微软安全博客于2026年7月8日发布文章，介绍其安全未来倡议（SFI）如何以AI速度主动强化云服务。SFI整合了安全要求、威胁知识和运营框架，为定义良好防御的云服务提供指南。关键在于持续对在线服务进行实时评估，确保满足安全要求。文章强调将安全嵌入开发生命周期，利用AI自动化威胁检测和响应，并分享了微软在云安全方面的最佳实践。虽然标签包含Conti、APT等威胁相关词，但文章内容主要聚焦于防御策略和框架，未涉及具体攻击事件或漏洞。

该漏洞（CVE-2026-0283）影响 Palo Alto Networks 的 PAN-OS 操作系统中的 Large Scale VPN（LSVPN）组件。LSVPN 用于大规模 VPN 部署，通常为企业提供安全的远程访问。该漏洞为认证绕过漏洞，攻击者可能通过向受影响的设备发送特制请求，绕过 LSVPN 的认证机制，从而获得未授权访问权限。成功利用此漏洞可能导致攻击者访问本应受保护的 VPN 资源，或执行进一步的恶意操作。目前厂商已确认此漏洞存在，并发布了安全公告，但尚未公开具体的技术细节或受影响版本列表。建议用户立即关注官方更新，并优先修补该漏洞。

CVE-2026-0280 是 Palo Alto Networks PAN-OS 防火墙操作系统中存在的一个 IPv6 防火墙策略绕过漏洞。PAN-OS 是 Palo Alto 防火墙的核心操作系统，负责安全策略执行。该漏洞源于对 IPv6 流量处理逻辑存在缺陷，攻击者可以通过网络发送特制的 IPv6 数据包，绕过已配置的 IPv6 安全策略，从而可能实现未经授权的网络访问。虽然厂商将漏洞严重性评为低危，表明利用条件较为复杂或影响范围有限，但在依赖 IPv6 策略进行访问控制的环境中仍存在风险。具体受影响版本尚未在公告中明确，但建议用户关注官方安全通告，及时升级至修复版本。

CVE-2026-0284 是 Palo Alto Networks PAN-OS 操作系统在大规模 VPN（LSVPN）功能中存在的一个 XML 注入漏洞。该漏洞源于对用户提供的 XML 输入未进行充分净化，攻击者可以通过向 LSVPN 组件发送特制的 XML 请求触发注入。成功利用此漏洞可能导致攻击者读取 PAN-OS 上的敏感配置文件、修改 VPN 配置或获取其他系统信息。由于 PAN-OS 通常部署在网络安全边界，该漏洞可能暴露内部网络信息或影响 VPN 服务的正常运作。厂商已将该漏洞评级为中等严重程度，但具体受影响版本尚未公布。

本文揭示了一种利用NAT路由器中普遍存在的端口保持策略缺陷和反向路径验证不足的侧信道漏洞，使得处于同一Wi-Fi网络的攻击者能够推断并劫持受害者与外部服务器之间的TCP连接。具体而言，攻击者首先通过发送伪造的TCP包探测受害者是否建立了TCP连接，进而利用路由器禁用TCP窗口跟踪机制（多数路由器默认开启此机制）的漏洞，驱逐原有的NAT映射并建立新映射，从而拦截服务器发送至受害者的TCP包，并获取序列号和确认号。基于此，攻击者可以强制关闭连接、明文篡改流量或重定向服务器数据包至自身。作者测试了来自30个厂商的67款主流路由器，其中52款受影响；对93个真实Wi-Fi网络的测量显示，75个（81%）完全易受攻击。案例研究表明，攻击可在平均17.5秒内终止SSH连接（成功率87.4%），19.4秒内从FTP服务器下载私密文件（成功率82.6%），54.5秒内注入伪造HTTP响应（成功率76.1%）。已向所有受影响厂商负责任披露漏洞，并建议启用TCP窗口跟踪、强化NAT端口随机化等缓解措施。

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware or application logic that depends on the complete X-Forwarded-For chain, rate limiting, audit logging, o

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34.

FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta4, the HTTP-tool OpenAPI schema importer validates only the top-level URL before passing it to SwaggerParser.bundle, whose remote reference resolver fetches $ref URLs without FastGPT's internal-address guard and returns fetched content inline, allowing an authenticated team member to read internal services or cloud metadata.

Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind Server-Side Request Forgery (SSRF) via the Azure instance identity endpoint (`POST /api/v2/workspaceagents/azure-instance-identity`). An external attacker can force the Coder server to issue HTTP G

本文针对基于突变的模糊测试（fuzzing）中字节重要性量化不足的问题展开研究。现有方法通常关注输入字节与路径约束的关系，但忽略了并非所有与约束相关的字节都能发现新代码。作者通过Shapley值分析发现，不同字节位置对模糊测试性能的贡献存在差异，且这种差异在不同种子间具有一致性。基于这一观察，提出ShapFuzz，一种通过Shapley值指导字节选择和突变的模糊测试方案。具体地，ShapFuzz在每次输入测试时以低开销更新字节的Shapley值，并利用上下文多臂老虎机（Contextual Multi-Armed Bandit）在突变高Shapley值字节和低频率被选中的字节之间进行权衡。基于AFL++实现原型，并与10个最先进的模糊测试器（包括5个字节调度增强型模糊测试器和5个常用模糊测试器）进行对比。实验结果表明：与字节调度增强型模糊测试器相比，ShapFuzz在三组不同初始种子集上发现了更多的新边（edges）和暴露了更多的漏洞；与常用模糊测试器相比，ShapFuzz在MAGMA基准上比最佳对比模糊测试器多暴露20个漏洞，并发现6个额外的CVE。此外，在最新版本的程序中发现了11个新漏洞，其中3个已得到供应商确认。该研究为模糊测试中的字节重要性量化提供了新视角，有效提升了模糊测试的代码覆盖和漏洞发现能力。

## Impact In versions from 1.5.0 up to and including 3.0.0, any authenticated portal user could complete and tamper with another user's open task by submitting it on their behalf. The task submission endpoint accepted a task ID and a payload, but it never checked whether the task actually belonged to the user making the call. An attacker who held a valid login (a normal `burger` OAuth token) and

## Impact In versions up to and including 3.0.0, two parts of the GraphQL API returned data without checking whether the data belonged to the logged-in user: - **Document content.** A logged-in user could download the raw content of any document by its ID, regardless of who owned it. The resolver has lacked an authentication parameter since the initial commit of the project (2022-11-22) — so eve

