POPS: Recovering Unlearned Multi-Modality Knowledge in MLLMs with Prompt-Optimized Parameter Shaking
该研究针对多模态大语言模型（MLLM）中的机器遗忘（Machine Unlearning）机制的安全性提出质疑。MLLM在训练时可能无意中编码了隐私敏感数据，因此多模态机器遗忘（MMU）被用于强制模型遗忘这些信息。但作者发现，当模型公开后，
2026-07-11 归档
今日共收录 1315 条安全情报，包含 488 个 CVE，410 篇安全通告，以及 120 篇研究论文。
← 返回归档列表TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories
论文提出了一种针对LLM agent轨迹日志的鲁棒水印方法TRACE，旨在解决agent通过reseller分发时的归属争议问题。在现实场景中，开发者将LLM agent交付给reseller，reseller可能重新品牌或替换为更便宜的模
From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure
该论文针对关键基础设施中操作技术（OT）环境无法主动扫描、但风险评估和合规管理仍需主动系统反馈的困境，提出了一种基于模型上下文协议（MCP）的非侵入式多智能体管道。该管道将自然语言描述的系统文档转化为经过源验证的知识图谱，并自动生成符合NI
Multi-Agent Firewall Architecture for Privacy Protection of Sensitive Data in Interactions with Language Models
随着大型语言模型（LLM）成为重要的生产力工具，将其集成到工作流程中若缺乏足够保护会带来显著的数据泄露风险。本文提出了一种开源、隐私优先、面向用户的防火墙架构，旨在保护基于 Web 和编程接口的 LLM 交互安全。该架构结合了浏览器扩展与代
ECO/CPO-DAG: A Contradiction-Based Accountability Layer for Adversarial Supply Chains
本文提出 ECO/CPO-DAG，一个针对对抗性供应链的问责协议，将矛盾检测形式化为补充验证层，而非共识或真理建立机制。参与者将签名的事件声明对象（ECO）发布到一个因果有序、只追加的有向无环图（DAG）中，边编码了发生在先关系。当关于同一
Context-to-Execution Integrity for LLM Agents
本文针对大语言模型代理（LLM agents）在执行任务时面临的完整性风险，提出了一种名为上下文到执行完整性（Context-to-Execution Integrity, CXI）的执行边界系统。LLM agents通常读取攻击者可写入的
Code-Level Cost Function Generation for Spatial Image Steganography Using RAG-Enhanced Large Language Models
传统的自适应图像隐写成本函数设计需要大量手动调参，而深度学习方法又缺乏可解释性。大语言模型（LLM）通过进化生成提供了一种自动化替代方案，但由于缺乏显式领域知识，常常违反领域特定的数学约束。为了解决这一问题，本文提出了一种新颖的进化系统，利
The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.
CVE-2026-20744
该漏洞影响充电站系统的WebSocket端点。由于缺乏适当的身份验证，任何能够访问该端点的攻击者均可建立连接，进而可能利用该通道执行未经授权的操作。CVSS 3.1评分为9.8（严重），表明攻击者无需身份验证即可远程利用该漏洞，且攻击复杂度
OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filen...
CVE-2026-14480
OpenPLC Runtime v3 的遗留 Web UI 程序上传功能中存在一个经过身份验证的任意文件写入漏洞。应用程序将攻击者提供的文件名 (prog_file) 直接存入 Programs.File 数据库字段，后续在保存上传文件时未
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud