Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO authorization flow did not bind the OAuth state parameter accepted by /connect/authorize to the initiating browser session, allowed attacker-controlled PKCE parameters, and left SsoAuth records intact after failed token exchange, allowing an unauthenticated attacker to induce IdP authentication and red

FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta5, FastGPT's shared SSRF guard validates only the initial request URL before handing the request to axios, and axios follows redirects by default. An authenticated workflow user can configure an HTTP request node to call an attacker-controlled public URL that redirects to cloud metadata, loopback, or internal services that t

Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load Balancer Controller before 3.4.2 might allow an authenticated remote user to intercept, spoof, or deny another namespace's gRPC traffic on a shared Gateway via a crafted HTTPRoute resource. To mitigate this issue, users should upgrade to version 3.4.2.

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied _failure_path parameter when failure_forward: true was enabled, allowing an unauthenticated failing login request to dispatch a subrequest to access_control-protected GET routes that skipped f

该论文提出了一种名为RIoTFuzzer的新型黑盒模糊测试方法，旨在远程发现物联网设备漏洞。由于IoT系统架构和外设的多样性，黑盒模糊测试是发现漏洞的首选方案，但现有工具依赖伴侣应用生成有效测试包，却面临无法绕过云服务器端验证以及仅关注Android伴侣应用中Java组件而忽略非Java组件（如基于JavaScript的小程序）的局限性。RIoTFuzzer专门针对由一体化应用（All-in-one Apps）中JavaScript小程序驱动的IoT设备，通过文档式控制命令提取、混合分析变异点识别以及侧信道引导的模糊测试三大技术，实现对IoT设备的远程模糊测试。文档式控制命令提取从伴侣应用的UI文档中解析控制命令；混合分析结合静态与动态分析识别可变异点；侧信道反馈（如设备响应时间）引导模糊测试方向，提高效率。作者在主流平台的27款IoT设备上应用RIoTFuzzer，发现了11个漏洞，均获得厂商确认，其中8个漏洞已确认并分配了4个CVE编号。实验表明，侧信道引导模糊测试平均提升76.62%的测试包发送效率，最高提升362.62%。该方法显著增强了物联网设备漏洞挖掘的覆盖面和有效性。

Ivanti Endpoint Manager Mobile代码注入漏洞

Huawei Secoway USG firewall weak password

Yokogawa YFGW410 gateway

### Impact The `/internal/object_storage` endpoint accepts a caller-supplied JSON `storage_path` parameter that dynamically overrides the TensorZero `[object_storage]` configuration. By abusing the `filesystem` storage type, a caller can read arbitrary files from the gateway filesystem, including files that may contain sensitive credentials. Similarly, by abusing the `s3_compatible` storage type

## Summary ToolHive's hand-rolled private/reserved-IP SSRF guard (`networking.IsPrivateIP` in `pkg/networking/utilities.go`) does not recognize the IPv6 **NAT64** address ranges — the well-known prefix `64:ff9b::/96` (RFC 6052) and the RFC 8215 local-use prefix `64:ff9b:1::/48`. As a result, an address such as `64:ff9b:1::a9fe:a9fe` — the NAT64 encoding of the link-local cloud metadata address `1

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitr

### Summary The fix for **CVE-2026-47260** (v9.3.5) added an **initial** `isSafeUrl()` check to several fetchers (`synchronizeEpisodes`, `getStreamableUrl`, `AddRadioStation`, `EpisodePlayable`), but the **redirect-target validation** — the per-hop Guzzle `on_redirect` callback added in follow-up commit `be1e867` — was applied to **only one** path, `EpisodePlayable`. Every other server-side fetch

CrowdStrike与Zscaler宣布合作，将连续身份安全能力集成到零信任访问架构中。该合作旨在通过整合CrowdStrike Falcon平台的端点检测与响应（EDR）能力与Zscaler的零信任网络访问（ZTNA）解决方案，提供实时的身份威胁检测与访问控制。双方结合威胁情报（包括APT活动和Conti勒索软件家族的行为模式）来持续验证用户身份和设备安全状态，从而在允许访问前识别并阻止潜在攻击。此合作强调在零信任框架下，通过持续的身份验证和风险评分，减少攻击面，防止横向移动和数据泄露。虽然文章未提及具体CVE或攻击技术ID，但标签包含APT和EDR，表明该集成针对高级持续性威胁和已知恶意软件家族（如Conti）提供防御。

CrowdStrike 于 2026 年 7 月 16 日发布博客，宣布推出“Continuous Identity for AI Agents”解决方案。该产品旨在为 AI 代理提供持续的身份验证与访问控制能力，应对 AI 工作负载中日益增长的安全风险。随着 AI 代理在企业环境中广泛用于自动化任务、数据处理和决策支持，其身份管理成为关键挑战。传统静态凭据容易泄露或被滥用，而 AI 代理的动态行为需要实时、基于上下文的风险评估。CrowdStrike 的解决方案利用其 Falcon 平台的实时威胁情报和身份安全能力，持续验证 AI 代理的身份、行为和访问权限，确保只有合法且未被篡改的代理可以访问敏感资源。该功能支持与主流 AI 框架和云服务集成，帮助安全团队实现零信任原则下的 AI 安全治理。尽管文章为产品发布公告，未提及具体攻击事件或漏洞，但反映了业界对 AI 安全的高度关注。