## Summary The `unstable_redirect()` helper exported from `waku/router/server` (`packages/waku/src/router/define-router.tsx:156–161`) accepts an arbitrary string and reflects it unchanged into the HTTP `Location` response header with no URL validation, scheme restriction, or path-only enforcement. Any application that passes user-controlled input to this helper — the natural pattern documented in

## Summary Waku's RSC request dispatcher invokes server actions without validating the request's `Origin` (or `Sec-Fetch-Site`) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated `POST` to a registered server action endpoint using a CORS-safelisted content type (`text/plain`), which does not trigger a preflight. Any state-mutating server action that

## Summary Nuclio controller builds a `curl` invocation string for each cron trigger and stores it as the `args` of a Kubernetes CronJob container (`/bin/sh`, `-c`, ``). Two fields in the trigger specification flow into this string without adequate sanitization: - `event.headers` keys — interpolated verbatim inside double-quoted `--header` arguments (`lazy.go:2150`); any key containing `"` break

Ivanti Endpoint Manager Mobile代码注入漏洞

# Unauthenticated Cross-Origin Plugin Upload Leads to RCE (Joro ≤ v1.1.0) **Severity:** Critical **CVSS v3.1:** 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) **Affected versions:** Joro ≤ v1.1.0, proxy mode (default), Linux/macOS **Reporter:** cstover **Date:** 2026-05-27 --- ## Summary Joro's default proxy mode (in versions <= 1.1.0) exposes a local API on `127.0.0.1:9090` that performs no authen

Elastic Security Labs 发现一个名为 REF6045 的银行欺诈攻击集群，针对墨西哥的银行、金融科技公司、支付处理商和加密货币交易所用户。攻击者利用 ClickFix 社会工程学技术，通过虚假的 CAPTCHA 验证页面诱骗用户复制并运行恶意命令。该命令下载并执行一个名为 SCMBANKER 的 PowerShell 工具包，该工具包具备窃取凭证、拦截双因素认证等能力，旨在劫持银行账户。攻击活动未有已知 CVE 关联，也未归因于特定威胁组织。SCMBANKER 通过模块化设计实现持久化和数据窃取，目前尚无公开的完整技术分析。建议用户警惕不明来源的验证码页面，不要运行未经核实的命令，并启用多因素认证。企业应部署端点检测与响应系统，监控 PowerShell 异常执行行为。

CrowdStrike和Zscaler宣布合作，将持续身份安全能力集成到零信任访问架构中。该合作旨在结合CrowdStrike的端点检测与响应（EDR）能力和Zscaler的零信任网络访问（ZTNA）解决方案，实现基于用户身份、设备健康状态和实时威胁情报的动态访问控制。通过集成，企业可以在用户访问应用前持续验证身份和端点安全状态，防止凭据泄露或受损设备带来的横向移动风险。该合作不涉及具体的攻击事件或漏洞，而是聚焦于提升安全架构的主动防御能力。

CrowdStrike Announces Continuous Identity for AI Agents

Citrix NetScaler 内存泄漏(CVE-2025-5777)

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints wit

FastGPT is a knowledge-based AI application platform. Prior to 4.15.0, GET /api/core/ai/record/getRecord authenticates the caller but loads LLM request and response traces only by requestId without team scoping, allowing any authenticated user to read another team's prompts, retrieved RAG chunks, and completions if the requestId is known. This issue is fixed in version 4.15.0.

FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object keys are global within the bucket and carry the tenant id only as a path segment, an attacker can supply a

FastGPT is an open source AI knowledge base platform. From 4.14.17 to before 4.15.0-beta4, FastGPT allows an authenticated tenant user to call POST /api/core/dataset/collection/create/reTrainingCollection in a way that persists a server-owned datasetId value from another tenant. This creates mixed dataset objects and downstream dataset, collection, and training endpoints then make authorization de

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all LLM operations instance-wide to an attacker-controlled endpoint by exploiting the process-wide singleton

On July 8, 2026, we released versions 19.1.2, 19.0.4, 18.11.7 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to tak

CVE-2026-0277 Prisma Access Agent: Improper Certificate Validation on iOS (Severity: MEDIUM)

File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and then follows the symlink during file creation, allowing an authenticated user with Create and Modify permissions to create attacker-controlled files outside the user's scope. This issue is fixed in version 2.63.16.

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authorize state-changing actions using the workflow:read scope instead of the action-appropriate workflow:execute scope. On instances using Advanced Permissions (Enterprise/Cloud) with projects and viewer roles, an authenticated user with the project:viewer role can

n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malicious JavaScript URLs into OAuth2 credential Authorization URL fields. Attackers can craft malicious credentials and trick victims into clicking the OAuth authorization button, executing arbitrary scripts in their browser session with the victim's privileges.

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, Coder's subdomain-based workspace app proxy allowed the same-owner CORS check to be bypassed. When a workspace-name subdomain segment parsed as a UUID, the workspace was resolved by ID without confirming the URL's username matched the real owner, while the C

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app proxy resolves the target app from `httpapi.RequestHost()` which prefers the `X-Forwarded-Host` header over the real `Host` header. No middleware strips `X-Forwarded-Host` before routing and the header is not browser-forbidden so client-side

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting requests to the local server, with severity varying by browser depending on Private Network Access prote

Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, `azureidentity.Validate()` verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself. An attacker can embed a legitimate Azure certificate alongside arbitrary content e.g. `{"v

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollama_base_url parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via GET /api/v1/config/ or trigger SSRF attacks by setting ollama_base_url to internal addresses like cloud IMDS via PUT /api/v1/config/mem0/llm en

Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row that has not expired without checking whether the associated user is still enabled, allowing a disabled

Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port, with no authentication, no CSRF protection, and no Host header validation. A DNS rebinding attack allows a malicious webpage to reach this API from any browser and write arbitrary c

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the vict

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded default share link signature key, allowing an attacker who can obtain a passwordless share for a resource and user to use the known key link-pwd-fit2cloud to forge linkToken JWTs, bypass TokenFilter verification, and access backend resources as the share creator even if the origina

NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to workflow request nodes, custom request action buttons, or the AI plugin. Attackers can target loopback addresses, RFC-1918 private ranges, and cloud instance metadata endpoints to

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints wit

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all LLM operations instance-wide to an attacker-controlled endpoint by exploiting the process-wide singleton

An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiService.apk

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic. The security risk posed by this issue is minimized when the User-ID Terminal Server

### Summary RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\left`, `\sqrt{`, `^{`, etc, with **no maximum depth limit**. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With `panic = "abort"` (`Cargo.toml:48`), and because a Rust stack overflow is always a fatal `SIGABRT` regardless of pani

PLANET VDR-300NU ADSL Router - 未授权修改DNS

Acknowledgements

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network.

