Why we cannot wait for better post-quantum signature algorithms
NIST is advancing nine new post-quantum signature algorithms as potential candidates for future standardization. We take
2026-07-10 归档
今日共收录 1398 条安全情报，包含 466 个 CVE，522 篇安全通告，以及 115 篇研究论文。
← 返回归档列表OpenMandriva Linux says contributor tried to sabotage the project
The OpenMandriva Linux project announced that it was the target of an attempted act of internal sabotage after a dispute
Injective SDK on npm infected with cryptocurrency wallet stealer
Hackers compromised the Injective Labs SDK project's GitHub repository and used it to publish a malicious package on the
Microsoft expects more Windows security updates from AI-discovered flaws
Microsoft says Windows users should expect to see an increase in security updates as the company increasingly relies on
New Forg365 phishing platform uses AI to target Microsoft 365 accounts
A new phishing-as-a-service (PhaaS) operation called Forg365 focuses on stealing Microsoft 365 accounts by combining adv
The Hidden Security Risks of Reduced Summer IT Coverage
Security operations don't slow down when IT teams take vacation, but staffing levels often do. Kaseya explains how AI-dr
Police arrests 5,800 suspects in global anti-fraud crackdown
Law enforcement agencies have arrested 5,811 suspects and seized $293 million in illicit assets in a global anti-fraud o
AssuranceAmerica data breach exposes records of 6.9 million drivers
American insurance company AssuranceAmerica has disclosed a data breach impacting nearly 7 million drivers after attacke
Microsoft patches RoguePlanet Defender zero-day vulnerability
Microsoft has released a security patch to address a Defender zero-day vulnerability known as "RoguePlanet," disclosed a
New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware
Microsoft has taken apart a destructive Windows backdoor it calls GigaWiper. What stands out is how it is built: not one
npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk
GitHub has officially announced the release of npm version 12 with install scripts disabled by default, along with depre
ThreatsDay: Cloud Bucket Hijacking, Windows LPE Chain, Global Fraud Bust + 17 More Stories
Most security mess starts as admin work. A link gets clicked. A tool gets trusted. A bucket name gets reused. A setting
GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses
Cybersecurity researchers have flagged a new ransomware family called GodDamn that employs the PoisonX kernel driver to
Mount Royal University Confirms Data Stolen in Ransomware Attack
Hackers accessed the institution’s internal network and deleted two drives containing employee, student, and university
8Layers Raises $2.9 Million for Identity Security Platform
The Spanish startup has closed an extended pre-seed funding round two months after launching its digital identity protec
Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completions
该论文聚焦于代码补全大语言模型的后门攻击归因问题。尽管大语言模型在代码补全任务上表现出色，但通过恶意微调数据植入后门是一种严重威胁：攻击者可以在看似正常的微调样本中隐藏触发条件，使模型在特定上下文中生成包含漏洞的代码。现有防御技术多聚焦于检
Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting
本论文揭示了智能体化大语言模型（LLM）应用中一种新型的可扩展攻击方法，作者将其命名为"对抗性幻觉蹲守"（Adversarial Hallucination Squatting）。研究背景是：随着LLM应用（如支持工具调用的智能体）日益普及
Efficient Safety Alignment of Language Models via Latent Personality Traits
该论文针对大语言模型（LLM）在安全性方面的脆弱性，提出了一种高效的对抗训练方法——潜在人格对齐（Latent Personality Alignment, LPA）。当前的安全对齐方法（如RLHF）易受对抗攻击，而潜在对抗训练（LAT）虽
The Blind Curator: How a Biased Judge Silently Disables Skill Retirement in Self-Evolving Agents
该论文研究了自演化智能体（self-evolving agents）中技能淘汰（skill retirement）机制在面对有偏裁判（biased judge）时的失效问题。自演化智能体通过观察技能失败来淘汰不佳技能，但这一机制依赖于无偏的
Multi-Channel Spread-Spectrum Code Watermarking
本文提出了一种名为多通道扩频代码水印（Multi-Channel Spread-Spectrum Code Watermarking）的新方法，旨在解决大型语言模型（LLM）生成代码的溯源问题。现有技术存在两大局限：生成时水印需要访问原始模