Citrix NetScaler 内存泄漏(CVE-2025-5777)

容器逃逸漏洞是云原生环境中的严重安全威胁，其中路径遍历（PaTra）漏洞源于跨边界路径解析错误，尤其是在共享GPU、工作区等资源支持AI工作负载时愈发普遍。现有防御手段存在不足：内核级防护具有侵入性且未被Linux主线接受；基于静态规则或人工审计的检测方法误报率高或成本高昂。本文提出Bulkhead，一个结合大语言模型（LLM）与形式化方法的自动化框架，用于语义化漏洞发现与修复。Bulkhead采用多智能体系统，通过从已知案例中泛化的多维知识模式识别并修复PaTra漏洞。其检测流程首先应用高风险功能模式定位容器化代码中跨边界交互的入口点，再利用调用链模式恢复合适的执行路径，随后结合应用场景与威胁模型分析调用链，识别缺失安全检查、TOCTOU等漏洞，并生成验证用的概念验证（PoC）利用。补丁流程基于预定义的模型检查模板执行断言驱动验证，确保修复正确性。实验表明，Bulkhead在多个真实容器镜像中成功发现并修复了已知和未知的PaTra漏洞，显著降低了误报率，并提供了可验证的修复方案。该工作为自动化容器安全检测与修复提供了新思路，尤其适合云原生安全工程师、AI基础设施运维人员及漏洞研究团队阅读。

本文针对生产级 LLM agent（如 Claude Code 和 Codex）在操作不可信内容、文件、命令和工作区状态时存在的安全风险，提出了一种自动化红队测试方法。现有的自动化红队测试方法主要优化攻击成功率，并保存基准、payload 或攻击程序等 artifacts，但这些 artifact 只记录攻击成功的位置，而无法揭示导致不安全 agent 行为的条件。为此，作者提出了 AHA（Autoresearch for Production-Agent Red-Teaming）框架，该框架利用一个 agentic 研究环境来发现关于另一个 agent 的可重用漏洞知识。AHA 是一个可证伪的发现循环，包括以下步骤：提出漏洞假设、构建证伪器、实例化有效攻击、在沙箱环境中执行攻击、反思执行轨迹，并将确认的发现提升为漏洞概念图（Vulnerability Concept Graph, VCG）。VCG 中的每个概念通过一个声明、使能条件、证伪器、迁移预测和支持证据，将面向攻击者的表面与不安全轨迹关联起来。在对 Claude Code 和 Codex 进行的实验涵盖了直接和间接攻击两种场景，发现的概念揭示了跨模型和 agent 的可重用漏洞核心。固定的 VCG 无需进一步搜索，在相同的单次协议下，比最强的固定发现基线高出 14.2 个百分点，并且能够跨场景和攻击通道迁移。最终生成的 VCG 为生产安全团队提供了一种可审计的 artifact，用于检查漏洞、验证补丁并积累可重用的安全知识。代码已开源。该研究主要面向 LLM agent 安全研究人员、红队测试人员和 agent 开发者，提供了一种系统性、自动化发现和记录漏洞知识的方法。

Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two concurrent requests to pass the read step and mint independent access tokens, refresh tokens, and ID token

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-/. The normal toolset routes deny access, but the workflow save and runtime path did not apply the same authorization check to the referenced toolset, allowing /

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the POST /api/core/chat/record/getCollectionQuote endpoint authenticates the caller's chat and collection context, but the initialId center-node lookup is not bound to that authorized context. A low-privileged tenant user can call the endpoint with valid attacker-owned appId, chatId, chatItemDataId, and collecti

FastGPT is a knowledge-based AI application platform. In 4.15.0-beta4, FastGPT plugin invoke reverse-call endpoints under /api/invoke/* authenticate only by verifying a JWT signed with INVOKE_TOKEN_SECRET, which defaults to the constant string token and was not set in official deployment templates. An unauthenticated attacker can self-sign an HS256 JWT and reach /api/invoke/userInfo to disclose cr

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated

PLANET VDR-300NU ADSL Router - 未授权修改DNS

Acknowledgements

【EdgeOne】CNAME 域名生成规则调整公告

Strands Agents is an open-source Python SDK for building and running AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including the elasticsearch_memory tool for agent memory storage. We identified CVE-2026-15746, a server-side request forgery (SSRF) issue in the elasticsearch_memory tool. The tool exposed its connection parameters (es_url, cloud_id, api_k

Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in SearchService that allows remote attackers to execute arbitrary code by delivering malicious JavaScript through controlled search provider content loaded into an Electron BrowserWindow configured with nodeIntegration enabled and contextIsolation disabled. Attackers who control a s

Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row and does not require an owner or admin role, allowing attacker-controlled OIDC or SAML providers to driv

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is set, store them on the ssoProvider row without origin validation, and fetch them during OIDC callb

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts email_verified: true without requiring the local user row's emailVerified field to also be true, allowing an attacker who pre-registers a victim email through /sign-up/email to