Use after free in Autofill in Google Chrome on Android prior to 150.0.7871.115 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.115 allowed a local attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obtain a CSRF token from the public getSystemVars endpoint and submit a fetchRemoteFile request with a so

GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.

Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to redirect users to arbitrary URLs or perform client-side SSRF by supplying unvalidated HTTP/HTTPS URLs to the file_fetch() function in the /gradio_api/file= endpoint. Attackers can craft a malicious FileData response targeting internal endpoints such as cloud metadata services to re

An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to execute arbitrary code via the USB debugging (ADB) and Android Debug Bridge components

A protection mechanism failure in the Code 27 Companion Hub allows an attacker with physical access to completely bypass kiosk restrictions via a factory reset

### Summary Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port (TCP 24282, hardcoded as `0x5EDA` in `constants.py`). The server has no authentication, no CSRF protection, and no Host header validation. A DNS rebinding attack allows a malicious webpage to reach this API from any browser and write arbitrary content to the agent's persistent memory stor

# `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes (`xlink:href`) **Reporter:** Guillem Lefait · **Date:** 2026-05-10 **Affected:** `lxml` ≤ 6.1.0 and `lxml_html_clean` ≤ 0.4.4 (latest stable) **Confirmed against:** lxml 6.1.0 + lxml_html_clean 0.4.4 on Python 3.13.5, 3.14.4, and 3.15.0a8 (libxml2 2.14.6 / 2.9.14 — bug is in pure-Python sanitizer logic,

> [ Click here to jump to the Simplified Chinese version (点击跳转到简体中文版本)](#goploy-系统任意文件读取) # Goploy System Arbitrary File Read Vulnerability ## Basic Information - **Vulnerability Name**: Goploy Endpoints Arbitrary File Read via Path Traversal - **Vulnerability Type**: Path Traversal (CWE-22) / Arbitrary File Read - **Affected Product**: Goploy - **Severity Level**: High (CVSS V3 7.7) - **Known Af

### Summary `Project.AddFile`, `Project.EditFile`, `Project.RemoveFile`, and `Project.Edit` in `cmd/server/api/project/handler.go` accept a project or project-file row id from the JSON body and act on it without checking that the project belongs to the caller's namespace. The corresponding `model.ProjectFile.GetData` and `model.Project.GetData` queries filter only by row id. A user holding the `m

### Summary `aiosmtplib`'s `SMTP.mail()`, `SMTP.rcpt()`, `SMTP.vrfy()` and `SMTP.expn()` send the caller-supplied email address to the server without rejecting embedded CR/LF (`\r\n`) bytes. An address that contains a CR/LF is written verbatim onto the SMTP control connection, so the bytes after the CRLF are framed by the server as one or more **additional, standalone SMTP command lines**. A call

### Summary The public parser entrypoint `ratex_parser::parse(&str)` panics on the **9-byte** input `\verbéxé` (i.e. `\verb` followed by the non-ASCII delimiter `é`). When handling a `\verb` command, the parser slices the verbatim argument with **byte** indices (`arg[1..arg.len() - 1]`); if the delimiter character is multibyte UTF-8, index `1` lands inside that character and Rust panics with *“by

Firewall for AI

Elastic Security Labs tracks REF6045, an active operator-assisted banking fraud operation targeting customers of Mexican banks, fintech, payment processors, and cryptocurrency exchanges.

Chinese hackers tracked as 'UAT-7810' are actively evolving their malware to expand their Operational Relay Box (ORB) network by compromising internet-facing networking devices, primarily unpatched Ruckus routers. [...]

A hidden authentication backdoor has been found in multiple Tenda router firmware versions, potentially allowing an attacker to gain administrative access to the device's web management panel. [...]

Cisco says the threat actor behind the LapDogs campaign has expanded its SOHO router malware toolkit with LongLeash, DogLeash, and JarLeash backdoors. The post China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors appeared first on SecurityWeek.

Firefox browsers

Sign in to Cloud

Sign Up for Free Cloud Tier

iOS 26.4.2 and iPadOS 26.4.2

iOS 18.7.8 and iPadOS 18.7.8

iOS 18.7.7 and iPadOS 18.7.7

iOS 26.4 and iPadOS 26.4

Background Security Improvements for iOS, iPadOS, and macOS

iOS 16.7.15 and iPadOS 16.7.15

iOS 15.8.7 and iPadOS 15.8.7

iOS 26.3 and iPadOS 26.3

iOS 18.7.5 and iPadOS 18.7.5

iOS 26.2 and iPadOS 26.2

iOS 18.7.3 and iPadOS 18.7.3

Compressor 4.11.1

iOS 18.7.2 and iPadOS 18.7.2

iOS 26.1 and iPadOS 26.1

iOS 26.0.1 and iPadOS 26.0.1

iOS 18.7.1 and iPadOS 18.7.1

Android Code Search

Android Devices

Secure an Android device

Android 16 QPR2

Mobile network security

iOS 26.5 and iPadOS 26.5

iOS 18.7.9 and iPadOS 18.7.9

iOS 16.7.16 and iPadOS 16.7.16

iOS 15.8.8 and iPadOS 15.8.8

MFSA 2026-49Security Vulnerabilities fixed in Firefox for iOS 151.0

MFSA 2026-52Security Vulnerabilities fixed in Firefox for iOS 151.1

MFSA 2026-53Security Vulnerabilities fixed in Firefox for iOS 151.2

MFSA 2026-55Security Vulnerabilities fixed in Focus for iOS / Klar 151.3.1

MFSA 2026-56Security Vulnerabilities fixed in Firefox for iOS 152.0

【Cloud Mate】产品退市及停止服务公告

iOS 26.5.2 and iPadOS 26.5.2

MFSA 2026-65Security Vulnerabilities fixed in Firefox for iOS 152.3

 The ChromeOS Dev channel is being updated to OS version 16733.12.0 (Browser version 151.0.7922.14) for most ChromeOS devices.If you find new issues, please let us know one of the following ways:File a bugVisit our ChromeOS communitiesGeneral: Chromebook Help CommunityBeta Specific: ChromeOS Beta Help CommunityReport an issue or send feedback on ChromeInterested in switching channels? Find out how

【大模型服务平台 TokenHub】&【智能体开发平台】& 【云开发 CloudBase】 关于腾讯云 MiniMax-M2.5 模型下线及切换升级的通知

  Hi, everyone! We've just released Chrome 150 (150.0.7871.114) for Android. It'll become available on Google Play over the next few days. This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.Android releases contain the same security fixes as their corresponding Desktop rele

Hi everyone! We've just released Chrome Stable 150 (150.0.7871.113) for iOS; it'll become available on App Store in the next few hours.This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.Chrome Release TeamGoogle Chrome

PAN-SA-2026-0010 Chromium and Prisma Browser: Monthly Vulnerability Update (July 2026) (Severity: HIGH)

本文提出了一种针对大型语言模型（LLM）智能体持久记忆的新型攻击方法——伪造放大推理记忆攻击（FARMA）。传统的记忆中毒攻击主要污染事实性知识，而FARMA则针对智能体的推理历史进行注入。攻击者通过插入含有规避性语言的伪造推理痕迹，绕过基于关键词的防御；再利用自我引用强化机制，使多条伪造条目相互印证，从而击败基于共识的防御。为应对FARMA，作者提出了SENTINEL分层防御管道，其核心组件是推理守卫，通过五种加权信号对候选条目进行结构性分析以检测伪造。实验在多个智能体和不同LLM模型上进行，50次试验表明：FARMA在基线条件下攻击成功率高达100%，并能绕过关键词过滤器和A-MemGuard等现有防御；而SENTINEL可将攻击成功率降至0%，且在326条良性智能体跟踪记录中未出现误报。研究揭示了保护智能体推理历史完整性的迫切需求。

该论文研究多模态大语言模型（MLLMs）中机器遗忘（MMU）的鲁棒性问题。MLLMs在跨模态任务中表现优异，但可能无意中编码隐私敏感信息，引发隐私或版权侵犯担忧。MMU作为一种缓解方法被提出，旨在强制模型遗忘私有信息。然而，当模型发布并被恶意用户访问时，此类遗忘方法的鲁棒性尚未被充分挖掘。论文提出一种名为“提示优化参数抖动”（POPS）的新型对抗策略，旨在从MLLMs中恢复本应被遗忘的多模态知识。该方法通过提示后缀优化诱导受害MLLMs生成潜在的私有示例，然后利用这些合成输出对模型进行微调，使其泄露真实的私有信息。在多个MMU基准上的实验表明，现有MMU算法存在显著弱点。POPS甚至能在遗忘模型上近乎完全恢复本应被擦除的敏感信息，暴露了基于MMU的隐私保护的基本脆弱性。研究揭示了当前机器遗忘技术的不安全性，对隐私保护机制提出严峻挑战。

该论文提出ECO/CPO-DAG，一个针对对抗性供应链的领域特定问责协议，将矛盾检测形式化为一个补充性的验证层，而非共识或真理建立机制。参与者将签名的事件声明对象（ECO）发布到一个因果有序、仅追加的有向无环图（DAG）中，其边编码了“发生在之前”的关系。当两个关于同一主体的声明违反域约束时，任何观察者都可以编译一个自验证的矛盾证明对象（CPO），该对象包含两个签名声明和违反的规则，在公开验证后触发对确定性责任方的经济惩罚。论文将约束映射到GS1 EPCIS 2.0事件语义（空间唯一性、时间单调性、数量守恒、质量单调性、监管有效性），使检测目标针对实际有意义的矛盾。通过承诺方案和零知识矛盾证明的可选机制，允许各方在挑战前隐藏声明内容。论文进行了分析处理：给出独立观察者检测模型1-(1-p_min)^h，在k方共谋下的威慑条件S>g(1-p)/(kp)，以及在假定条件下每位参与者每年约1 GB的存储估计。协议边界明确：它可检测可证明的矛盾，而非一致谎言；从不自相矛盾的参与方对它不可见，因此该层补充而非替代源验证和预言机聚合。单机参考实现验证了检测模型，预测覆盖率带在每一个观察者数量上都与测量的95%置信区间重叠，并记录零误报；完全零知识CPO、多方传播和自适应对抗规避仍处于分析阶段。论文适合分布式系统、供应链安全和问责机制研究人员阅读。

本文提出了面向LLM智能体的上下文到执行完整性（Context-to-Execution Integrity, CXI）系统。LLM智能体在执行任务时，通常需要读取攻击者可写入的上下文，并调用工具。现有系统缺乏对工具调用中敏感字段（protected sink fields）、有效载荷解释（sink-interpreted payloads）以及调用事件（invocation event）的独立权限检查，导致安全风险。CXI是一个执行边界系统，设计了四个核心机制：1）策略标记受保护字段；2）类型化释放（typed releases）将经过验证的窄范围值从可写上下文传输到特定目标；3）不透明数据槽（opaque data slots）以数据形式保留证据；4）确定性门控（deterministic gate）仅当字段权限、精确效果授权和调用权限都绑定到同一操作清单时才允许调用。CXI在多个基准上进行了评估：AgentDojo覆盖720个实时回合和1739次LLM调用；代码智能体基准覆盖400个仓库回合，采用精确效果授权和租约绑定执行，实现了231次安全任务完成，零字段、效果或调用逃逸。评估还包括开放权重字段投影运行、清单账本故障、提案压力控制以及托管/API兼容性测试。结果表明CXI能够有效防止工具执行中的权限提升和未授权操作，为LLM智能体安全提供了系统级的完整性保障。

本文针对自适应隐写术中代价函数设计通常依赖人工调参或深度学习黑盒的问题，提出了一种基于检索增强生成（RAG）增强的大语言模型（LLM）的自动代码级空间图像隐写代价函数生成系统。系统核心是自进化RAG（SE-RAG）模块，其中代码语义签名（CSS）将过程代码转化为对齐的查询，从静态文献和动态经验知识库中检索显式领域知识，引导LLM生成符合数学约束的代价函数。反馈机制持续将成功优化策略回注到动态知识库，实现闭环进化。在BOSSBase和BOWS2数据集上的实验表明，该系统在隐写安全性上一致优于现有自动设计方法，平均代码执行率提升46.3%，搜索成本降低26.1%。工作表明LLM与领域知识结合在自动隐写算法生成中的有效性和潜力。

