architectural Properties with Restrictive API Access
这篇论文研究了在API访问受到严格限制的情况下，如何推断大语言模型（LLM）的底层架构属性。当前大多数商业LLM供应商不再公开模型架构细节，且API只返回每个解码token的单一logit值，不再提供logit偏置功能。作者提出了Night
Antaeus: Hunting Repository-Level Logic Vulnerabilities via Context-Grounded LLM Reasoning
该论文提出了Antaeus，一个用于检测仓库级逻辑漏洞的框架，通过将LLM推理锚定在仓库级代码上下文中来克服现有方法的局限性。逻辑漏洞的识别需要推断应用特定的安全不变量和隐式假设，而现有基于LLM的检测器在内存安全等漏洞上表现良好，但难以处
SessionBound: Turning Enterprise Task Approval into Budgeted Database Sessions
本文提出 SessionBound，一种将企业 AI 代理的任务审批转化为有预算、可审计的数据库会话的框架。随着 AI 代理在企业内部分析、审计、合规检查和运营调查中的广泛应用，传统的授权机制面临挑战：经理或数据所有者可能批准一个业务任务，
HARC: Coupling Harmfulness and Refusal Directions for Robust Safety Alignment
该论文研究了大型语言模型（LLM）在安全对齐后内部表示的安全方向问题。作者首先证实了之前的工作：对齐的LLM在提示侧（prompt-side）的残差流中编码了“有害性”（harmfulness）和“拒绝”（refusal）两个可分离的方向。
Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Traces
该论文揭示了大型语言模型（LLM）在支持函数调用的状态ful环境中存在的一种结构性安全漏洞。在此类系统中，开发者定义的函数schema、结构化参数以及不可信的工具输出被混入同一个共享模型上下文，导致可信控制逻辑与不可信数据间的边界模糊，攻击
Generative AI and Federated Learning for Intrusion Detection Systems: A Survey
该论文是一篇关于生成式人工智能（Generative AI）和联邦学习（Federated Learning）在入侵检测系统（IDS）中应用的综述。入侵检测系统是现代网络环境（如网络物理系统、物联网、企业网络和分布式网络）中监控流量、识别恶
[分享]全平台IDAPro 9.4 beta1+汉化补丁+新版注册机
[分享]全平台IDAPro 9.4 beta1+汉化补丁+新版注册机