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/{env}/releases/{releaseId} while configView.memberOnly.envs is enabled, allowing a low-privileged Portal user who obtains or guesse

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled because ConfigService can accept a non-canonical appId variant during authentication while downstream request handling resolves it to the

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under /configfiles/raw/{appId}/{clusterName}/{namespace} are parsed for authentication as appId raw instead of the a

Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as `http://attacker.com/@victim.com/` was fetched from attacker.com but treated as `http://victim.com`, allowing a complete Same-Origin Policy bypass. This issue is fixed in versio

Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin reques

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername() when Signup=true and CreateUserDir=true, but the many-to-one normalization can collapse usernames such as team/one, team one, and team-one to the same home directo

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16, File Browser's archive builder uses strings.ReplaceAll(nameInArchive, "\", "/"), which turns a POSIX filename such as ..\..\evil.sh into the archive entry ../../evil.sh, allowing a user with upload permission to plant a backslash-named fil

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser can leave a public directory share behind when the shared directory is deleted through a path with a trailing slash because the share cleanup path calls DeleteWithPathPrefix(file.Path, userID) and the Bolt backend performs the datab

Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode, allowing an attacker-controlled page to hide the real browser UI and origin information, imitate a trusted website UI, and combine with long-domain URL eliding to spoof a trusted origin for phishing and credential theft. This iss

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the IdP email_verified claim only for new-user creation and not when SSO_SIGNUPS_MATCH_EMAIL=true linked an IdP identity to an existing local account, allowing an attacker-controlled IdP identity asserting a victim email address to bind to and authenticate as that account. This issue

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO discovery and pre-validation flow returned organization-related SSO metadata including organizationIdentifier values for arbitrary email addresses and allowed a valid pre-validation JWT to be obtained with only the discovered identifier, enabling SSO-enabled organization enumeration and authentication

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint rendered PDF Title and Author metadata fields without proper HTML encoding or sanitization, allowing a crafted PDF to execute attacker-controlled JavaScript in the browser of a user who views the resulting page. This issue is fixed in version 2

Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth client_id claim, so the JWT verifier does not load token scopes into request context and RequiredScopes treats the request like non-scoped session authentication, allowing a low-scope OAuth access token to call APIs requiring higher scopes such as fi

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the con

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/download and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets, allowing a non-admin user with remote download permission to fetch internal-only URLs and

Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint validator (Security::detectXss()) runs on raw page content before Twig processing. When Twig content processing is enabled (twig_content.process_enabled: true), an attacker with page-write API permission can use Twig's string concatenation operator (~) to dynamically construct event handler names, dangero

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to alter shared label taxonomy and manipulate issue-label associations without owner or admin authorization

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the string context so that opening or building the exported Gradle project executes attacker-controlled Groo

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delet

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the desti

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as ../, allowing creation or overwrite of sibling objects in the same bucket or path scope. This issue is

Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a browser renders the profiler dump. This issue is fixed in version 3.26.0.

UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrop

Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private address ranges, loopback, or lin

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside is returned. This issue is fixed in version 3.4.5.

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker

Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in ve

9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an auth_token cookie when JWT_SECRET was unset. This issue is fixed in version 0.4.44

9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow attacker to information disclosure via

### Impact If this library is used in tandem with the `permessage-deflate` extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression. This can lead to applications accep

### Impact The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values `0x80` or above, a client can make the server parse these bytes into an ever-growing integer. Since JavaScript numbers are 64-bit floating point v

### Impact If this library is used to implement a WebSocket server on top of a TCP server (rather than an HTTP server or framework) using the `WebSocket::Driver.server()` method, or, if it is used to complement a WebSocket client, then a peer can make a single connection consume an unbounded amount of memory by sending an HTTP request or response with a never-ending list of headers. This can lead

### Impact If this library is used in tandem with the `permessage-deflate` extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression. This can lead to applications accep

### Impact The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values `0x80` or above, a server or client can make the other peer parse these bytes into an ever-growing integer. Since Ruby integers are arbitrary prec

CVE-2026-55398 is a memory management vulnerability in Secure Access clients and servers prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against the server.

CVE-2026-33444 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against the server.

CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel protocol can create a persistent DoS against the server.

CVE-2026-40958 is a input validation error in Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client.

CVE-2026-33443 is a memory management error in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel protocol can create a persistent DoS against the server.

CVE-2026-40956 is a memory disclosure vulnerability in Secure Access client versions prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can cause a small amount of random memory to leak.

CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client

CVE-2026-40955 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client.

## Insecure Permission Assignment for Garmin OAuth Token Store ### Summary `garminconnect` (≤ 0.3.4) wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask (`022`) the token file `garmin_tokens.json` was created world-readable (`0o644`). The file contains the DI **refresh token**, so any other local user on a shared host could read it and o

本文提出了一种名为 Prezta（可验证的零信任授权远程执行）的新型架构，旨在解决关键基础设施中运营技术（OT）系统安全现代化面临的挑战。传统的应用网关虽然能执行复杂授权并支持零信任架构，但存在部署和管理负担重、需与远程边缘设备共置、频繁更新补丁等问题。Prezta 通过将授权策略评估移到客户端内的零知识虚拟机（zkVM）中执行，生成简洁的零知识证明，边缘设备只需高效验证该证明即可确认授权结果，从而消除了应用网关，将零信任安全边界扩展至边缘。该系统支持策略和身份管理方案的动态演进，无需更新边缘设备。原型基于 RISC Zero zkVM 实现，兼容 XACML 3.0 策略和 JWT 身份声明。为减轻 zkVM 带来的证明开销，作者将策略编译为 Rust 代码，并预编译正则表达式，同时优化签名验证和 JWT 解析，将证明者时间降低了一个数量级以上。编译器正确实现了 XACML 3.0 一致性测试套件的 83%，在台式机上证明生成耗时数十秒，而验证仅需数十毫秒，足以适应资源受限的边缘设备。该研究展示了零知识证明在零信任远程授权中的可行性，为边缘计算环境下的安全架构提供了新思路。

大型语言模型（LLM）在翻译、代码生成等任务中表现出巨大优势，但同时引入了社会风险，恶意用户可通过有害提示（如请求非法活动指导）利用模型。为缓解此问题，模型通常内置安全机制自动拒绝此类提示。然而，现有越狱方法常需大量人工、高计算成本或导致模型过度修改而影响常规效用。本文提出TwinBreak，一种创新的安全对齐移除方法。基于安全机制类似嵌入式后门的观察，TwinBreak识别并剪除负责该功能的参数。通过聚焦最相关的模型层，TwinBreak对模型效用和安全性的关键参数进行细粒度分析。TwinBreak是首个通过分析具有高度结构和内容相似性的提示的中间输出来隔离安全参数的方法。作者构建了包含100对“双胞胎提示”的TwinPrompt数据集。实验在来自五家供应商的16个LLM上进行，成功率89%至98%，且计算需求极低。该方法揭示了现有安全对齐的脆弱性，对LLM安全研究具有重要警示意义。

该论文系统性地研究了大型语言模型（LLM）集成应用中存在的远程代码执行（RCE）漏洞。尽管LLM在软件开发中展现出潜力，但集成框架如LangChain提供了代码执行工具和API，理论上攻击者可通过提示注入触发RCE。此前尚无研究系统性地分析这些框架的RCE漏洞及其对应用的影响和利用后果。本文旨在填补这一空白，通过分析典型LLM集成框架中的RCE风险，揭示漏洞成因、攻击面及潜在危害，为后续防御研究奠定基础。

随着ChatGPT等大型语言模型（LLMs）在学术写作中的广泛应用，如何检测LLM生成的内容成为学术界关注的焦点。本文系统研究了ChatGPT生成内容在学术文献中的可检测性，特别是科学论文摘要。作者首先构建了GPABench2基准数据集，包含超过280万对比样本，涵盖人类撰写、GPT生成、GPT补全和GPT润色四种类型的摘要，涉及计算机科学、物理学及人文社会科学三个学科。其次，作者探索了检测方法：评估了现有检测工具和超过240名人类评审者的不佳表现，然后基于手工设计的语言学特征模型作为基线，开发了名为CheckGPT的深度神经网络框架，旨在捕捉ChatGPT写作中微妙的深层语义和语言模式。最后，通过跨学科、跨任务的全面实验验证了CheckGPT框架的有效性，并评估了其迁移性、对提示工程的鲁棒性等。研究结果表明，现有工具和人类难以可靠区分ChatGPT生成内容，而CheckGPT在多种任务上表现更优。这项工作为学术圈制定LLM使用政策提供了数据和方法支持。

Anubis 是一个 Web AI 防火墙工具，通过向用户连接发送挑战来保护上游资源免受爬虫机器人攻击。在版本 1.22.0 至 1.26.0-pre1 之间，lib/policy/checker.go 中的 PathChecker.Check() 函数在处理路径匹配时，错误地信任了客户端控制的 X-Original-URI 头部，并在匹配 r.URL.Path 之前使用该头部进行规则检查。攻击者可以利用此缺陷，通过构造特制的 X-Original-URI 头部，匹配默认规则文件 data/common/keep-internet-working.yaml 中定义的允许规则（例如 ^/\.well-known/.*$），从而绕过 Anubis 的挑战机制，直接访问受保护的上游资源。该漏洞允许攻击者绕过反爬虫保护，可能导致资源被滥用或数据泄露。CVSS 评分为 5.8（中等），攻击复杂度低，无需认证，且影响范围可能扩展至其他系统（C 类影响）。建议用户立即升级到版本 1.26.0-pre1 或更高版本，该版本已修复此问题。同时，作为临时缓解措施，可限制对 Anubis 服务的网络访问，仅允许可信来源，并监控异常请求模式。

Akamai 发布了一款名为 'Firewall for AI' 的新型防火墙产品，旨在保护人工智能工作负载和模型免受网络威胁。该产品主要针对 AI 应用面临的特殊攻击面，包括模型投毒、数据泄露、API 滥用和 DDoS 攻击等。Akamai 指出，随着企业广泛采用 AI，针对 AI 基础设施的攻击也在增加，传统防火墙无法有效识别和阻止针对 AI API 的恶意请求。Firewall for AI 通过深度包检测、行为分析和威胁情报集成，提供针对 AI 流量的专门防护。产品支持对调用 AI 模型的请求进行验证和过滤，防止提示注入、敏感数据外泄等风险。此外，该解决方案还整合了 Akamai 的全球边缘网络，提供低延迟的防护。此次发布标志着网络安全厂商开始针对 AI 应用提供定制化安全产品。

This patch Tuesday includes a staggering&#;x26;#;xc2;&#;x26;#;xa0;622 vulnerabilities, not including another 427 vulnerabilities in Chromium, affecting Microsoft&#;x26;#;39;s Edge browser. 62 of the vulnerabilities are rated critical. One was disclosed before today, and two have already been exploited.