网络威胁情报（CTI）报告通常是非结构化、异构且包含噪声的，这限制了它们在自动化分析与推理中的直接可用性。网络安全知识图谱（CSKG）能够以结构化形式表示攻击实体、行动和关系，但从自由文本CTI中构建此类图谱仍然是一个挑战。现有方法通常依赖单一的大型语言模型（LLM）进行端到端的信息提取和补全，这会导致高昂的成本、有限的可控性和不稳定的性能。本文提出了TACTIC-KG，一个基于智能体的CSKG构建框架，它将任务分解为多个模块化的、专门的LLM智能体，分别负责信息提取、类型标注、验证和精炼。通过使用轻量级模型（3B-8B参数），TACTIC-KG在提升稳定性、召回率和图一致性的同时降低了部署成本。该框架实现了并评估了TACTIC-KG，与最新的先进系统进行了对比。在人工标注的CTI报告上的实验表明，智能体专业化在提取F1分数、类型标注准确性和结构图相似性方面始终优于更大的单体语境学习（ICL）基线方法。这项工作为利用小型专家智能体团队构建高质量CTI知识图谱提供了可扩展且经济高效的解决方案。

该漏洞（CVE-2026-47646）存在于 Microsoft Dynamics 365 Customer Voice 中，属于跨站脚本（XSS）类型。由于网页生成过程中对用户输入进行了不恰当的清理，未授权的远程攻击者能够通过网络向目标用户发送恶意脚本，从而实施欺骗攻击。CVSS 3.1 评分为 9.3（严重），攻击向量为网络，攻击复杂度低，无需特权，但需要用户交互。该漏洞影响机密性和完整性，可能导致攻击者窃取用户会话、篡改页面内容或进行钓鱼欺诈。目前微软尚未发布补丁信息，但建议用户密切关注官方安全更新，并在网络层面限制对 Dynamics 365 Customer Voice 服务的访问权限，以降低风险。由于该漏洞评分极高且易于利用，应优先处理。

Cloud & Application Security

From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise

Next-Gen Identity Security

CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security

CrowdStrike Expands Identity Leadership with OpenID and IDPro

cloud architecture assessment

ransomware and multifaceted extortion defense

Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand

The Identity Problem Hiding in AI Agent Deployments

94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey

Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud

Specops Software explains how AI is making service desk impersonation attacks more convincing, personalized, and scalable, along with practical steps organizations can take to strengthen onboarding and identity verification. [...]

该论文对文件劫持漏洞（File Hijacking Vulnerabilities, FHVulns）进行了系统性研究。文件劫持漏洞是一类通过操纵文件内容或路径来突破安全边界的漏洞，但此前缺乏对其底层机制的全面理解。作者收集了2020年1月至2022年10月期间268个详细记录的FHVuln CVE条目，进行了深入的实证研究，揭示了FHVuln的起源和触发机制，并指出现有检测技术忽略了大部分此类漏洞，因此预计软件中存在大量零日FHVuln。为了弥补这一缺口，作者开发了动态分析工具JERRY，该工具通过在程序执行期间模拟劫持动作，能够有效在运行时检测FHVuln。JERRY被应用于微软、谷歌、Adobe、英特尔等厂商的438个流行软件程序，共发现339个零日FHVuln。所有发现的漏洞均已向相应厂商报告，截至目前，84个漏洞已得到确认或修复，获得了51个CVE编号和83,400美元漏洞赏金。论文的核心贡献包括：首次对FHVuln进行大规模实证研究，揭示了其分布和触发模式；提出了一种新的动态检测方法JERRY，其检测能力显著优于现有工具；通过实际应用证明了该方法在发现真实世界漏洞方面的有效性。适合安全研究人员、漏洞分析工程师以及软件安全开发人员阅读。

分片是区块链扩展的关键技术，通过将网络划分为多个分片并行处理交易，同时依靠片内和跨片共识协议保证一致性。然而，本文发现分片系统存在严重的交易顺序操纵漏洞：片内共识与跨片共识协调期间，攻击者可利用“最终化公平性”（finalization fairness）缺失实施前置运行攻击（front-running attack）。即使受害者的交易已被公平的片内共识处理并上链，攻击者仍能通过操纵跨片交易的最终化顺序，改变全局执行顺序，从而获利。为应对此问题，作者提出Haechi协议——一个抗前置运行攻击的跨片共识方案。Haechi在交易处理与执行之间引入排序阶段，保证交易的执行顺序与处理顺序一致，实现最终化公平性。针对不同分片共识速度差异，Haechi内嵌最终化公平算法，以最小性能损失达成全局公平顺序，并提供强一致性，提升冲突交易处理的并行度。作者使用Tendermint实现了Haechi，并在亚马逊云地理分布式环境进行实验。结果表明，与现有跨片共识协议相比，Haechi能有效阻止前置运行攻击，且性能开销极小。该工作为分片区块链的安全性和实际部署提供了重要参考。

本文提出了一种名为AAKA（匿名认证与密钥协商）的方案，旨在解决移动网络中用户被运营商（MNO）跟踪的隐私问题。当前，移动网络运营商收集用户的地理位置和时间戳数据，并可将其出售给第三方，导致隐私泄露。AAKA利用匿名凭证技术，设计了一套新的移动认证协议，使得合法用户能够在不泄露真实身份的情况下匿名接入网络。该方案保证了用户凭据的完整性，防止伪造，并且同一用户在不同时间建立的连接无法被关联，从而避免被追踪。同时，在合法干预（例如执法机构授权协作）下，AAKA仍然能够识别出特定用户，兼顾了隐私与合规需求。方案兼容3GPP定义的最新蜂窝网络架构和SIM卡标准，满足UE认证与密钥协商的基本安全要求。安全分析证明了方案的有效性，性能评估显示在受限的宿主设备（配备标准蜂窝SIM）上生成凭证展示约需52毫秒，表明其实用性。该研究适合移动网络安全研究人员、隐私保护技术开发者以及运营商安全策略制定者阅读。

