From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
2026-07-14 归档
今日共收录 1138 条安全情报，包含 379 个 CVE，396 篇安全通告，以及 80 篇研究论文。
← 返回归档列表Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Defending SaaS-based applications against ShinyHunters OAuth abuse
Microsoft Threat Intelligence identified threat actor activity with overlapping tradecraft commonly associated with Shin
Introducing Precursor: detecting agentic behavior with continuous client-side signals
Precursor, our new continuous behavioral validation engine for bot management, offers visibility into how humans and bot
Breach at the Beach: Play the Ultimate Entra ID CTF
Learn how attackers abuse Entra ID through a free hands-on Capture the Flag. Varonis created the Breach at the Beach CTF
Exposing New Vulnerabilities of Error Handling Mechanism in CAN.
本文针对控制器局域网(CAN)中的错误处理机制展开了深入的安全性分析。CAN总线广泛部署于汽车、工业自动化等安全攸关领域，其错误处理机制包括错误帧、主动错误标志、被动错误状态等，设计初衷是为了在总线节点间实现可靠的数据传输。然而，该研究通过
Stealing the Decoding Algorithms of Language Models.
本文首次展示了一种攻击方法，能够通过仅对语言模型（LM）进行典型的API访问，以极低的经济成本窃取其解码算法的类型和超参数。解码算法是语言模型生成文本的关键组件，决定了如何从LM输出的内部概率分布中选出文本。选择和调优解码算法需要大量时间、
Optical Cryptanalysis: Recovering Cryptographic Keys from Power LED Light Fluctuations.
该论文提出了一种新型侧信道攻击方法——光学密码分析（Optical Cryptanalysis），通过测量设备电源指示灯（power LED）的光强波动来恢复加密密钥。尽管电源LED已广泛应用于执行加密操作的设备数十年，但其密码分析风险此前
Explanation-Guided Backdoor Poisoning Attacks Against Malware Classifiers.
本文研究了基于机器学习的恶意软件分类器在后门投毒攻击下的脆弱性。恶意软件分类器的训练流程常依赖众包威胁情报源，这为攻击者提供了天然的攻击注入点。作者聚焦于“干净标签”攻击场景，即攻击者无法控制样本标签，仅能污染训练数据中的特征。他们提出利用
You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completion.
本文研究了神经代码自动完成器（基于Pythia和GPT-2的新型自动完成系统）面临的数据投毒和模型投毒攻击。代码自动完成是现代IDE的核心功能，最新一代自动完成器使用在公开开源代码上训练的神经语言模型，根据当前上下文提供智能建议。研究发现，
Pretty Good Phone Privacy.
该论文针对当前蜂窝网络中用户身份与位置隐私严重泄露的问题，提出了一种名为 Pretty Good Phone Privacy (PGPP) 的端到端隐私保护方案。现有蜂窝架构要求手机向基站唯一标识自身，运营商进而可以收集并出售或泄露数亿移动
Titanium: A Metadata-Hiding File-Sharing System with Malicious Security.
该论文提出了 Titanium，一种具有恶意安全性的元数据隐藏文件共享系统。在端到端加密文件共享系统中，文件内容对存储服务器保密，但服务器仍能学习元数据，如用户身份和访问模式。先前的工作如 Metal（NDSS '20）在恶意服务器模型下不