A malware framework called OkoBot has been running on Windows machines since April 2025, and one of its modules is built to con hardware wallet owners out of their recovery phrase. On an infected PC, the request comes from inside the wallet's own desktop software. Sometimes it waits until you plug the device in first. The page is malicious. The app around it is the real one you installed, and

Firefox browsers

Sign in to Cloud

Sign Up for Free Cloud Tier

iOS 26.4.2 and iPadOS 26.4.2

iOS 18.7.8 and iPadOS 18.7.8

iOS 18.7.7 and iPadOS 18.7.7

iOS 26.4 and iPadOS 26.4

Background Security Improvements for iOS, iPadOS, and macOS

iOS 16.7.15 and iPadOS 16.7.15

iOS 15.8.7 and iPadOS 15.8.7

iOS 26.3 and iPadOS 26.3

iOS 18.7.5 and iPadOS 18.7.5

iOS 26.2 and iPadOS 26.2

iOS 18.7.3 and iPadOS 18.7.3

Compressor 4.11.1

iOS 18.7.2 and iPadOS 18.7.2

iOS 26.1 and iPadOS 26.1

iOS 26.0.1 and iPadOS 26.0.1

iOS 18.7.1 and iPadOS 18.7.1

Android Code Search

Android Devices

Secure an Android device

Android 16 QPR2

Mobile network security

iOS 26.5 and iPadOS 26.5

iOS 18.7.9 and iPadOS 18.7.9

iOS 16.7.16 and iPadOS 16.7.16

iOS 15.8.8 and iPadOS 15.8.8

MFSA 2026-49Security Vulnerabilities fixed in Firefox for iOS 151.0

MFSA 2026-52Security Vulnerabilities fixed in Firefox for iOS 151.1

MFSA 2026-53Security Vulnerabilities fixed in Firefox for iOS 151.2

MFSA 2026-55Security Vulnerabilities fixed in Focus for iOS / Klar 151.3.1

MFSA 2026-56Security Vulnerabilities fixed in Firefox for iOS 152.0

iOS 26.5.2 and iPadOS 26.5.2

MFSA 2026-65Security Vulnerabilities fixed in Firefox for iOS 152.3

【大模型服务平台 TokenHub】&【智能体开发平台】& 【云开发 CloudBase】 关于腾讯云 MiniMax-M2.5 模型下线及切换升级的通知

MFSA 2026-66Security Vulnerabilities fixed in Firefox for iOS 152.4

APSB26-77: Security update available for Adobe Creative Cloud Desktop Application

A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper access control vulnerability by presenting a valid assertion token from an external identity provide

PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables. Consequently, multiple Capture objects running within the same Python process could share state, including HTTP headers, cookies, browser storage, HTTP credentials, proxy configuration, user-agent settings, geolocation information, and captured request dat

# Security Advisory: SSRF in remote MCP server authentication discovery **Severity:** High. **CWE:** CWE-918. **Affected:** ToolHive through the latest release v0.29.3 and current `main` (HEAD b672d82f, 2026-06-12; re-verified 2026-06-14). `FetchResourceMetadata` and the discovery clients remain unguarded; no commits to `pkg/auth/discovery` or `pkg/auth/remote` address this. Originally identified

## Summary The HPKE V2 URL decode path in `pkg/hpke/url.go` decompresses attacker-controlled zstd data without any size limit. On Pomerium deployments using the stateless authentication flow (Pomerium Zero / hosted authenticate), the proxy's `/.pomerium/callback` endpoint is reachable without credentials and processes attacker-crafted HPKE-encrypted payloads before the sender's identity is valida

# Reused Component Instances Retain Stale Render Context ## Summary `ViewComponent::Base` instances retain multiple render-scoped objects across calls to `render_in`. If the same component, collection, or spacer component instance is reused across requests, users, tenants, or threads, later renders can use stale `helpers`, `controller`, `request`, `view_flow`, format/variant details, and slot ch

### Impact The FiftyOne App/API server (`fiftyone/server/app.py`) and the `/media` route (`fiftyone/server/routes/media.py`) unconditionally set a permissive CORS header (`Access-Control-Allow-Origin: *`) on their responses. Because the embedded App server runs locally and is unauthenticated, this allows **any website a user visits to make cross-origin requests to that user's running FiftyOne ser

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, and 10.1.2507.24, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could view stored credential hashes when they access the `/servicesNS/-/-/storage/passwords` REST endpoint through the `|rest` Search Proc

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the `list_deployment_server` capability into running arbitrary Search Processing Language (SPL) searches on their behalf as `splunk-system-user`, allowing for ac

Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in SearchService that allows remote attackers to execute arbitrary code by delivering malicious JavaScript through controlled search provider content loaded into an Electron BrowserWindow configured with nodeIntegration enabled and contextIsolation disabled. Attackers who control a s

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the `edit_local_apps` and `install_apps` capabilities could cause a legitimate app installation to write files outside the intended app directory, into `$SPLUNK_HOME/etc/` and its sub

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system to either read or delete arbitrary files. To exploit this vulnerability, the attacker must have valid administrative credentials.  This vulnerability is due to improper val

## Summary Koel's outbound-URL guard `App\Helpers\Network::isPublicHost()` classifies an IP as "public" using PHP's `filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)`. That flag set does **not** recognise IPv6 transition-address forms that embed a private/loopback/link-local IPv4: NAT64 well-known prefix `64:ff9b::/96` (RFC 6052) and 6to4 `2002::/16` (RFC

Summary Koel v9.5.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the radio station creation endpoint (POST /api/radio/stations). The url field validation rules are declared without the bail keyword, so the HasAudioContentType rule — which issues HTTP requests to the supplied URL — still executes even after the SafeUrl rule has rejected the URL as pointing to a private/reserved a

### Summary Any authenticated user can achieve arbitrary command execution on the LangBot servers through changing the MCP Server Configuration by added an "STDIO" MCP with an arbitrary command. ### Details The repository uses StdioServerParameters which is based on Anthropic's modelcontextprotocol open source, inside the code - src/langbot/pkg/provider/tools/loaders/mcp.py - StdioServerParameter

该论文研究了多智能体LLM系统中的分布式后门攻击问题。在多智能体环境中，每个LLM智能体可以调用工具、发送消息，系统通常会部署运行时监控器检查每个步骤或消息的合法性。然而，论文揭示了一个根本漏洞：攻击者可以将有害载荷分割成多个无害的片段，分别分配到不同智能体的消息或工具调用中，这样每个本地监控器检查时均通过，但组合后的完整载荷却是攻击代码。问题不在于分割本身（因为分割后的片段可能仍会泄漏可疑标记或来源边），而在于每个片段在本地视角下完全表现为良性流量，没有任何危险迹象。论文将此形式化为“可观测性边界”：监控器只能捕获其观测视角下可与良性流量区分的事件。作者证明，一旦片段的监控视角下表现为良性，任何检测器都无法捕获，无论其能力多强。在受控测试平台、外部基准测试和端到端智能体运行中，实验验证了本地监控器在局部证据消失时完全丢失信号，只有当监控器看到组装后的完整对象时信号才恢复。论文进一步提出一种仅用良性流量训练的监控器，能够恢复攻击的代码结构（在留出编码上平均AUROC为0.874），并设计了一个“解码视图门”（给定编码族）可阻止所有测试攻击。但作者强调，仅仅看到更多信息并不足够：全轨迹监控器和解码器只有到达暴露载荷的表示层面才能成功。论文总结：当危害是组合性时，局部安全不等于全局安全，开放问题是如何找到正确的表示层面。该研究为多智能体系统的安全监控提供了重要理论分析和实用方向。

大型语言模型（LLM）的成功应用带来了内容溯源和滥用的担忧，因此可靠的水印技术不可或缺。然而现有水印技术在实际部署中面临两个主要障碍：一是严重降低模型性能，二是增加推理开销。为了验证这一问题，作者构建了一个涵盖不同生成任务的综合基准，系统评估了9种代表性水印方法，发现几乎所有现有方法都只针对文本流畅性设计，不适用于受限或复杂任务，且其开销阻碍了在延迟敏感系统中的部署。针对这些问题，本文提出了一种名为 WaterMoE 的水印方案，专为日益流行的混合专家（MoE）架构 LLM 设计。WaterMoE 通过在每个路由器的专家选择中引入受控扰动来嵌入水印信号，这种扰动逐渐累积，最终导致最终输出的 token 选择偏移。与作为后处理 token 采样步骤的传统水印方法不同，WaterMoE 将水印嵌入到推理循环内部，从而引入可忽略的质量下降和计算开销。大量实验表明，该方法在保真度上接近未加水印的模型，并且在基准测试中始终优于最先进的水印方法，同时实现高达4倍的加速，与原生生成相比仅增加1%的额外推理延迟。这些结果证明了 WaterMoE 在现实任务中部署的能力。本文主要贡献包括：指出现有水印方法在复杂任务和开销上的不足；提出针对 MoE 架构的专用水印方案；通过实验验证了高保真、高效率的水印性能。适合对 LLM 安全、内容溯源、模型部署感兴趣的读者。