Affected versions of `oneringbuf` exposed the obsolete `IntoRef::into_ref` method through the public `IntoRef` trait. For heap-backed ring buffers, this method returned a `DroppableRef` handle. `DroppableRef` stored an owning raw pointer created from `Box::into_raw`. Its `Clone` implementation copied this raw pointer without incrementing the internal `alive_iters` counter. Internally, this clone

### Summary Flask-Security-Too 5.8.0 and 5.8.1 mark a session as reauthentication-fresh after processing a WebAuthn assertion whose proven credential belongs to a different user than the currently authenticated session user. The check that `GHSA-97r5-pg8x-p63p` added on the OAuth reauthentication path (`user.email == current_user.email`) is missing on the WebAuthn reauthentication path. An attack

### Summary In add-on mode, the ha-mcp settings UI routes are mounted both under the MCP secret path **and** at the bare root of the published port (`:9583`), so Home Assistant ingress can serve the "Open Web UI" button. The root-mounted routes perform no authentication — no secret, no `Origin` check, no CSRF token — so any client that can reach `:9583` without the MCP secret can invoke them. ##

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3 ## Summary `plabayo/rama` contains a stored/reflected cross-site scripting issue in the `ServeDir` HTML directory listing feature. When `ServeDir` is configured with `DirectoryServeMode::HtmlFileList`, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an

无人机开源飞控 PX4-Autopilot堆栈溢出漏洞 CVE-2025-15150

MongoDB内存泄漏 CVE-2025-14847(MongoBleed)

1Panel 代理证书验证绕过导致任意命令执行漏洞(CVE-2025-54424)

ModelContext Inspector 未授权访问漏洞(CVE-2025-49596)

llamaindex SQL 注入漏洞(CVE-2025-1750)

Screen 本地权限提升漏洞(CVE-2025-23395)

Zabbix认证后SQL注入漏洞(CVE-2024-42327)

ProjectSend认证绕过漏洞(CVE-2024-11680)

PyTorch库RPC框架反序列化RCE漏洞(CVE-2024-48063)

Grafana认证后DuckDB-SQL注入漏洞(CVE-2024-9264)

SPIP BigUp Unauthenticated RCE(CVE-2024-8517)

Rejetto HFS 远程命令执行漏洞(CVE-2024-39943)

Apache HugeGraph-Server Command Execution In Gremlin（CVE-2024-27348）

Zabbix 后台延时注入(CVE-2024-22120)

CrushFTP 认证绕过漏洞（CVE-2024-4040）

Alert for CVE-2026-21992

Alert for CVE-2025-61884

Alert for CVE-2025-61882

Alert for CVE-2024-21287

Alert for CVE-2022-21500

Alert for CVE-2021-44228

Linux 内核提权 CVE-2026-31431(copy-fail)

Alert for CVE-2026-35273

【安全通告】Gitea act_runner 容器逃逸漏洞风险通告（CVE-2026-58053）

【安全通告】Linux Kernel "GhostLock" 本地权限提升漏洞风险通告（CVE-2026-43499）

The Stable channel has been updated to 150.0.7871.114/.115 for Windows and Mac and 150.0.7871.114 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the LogSecurity Fixes and RewardsNote: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug ex

CVE-2026-0279 PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities (Severity: LOW)

CVE-2026-0282 PAN-OS: File Deletion Vulnerability in Management Web Interface (Severity: LOW)

CVE-2026-0281 PAN-OS: Information Disclosure Vulnerability in Management Web Interface (Severity: LOW)

CVE-2026-0278 Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilities on Windows (Severity: MEDIUM)

CVE-2026-0288 PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent (Severity: HIGH)

CVE-2026-0285 PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface (Severity: MEDIUM)

CVE-2026-0286 PAN-OS: Authenticated Command Injection in CLI (Severity: MEDIUM)

CVE-2026-0276 Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability (Severity: LOW)

CVE-2026-0287 PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing (Severity: MEDIUM)

本文提出了一种名为zk-ScalHard的硬件根植隐私保护认证协议，旨在解决下一代面向区域的软件定义汽车（SDV）中OTA更新的安全与可扩展性问题。随着汽车电子控制单元（ECU）数量激增，传统的基于公钥基础设施（PKI）的认证方案（如Uptane和AUTOSAR Adaptive）在带宽瓶颈、隐私泄露和中心化架构方面面临挑战。zk-ScalHard通过引入去中心化的层次化信任提升模型，结合硅物理不可克隆函数（PUF）和两种新型零知识证明（ZKP）电路：区域身份与完整性（ZIDI）电路和高性能计算聚合（HPCA）电路，实现了可扩展的隐私保护认证。PUF提供硬件级信任根，确保设备唯一性和防篡改；ZIDI电路验证ECU的身份和软件完整性，HPCA电路通过多方计算（MPC）和递归聚合实现去中心化验证。该协议保证了100%的车辆级数据主权，符合GDPR要求。实验表明，与Uptane相比，zk-ScalHard实现了常数级O(1)的通信和验证复杂度，认证带宽减少99.2%，时间攻击面减少99.9%。该工作为未来区域化SDV提供了可扩展、安全且合规的OTA更新认证框架，适合汽车安全研究人员、系统架构师及标准制定者参考。

该论文提出了一种名为DiRLU的轻量级强化学习框架，用于物联网（IoT）设备上的僵尸网络检测，同时通过选择性遗忘敏感或过时特征来保护隐私。现有基于人工智能的解决方案存在两个主要局限：一是模型过于沉重，难以部署在资源受限的IoT设备上；二是缺乏遗忘机制，需要完全重新训练才能移除特定特征。DiRLU通过知识蒸馏将教师模型（使用A2C强化学习算法训练）的知识迁移到轻量级学生模型中，两个模型均基于A2C训练。后置遗忘机制通过调整权重来移除目标特征，且可逆性实验显示恢复特征后性能损失极小。与许多仅使用5% BoT-IoT数据集的基准模型不同，本研究利用了25%的数据，从而构建了强大的教师模型。学生模型达到了99.60%的准确率和99.80%的F1分数。为增强可解释性，集成了LIME（可解释AI方法），帮助理解模型决策和关键特征。DiRLU的浮点运算数（FLOPS）仅为2370，比现有最优模型高效约3.87倍，适合边缘部署。此外，该框架符合GDPR的“被遗忘权”要求，提供了实用且可扩展的IoT安全解决方案。

