The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
2026-07-08 归档
今日共收录 1050 条安全情报，包含 282 个 CVE，378 篇安全通告，以及 103 篇研究论文。
← 返回归档列表94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Microsoft testing new Cloud Rebuild Windows 11 recovery feature
Microsoft has begun testing the Cloud Rebuild recovery feature in the latest Windows 11 Insider Preview builds released
What Changes When Your Software Supply Chain Includes AI Writing Your Code?
Software supply chain security was hard enough. Then AI joined the build pipeline. For five years, "software supply cha
Practical Mempool Privacy via One-time Setup Batched Threshold Encryption.
本文提出一种实用的一站式设置批处理阈值加密方案，旨在解决区块链mempool（交易内存池）中的隐私问题。在现有区块链系统中，交易在被打包进区块前通常以明文形式广播到mempool，这导致交易信息提前泄露，可能被利用进行抢先交易（front-
A Framework for Abusability Analysis: The Case of Passkeys in Interpersonal Threat Models.
该论文提出了一种全新的可滥用性分析（Abusability Analysis）框架，旨在系统性地评估安全机制在人际威胁模型（Interpersonal Threat Model）中的脆弱性。人际威胁模型关注的是攻击者与受害者之间存在亲密或社
BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning.
自监督学习在计算机视觉领域通过大量无标签图像或(图像，文本)对预训练图像编码器，然后将该编码器作为特征提取器，用于少量或零标注数据的下游分类任务。本文提出BadEncoder，是首个针对自监督学习的后门攻击方法。该方法将后门注入预训练图像编
"They're not that hard to mitigate": What Cryptographic Library Developers Think About Timing Attacks.
该论文通过半结构化访谈，调查了密码学库开发者对时序攻击（Timing Attacks）的认知、态度和实践。研究者访谈了来自Libsodium、BoringSSL、WolfSSL、OpenSSL、Curve25519等知名库的20位核心开发者
Bots can Snoop: Uncovering and Mitigating Privacy Risks of Bots in Group Chats.
本论文针对群组聊天平台中聊天机器人带来的隐私风险进行了深入研究。研究发现，聊天机器人往往能够访问超出其功能所需的消息，包括发送者身份和并非针对机器人的消息内容，这可能导致用户个人信息泄露、跨群组追踪以及针对性广告等问题。通过对实际对话数据集
NetCap: Data-Plane Capability-Based Defense Against Token Theft in Network Access.
该论文提出了一种名为 NETCAP 的新型防御机制，旨在防止攻击者利用窃取的令牌在企业网络环境中访问未授权资源。令牌在网络安全访问中至关重要，例如 JSON Web Token 和 OAuth 2.0，它们允许用户通过有效令牌访问授权资源，
To Shuffle or not to Shuffle: Auditing DP-SGD with Shuffling.
本文研究了差分隐私随机梯度下降（DP-SGD）算法中，使用洗牌（shuffling）替代传统的泊松子采样（Poisson subsampling）对隐私保证的影响。泊松子采样是DP-SGD的经典采样方法，每个训练迭代中每个样本以固定概率被选
BLACKSMITH: Scalable Rowhammering in the Frequency Domain.
该论文提出了一类新的非均匀 Rowhammer 访问模式，能够绕过 DRAM 内部未文档化、专有的目标行刷新（TRR）缓解机制，并在实际生产环境中成功触发比特翻转。作者首先指出所有已公开的 Rowhammer 访问模式都采用均匀锤击“攻击行
SoK: Can Synthetic Images Replace Real Data? A Survey of Utility and Privacy of Synthetic Image Generation.
本文是一篇系统化知识综述（SoK），旨在系统评估合成图像能否替代真实图像数据在机器学习中的应用，重点分析了合成图像的效用（utility）与隐私保护（privacy）之间的权衡。研究首先梳理了当前主流的合成图像生成方法，包括生成对抗网络（G
LEO-Range: Physical Layer Design for Secure Ranging with Low Earth Orbiting Satellites.
本论文提出了LEO-Range，一种针对低地球轨道（LEO）卫星的安全测距物理层设计。当前卫星测距系统易受距离欺骗攻击，攻击者可能通过延迟或提前信号来篡改距离测量结果。论文旨在通过物理层信号设计增强测距的安全性和完整性。LEO-Range可
Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion
### Summary Flask-Security-Too 5.8.0 and 5.8.1 mark a session as reauthentication-fresh after processing a WebAuthn ass
ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path
### Summary In add-on mode, the ha-mcp settings UI routes are mounted both under the MCP secret path **and** at the bar
rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path
Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3 ## Summary `plabayo/rama` co
Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp
### Am I affected? Check each condition. Users are affected when all of the first three hold. - Their application enab
CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware
CVE-2026-11405
Several versions of firmware released by Chinese network device manufacturer Tenda have been found to embed an undocumen