本文提出ProfMalPlus，一个用于检测恶意NPM包的新型系统。开源软件通过传递依赖容易受到供应链攻击，尤其是注入到NPM包中的恶意代码。现有检测器通常存在以下不足：对混淆行为建模不充分、忽略JavaScript的面向对象特性、静态与动态分析协调不佳、以及行为抽象过程中丢失语义信息。ProfMalPlus结合对象敏感行为图与基于注释代码切片的协调LLM推理来克服这些问题。该系统首先识别安装命令和入口文件，然后构建捕获敏感API、第三方调用和未解析调用的行为图。从这些图中，ProfMalPlus提取安全相关的代码切片并添加内联静态分析证据。本地判断智能体独立评估每个切片，通过自一致性机制合并重复判断以降低LLM的方差，全局智能体综合报告形成入口级判定。对于未确定的情况，路由器选择第三方增强（添加注册表派生的模块和方法语义）或动态增强（在沙箱中执行包以解析运行时依赖行为），并将增强后的证据反馈重新评估。最后，定位智能体报告恶意代码片段及解释。实验表明，ProfMalPlus在NPM恶意包检测上达到98.1%的F1分数，比现有最先进检测器高出3.5%到52.6%。它还识别了597个以前未知的恶意包，且全部被确认并从NPM中移除。本方法适用于安全研究人员和防御者，以增强软件供应链安全。

本文提出了一种名为 xChk 的参考身份提供商，用于实现“自带身份”（Bring Your Own Identity, BYOI）模式。在 BYOI 中，用户可以通过多种异构证明方式进行注册，包括政府 KYC、企业 SSO、WebAuthn/FIDO2 认证器、专业网络验证、实时视频验证、长期活动记录以及行为信号等。这些证明被封装为标准投资组合声明，并通过 OAuth 2.0/OpenID Connect (OIDC) 令牌传递给依赖方（Relying Party, RP）。xChk 的核心创新在于：依赖方自行决定充分的认证级别，而身份提供商仅负责传输声明并可选地评估 RP 提供的证据策略以征得用户同意，但不直接裁决访问权限。注册深度因认证方式而异，部分路径由用户发起，而组织级 KYB（了解你的业务）和负责人绑定则需要操作员协助。此外，xChk 支持高风险操作的人工参与证明：人类可直接通过浏览器 UI 或 POST /api/attestations 发起证明请求，而在此主体下行动的 AI 代理也可通过范围门控的 authorize/attest 端点触发相同的证明网关，形成基于哈希链的人类批准共享验证图（人类通过 OIDC，代理通过 API 密钥）。论文同时给出了生产部署实例（https://in.xchk.io），该实例实现了两种发起路径，并在用户同意阶段进行双向 RP 评估；一个已记录的依赖方（https://crabbyed.com，附录 B）演示了“使用 xChk 登录”的完整流程。本文适合身份管理研究者、SSO 实现者及安全架构师阅读，其贡献在于提供了一种去中心化、灵活且适应多模态证据的身份认证框架，解决了传统 IdP 单一置信度标准的局限性。

本研究针对开发者从两个截然不同的来源获取代码的现状——一是Stack Overflow等平台上积累的人类答案，二是大型语言模型（LLM）的输出——提出了两个核心问题：第一，能否仅从代码本身恢复其出处处（人类还是模型）？第二，两种来源在完成相同编程任务时，其采用的安全模式是否存在差异？为此，作者构建了一个完全可复现的流水线，利用公开的开源权重语言模型API和Stack Overflow公共API，从9个语言模型和人类回答中收集了31个安全敏感编程任务（如OAuth with PKCE、JWT验证、密码哈希、SQL访问等）的实际实现，并用确定性的安全检测器和风格检测器对每个样本进行评分。在528个真实样本上，通过交叉验证训练了一个分类器，能够以93%的准确率区分人类与模型来源（基线为78%），并且一个7路分类器能以48%的准确率将样本归因到生成它的具体模型。随后，研究揭示了两种来源在安全模式上的分歧点：哪些模式被模型更频繁地采用，哪些模式则是从人类语料中继承的。在Python、JavaScript、Go和Java四种语言中运行相同的任务时，发现安全分歧在所有语言中均存在，而出处边界部分依赖于语言，且在不同语言间不能对称迁移。此外，通过一个漏洞修复案例研究，研究者将不安全代码交给模型并要求其修复，发现模型在21个随机种子和12类弱点上的修复率为77%，但存在一种反复出现的“部分修复”失败模式：模型移除了不安全模式，却没有添加正确的防御措施。该流水线完全由数据驱动，因此任何新任务或语言只需添加一条规范条目即可，并且一个故障闭合检查器能从存储的数据中重新导出论文中的所有数值。本研究为LLM生成代码的安全性评估、代码溯源以及智能编码辅助工具的安全审计提供了重要的方法论和实证基础。

本文提出了一种面向大型语言模型（LLM）的高效且保护隐私的边缘-云协同推理框架。当前，设备端LLM推理面临响应延迟、硬件资源有限和用户隐私保护的三难困境。完全在云端推理虽然计算能力强，但会暴露用户提示和对话数据；而完全在设备端推理对于大多数消费级和嵌入式边缘设备而言不可行。为此，作者构建了一个基于端点认证KV缓存的隐私中心型协同推理框架。本地端点负责输入预处理、嵌入计算、自适应特征优化、KV缓存认证、推测解码和低维模型头计算；云端则负责认证解码器推理、KV缓存管理、令牌验证和高维词汇投影。端点融合部分输出，应用语言自适应掩码并采样目标令牌。所有传输数据和截断的logits均经过量化和AES-GCM加密，核心轻量级模块、草稿参数和缓存访问策略保留在本地以避免泄露。该框架支持异构设备，包括仅CPU、GPU设备和嵌入式设备，通过优化流式处理、批处理和量化ONNX部署实现。实验结果表明，与基线分割推理相比，该框架将每令牌延迟降低了最多46.1%，下行链路负载降低了最多67.4%，同时保持了与全云端推理相当的性能。