该论文提出了一种名为嵌入式区块链基础设施管理（eBIM）的概念，旨在解决传统区块链即服务（BaaS）模型中因第三方服务商托管基础设施而导致的信任丧失、灵活性降低和数据主权丧失问题。作者借鉴eSIM（嵌入式SIM卡）的发展思路，利用RISC-V开放、模块化、可扩展的指令集架构，设计了一种软硬件协同的区块链基础设施管理框架。eBIM将区块链的关键功能（如密码加速、可信执行环境、零知识虚拟机、智能合约执行引擎）集成到RISC-V硬件中，从而在底层实现可信计算和去中心化信任。论文通过回顾相关技术与研究，系统回答了三个核心问题：什么是eBIM？eBIM如何工作？eBIM能做什么？文章为研究人员、硬件架构师和协议设计者提供了基础参考，并指出了未来研究方向，包括进一步优化硬件加速器、增强安全性能以及探索在分布式物理基础设施管理中的应用。该工作属于综述性质，但提出了新颖的eBIM概念，结合了RISC-V开放硬件与区块链信任机制，为构建更自主可控、安全可信的区块链基础设施提供了新思路。

本文首次系统评估了在差分隐私（DP）合成表格数据上应用公平性干预的效果。机器学习模型在高风险场景（如信贷、招聘）中广泛部署，对隐私和公平性提出了双重需求。DP已成为隐私保护的事实标准，但现有研究表明DP可能放大不同人口群体间的差距，而公平性干预在DP约束下是否仍然有效尚不明确。为此，作者构建了一个基准测试，以最先进的边际统计DP合成器AIM为核心，在四个公开数据集（如Adult、COMPAS等）上，覆盖多种群体公平指标（如人口平准性、均等化几率等），并在广泛的隐私预算（ε=0.1至10）下，评估了三种干预策略：预处理（重加权）、处理中（对抗性去偏）和后处理（基于阈值的调整）。实验比较了四种管道配置：原始数据训练（基线）、仅DP合成数据训练、仅原始数据应用公平机制、以及DP合成数据与公平机制结合。结果表明：单独使用DP会显著降低模型效用和公平性（例如，导致更差的准确率与更严重的不平等）；但公平干预可以部分恢复公平性，其中后处理方法（如调整分类阈值）在不同隐私预算和合成器之间展现出最稳定的公平-效用权衡，能在保持竞争性效用的同时大幅提升公平性。相比之下，预处理和处理中方法受DP噪声影响较大，效果不稳定。该研究首次量化了隐私、公平和效用三者的权衡关系，并提供了全面的实验基准。所有代码、数据和实验资产均已开源，以支持后续研究。

本文提出了Crossroads，一个针对链抽象资产（chain-abstracted assets）的智能合约层。Crossroads的核心思想是将来自几乎任何区块链的资产在单一后端区块链上表示为ERC-20代币，从而使得这些资产能够在一个统一的平台上参与基于智能合约的交换、借贷或隐私应用。虽然Crossroads提供了跨链桥接功能，但这只是其通用链抽象模型中的一项服务。Crossroads依赖密钥抵押机制：一个阈值签名委员会持有加密密钥，控制每条集成链上的资产，仅根据后端区块链上智能合约的授权签署交易。资产转移具有费用效率，因为所有权变更记录在后端区块链上，用户可自行设定提现交易费。Crossroads支持使用可插拔预言机（如zkBridge、基于TEE、混合设计）实现无许可、模块化的新链集成。资产存入Crossroads时享有强链特异性最终性保证，最小化重组攻击风险。但与现有桥接不同，Crossroads中的第三方智能合约可以在最终确认前提供快速的乐观资金访问。作者证明了Crossroads满足可靠性：在签名委员会成员诚实的前提下，任何用户都可以单方面生成提现交易，将其净余额转移到某条集成链上的账户。他们还在比特币、以太坊和Solana上实现了概念验证，并列举了Crossroads启用的多种应用，包括通用钱包、跨链质押和借贷、隐私保护支付以及公共区块链资产的私密管理。

本研究聚焦于大型语言模型（LLM）在辅助软件安全分析中的安全状态影响。LLM辅助的软件安全分析处于一个微妙的边界：用于合法代码审查、分类和修复的漏洞分析术语可能与滥用场景下的术语高度相似。现有安全评估常比较不同模型家族，混淆了安全行为与架构、规模、训练数据等差异。为隔离这一因素，论文研究同一谱系模型的安全状态：即拒绝行为是否保持完整（Aligned）或已被移除（Abliterated）。作者选取Gemma和Qwen两个模型家族的对齐指令微调版本及其公开发布的拒绝消融变体，在漏洞检测、CWE归因、脆弱代码行定位、根因定位及可执行补丁验证五项任务上比较Aligned与Abliterated状态的表现。此外，实验将提示措辞作为受控维度：提示从中性代码审查语言开始，逐步加入授权上下文并增加网络安全术语密度。在基于Gemma的Java/Vul4J修复验证研究中，Abliterated在早期验证率上显著优于Aligned：修补程序被认为可用、成功应用和成功编译的比例分别为67.8%、65.0%和32.8%，而Aligned对应仅为29.9%、24.9%和9.0%。在Qwen对中，Abliterated提升了定位性能，行级F1从2.08%升至3.91%，Top-1准确率从4.10%升至6.95%。结果表明，评估基于LLM的安全助手应同时衡量模型是否响应、正确响应是否可用以及输出在整个工程流程中是否可操作。该研究为安全从业者设计LLM辅助工具提供了重要参考。

该论文报告了一个基于量子密钥分发（QKD）的VPN原型系统，它通过ETSI GS QKD 014标准化API获取QKD生成的密钥，并使用AES-256-GCM算法对IP流量进行实时加密。系统设计上，VPN在数据包中内联携带密钥标识符，本地密钥管理实体（KME）根据标识符提供匹配密钥。研究首先在受控的KME模拟器中验证了密钥传递流程的正确性，随后将两个Jetson Xavier NX边缘计算设备连接至LuxQuanta NOVA QKD平台进行真实环境测试。实验成功实现了连续8小时的双向实时音视频传输，验证了标准密钥传递接口将经典VPN应用与QKD基础设施集成的可行性。该工作解决了QKD密钥与现有VPN协议栈的兼容性问题，展示了在安全关键通信场景中利用量子安全密钥增强加密强度的实际路径。主要贡献包括：1）实现了符合ETSI标准的QKD密钥交付接口；2）设计了轻量级的密钥标识符带外传输机制；3）通过长时间连续测试证明了系统的稳定性和实用性。本文适合对量子安全网络、VPN密钥管理及实用化QKD系统感兴趣的网络安全研究人员和工程人员阅读。

