When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems
该论文揭示了多智能体、工具调用LLM系统在安全监控中的一个根本缺陷：传统的运行时监视器对每个消息、工具调用或步骤进行独立检查，但分布式后门攻击将有害负载拆分成多个片段分配到不同智能体上，使得每个局部检查都看似正常，而组装后的整体却构成攻击。
2026-07-15 归档
今日共收录 995 条安全情报，包含 81 个 CVE，528 篇安全通告，以及 87 篇研究论文。
← 返回归档列表LLM-Guided Program Evolution for Targeted Black-Box Attacks on Perceptual Hash Algorithms
感知哈希算法（PHA）广泛应用于图像篡改检测，但其在对抗性扰动下的鲁棒性尚未得到充分研究。本文提出一种基于进化框架（GigaEvo和OpenEvolve）的新型黑盒攻击方法，针对感知哈希算法实施目标性二次图像攻击。攻击性能通过复合评分衡量，
Which Neurons Detect Malicious Code? A Probing Study of LLM Security Knowledge
本文研究了大语言模型（LLM）内部如何识别恶意代码的机制。尽管LLM在代码补全、漏洞检测等软件工程任务中表现优异，但其识别恶意或漏洞代码的内部工作机制仍不透明。作者采用机械可解释性方法，对三个指令微调的LLM（Llama3.1-8B-Ins
Firewall3D: A Hardware Firewall for Defending 3D Printers Against Firmware Attacks
随着3D打印市场快速增长（估值超过300亿美元），针对增材制造系统的网络安全风险也在上升。攻击者可能破坏打印部件、窃取知识产权，甚至物理损坏3D打印机。固件级攻击是主要威胁之一，可通过供应链入侵、恶意固件更新或内部威胁引入，从而操纵打印机行
Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hv_exts. When building the extension hash (via exten...
CVE-2026-58102
Crypt::OpenSSL::X509 是一个 Perl 模块，用于处理 X.509 证书。在版本 2.1.3 之前，该模块存在一个堆越界读取漏洞。当使用 extensions()、extensions_by_long_name()、ex
PromptGraph: Graph-Guided Prompt Sanitization for Balancing Privacy and Utility in LLM Inference
PromptGraph: Graph-Guided Prompt Sanitization for Balancing Privacy and Utility in LLM Inference
Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware
### Summary Ech0's i18n middleware runs on every HTTP request and constructs a fresh `*goi18n.Localizer` from the raw `
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Defending SaaS-based applications against ShinyHunters OAuth abuse
Microsoft Threat Intelligence identified threat actor activity with overlapping tradecraft commonly associated with Shin
Microsoft Entra ID gets passkeys default authentication starting September
Microsoft has announced that passkeys will become the default authentication method for the Entra ID enterprise identity