本文针对AI Agent在工具调用过程中因依赖不可信文本而面临的安全性问题展开研究。AI Agent通常基于LLM的输出发起工具调用，但攻击者可通过控制上下文（如提示注入）伪装成合法用户执行非授权操作。作者首先评估了15个当代语言模型在8种源自真实Agent事件的攻击场景下的拒绝率，结果显示拒绝率从100%到38%不等，最昂贵的模型仅拒绝了一半的攻击，尽管价格相差20倍。为解决此问题，提出了aiAuthZ——一种将安全决策从Agent主机移出的授权网关。在每次工具调用执行前，网关通过基于单次使用nonce和时间窗口的HMAC-SHA256签名验证调用者身份，并评估基于角色和参数级别的访问策略，该策略Agent既无法读取也无法修改。所有决策记录在SHA-256哈希链审计日志中，每个被接受的报文生成HMAC认证的QR收据，在8种传输通道中平均验证率达94%，且25次错误密钥尝试下零伪造。集成网关后，全部15个模型的残余攻击成功率为0%，决策延迟增加不超过0.03毫秒。在AgentDojo银行基准套件中，aiAuthZ阻止了Agent发出的所有7个攻击导向的工具调用，仅误拦截了一次合法首次付款，而基线方案允许两次注入成功。在来自同一事件语料库的9个案例研究中，aiAuthZ阻止了9/9的攻击，而基于无身份绑定策略的基线只阻止了4/9。本文的核心贡献在于：不阻止模型被欺骗，但阻止被欺骗模型超越已验证用户权限执行工具调用，并通过开源实现（GitHub链接）提供了可部署的解决方案。

本文聚焦于生成式人工智能工作流中的特权与保密性问题。作者指出，生成式AI系统通过三种不同方式存储和处理客户数据：训练与记忆中的模型参数、实时会话中的上下文窗口以及用于检索增强生成（RAG）的知识数据库。每种模式都会对保密性和法律职业特权产生不同且往往违反直觉的风险，需要特定的治理响应。论文借鉴了首批涉及特权与生成式AI的英美判例（英国Munir v Secretary of State for the Home Department案和美国United States v Heppner案），结合传统特权权威以及最新计算机科学研究，以从业者可理解的语言解释了三种数据存储与处理模式，并分析了各自的法律后果。随后，论文将分析置于英格兰和威尔士律师监管框架以及普通专业过失原则中，论证有效信息治理标准（以及衡量过失与不当行为的基准）正在发生变化。尽管主要面向受SRA监管的从业者，但数据治理分析框架可扩展到任何依赖可证明保密性来保护特权或职业秘密的司法管辖区。最终目标是帮助法律服务专业人士理解生成式AI系统中显著的数据泄露风险，从而促进在客户数据及其他敏感材料上更负责任地部署生成式AI。

该论文聚焦于智能电网中基于IEC 61850协议的GOOSE消息面临的虚假数据注入（FDI）攻击检测问题。智能电网依赖通信网络和智能电子设备实现可靠的自动运行，但这也使其容易遭受网络攻击，如消息篡改、虚假命令注入和拒绝服务攻击。其中FDI攻击尤为危险，攻击者通过删除、修改或添加数据包来操纵通信消息。在IEC 61850变电站中，GOOSE消息承载着时间关键的继电保护和控制信息，因此对FDI的检测至关重要。然而，由于恶意数据包在形式上与正常通信极为相似，且现有检测方法大多依赖人工设计的协议特征，需要大量专业知识且泛化能力有限，导致检测困难。本文提出FDIFormer，一种无需特征工程的FDI攻击检测框架。该方法将GOOSE数据包序列转化为结构化的文本窗口，以捕获通信行为，然后利用预训练Transformer模型（如GraphCodeBERT）直接学习攻击相关模式。在QUT-ZSS-2023-GOOSE数据集上采用场景级三折交叉验证评估，GraphCodeBERT达到了0.595±0.122的MCC（马修斯相关系数），与最强的手工特征基线XGBoost（MCC=0.604±0.121）相当，且比TF-IDF基线提高了0.133。结果表明，预训练Transformer表示在不依赖手工协议特征的情况下，能有效检测IEC 61850 GOOSE通信中的FDI攻击。该研究为智能电网安全提供了一种新的思路，尤其适用于无法获取专家知识或协议频繁更新的场景。

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause pypdf to spend long runtimes recovering broken cross-reference table entries. This issue is fixed in version 6.14.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0.

HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.

Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() method fails to sanitize command substitution sequences, allowing authenticated attackers to inject arbitrary shell commands through user-controlled filenames. Attackers can supply malicious filenames containing unescaped command substitution p

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise RecursionError, and crash the rendering request. This issue is fixed in version 3.3.0.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/block_parser.py and the ref_links environment dictionary handling, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files are processed using md.read(). This issue is fixed in version 3.3.0.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:, and res: to reach rendered href and src attributes and potentially execute script in affected user a

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.

U-Boot through 2026.04-rc3 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing

U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() valida

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safe_url() does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version 3.3.0.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable toc_N values without slugifying the heading text, allowing attacker-controlled id="toc_N" content to collide with generated anchors and redirect same-page navigation, CSS selectors, or JavaScript handlers. This issue is fixed in version 3.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from each possible start position, allowing denial of service through CPU exhaustion. This issue is fixed in v

U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet with a mismatched IP total length and TCP data offset field. Attackers can send a packet with an IP total length of 40 bytes and a TCP data offset claiming 60 byt

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. Thi

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using Jaeger

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be p

OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-trust access to configured input paths can expose sensitive data and credentials that should remain within trusted boundaries.

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.

Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them, because SetCookie::matchesDomain() applied ordinary suffix matching to domains such as 192.168.0.1, [::1], or 1, allowing cross-host cookie disclosure, cookie injection, or session fixation. This issue is fixed in version 7

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abor

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft ma

AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to.

Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7.