用户被迫更换密码时，常常会生成原密码的可预测变体（如增加数字或改变大小写），这给攻击者提供了可乘之机。本文提出并评估了 MindReader 工具，该工具利用大型语言模型（LLM）帮助用户生成既容易记忆又难以被攻击者猜测的密码替换方案。MindReader 首先解析用户原密码的各个组成部分，通过 LLM 推断每个部分的语义含义（例如，单词“cat”表示动物，数字“123”表示序列），然后基于这些语义生成语义相关但语法结构不同的替换建议（例如，将“cat”替换为“dog”，将“123”替换为“456”），最终组合成完整的新密码。在用户研究中，参与者被分为两组：一组使用 MindReader 生成替换密码，另一组自行创建替换密码。结果表明，使用 MindReader 生成的密码在在线攻击场景下更难被破解（即使攻击者知道原密码和工具实现细节），同时其可记忆性与用户自行创建的密码及原密码相当（以一周后成功登录率为衡量标准）。该研究为密码替换提供了兼顾安全性与可用性的新思路，适合密码安全研究人员、人机交互设计者和企业安全策略制定者阅读。

该论文研究了大型语言模型（LLM）从云端向边缘和本地部署迁移过程中面临的安全与隐私挑战。作者指出，边缘设备有限的计算和内存资源迫使采用量化、剪枝、模型分区和参数高效微调等激进优化手段，这些优化在提升效率的同时可能引入新的漏洞或加剧已有的安全风险，形成“安全-效率悖论”。论文系统分析了压缩如何削弱安全对齐、分区推理如何导致重构攻击、以及持续本地微调如何引发隐私泄露和模型漂移等问题。为了系统化地分析这些风险，作者提出了一种以部署为中心的威胁分类法，围绕三个硬件约束：内存墙（Memory Wall）、二次方墙（Quadratic Wall）和计算墙（Compute Wall），并推导出一个统一的约束模型来量化何时不安全优化变得不可避免，将每个约束与特定的攻击面关联。基于该模型，论文提出安全操作效率分数（Secure Operational Efficiency Score, SOES），这是一个综合考虑任务准确性、越狱抵抗性、隐私保护以及能耗、内存和延迟的指标，帮助实践者在真实硬件限制下配置边缘LLM。此外，作者还给出了一套实用的决策流程和针对每种优化引入的漏洞的缓解措施。整体上，论文提供了一个共同设计的安全、隐私与效率联合评估框架，为边缘智能系统的安全部署奠定基础。适合安全研究员、边缘计算工程师以及关注LLM隐私合规的从业者阅读。

该论文提出了一种基于大语言模型引导的演化框架（结合GigaEvo和OpenEvolve），用于对感知哈希算法（PHA）实施有针对性的黑盒第二图像攻击。感知哈希算法广泛应用于图像篡改检测，但对抗性扰动的鲁棒性研究不足。作者设计了一个复合评分函数，综合考虑攻击成功率（归一化汉明距离低于阈值的对抗样本比例）、对哈希函数的查询次数以及相对于原始图像的L2失真度。在pHash、PDQ、PhotoDNA和NeuralHash四种部署的PHA上，使用30对ImageNet图像进行实验，结果表明：与现有黑盒基线相比，该方法能以更少的查询次数达到相当或更高的攻击成功率，同时产生更低的L2失真。最佳演化程序将预定义的复合攻击评分降低了：NeuralHash 41.2%、PDQ 38.3%、pHash 34.0%、PhotoDNA 8.1%。该方法不需要PHA内部知识，能自然处理哈希输出的不可微离散性。这些结果揭示了广泛部署的内容审核流水线中此前未被报告的安全漏洞，并激励开发可证明鲁棒的感知哈希方案。适合安全研究员、内容审核系统开发者以及对抗性机器学习研究者阅读。

本论文针对大型语言模型（LLM）服务中的隐私保护问题提出了一种新的提示清洗方法PromptGraph。LLM推理过程中，用户的敏感信息不仅可能通过显式标识符（如姓名、电话号码）泄露，还可能通过看似无害的文本片段之间的上下文关联被推断。现有的提示清洗方法通常为每个片段单独分配隐私或效用信号，忽略了片段之间的成对关系。PromptGraph将每个提示表示为属性图，其中节点承载片段的隐私分数，边编码维持效用所需的上下文依赖关系。清洗目标是在最大化隐私增益的同时，惩罚上下文依赖关系的损失，从而在隐藏上下文证据时显式平衡隐私与效用。受保护的片段会被本地清洗，返回的占位符只有在通过局部一致性检查后才被恢复。实验结果表明，PromptGraph在隐私与效用之间取得了比现有的提示隐私基线更优的平衡。该方法为LLM隐私保护提供了新思路，特别适合需要同时保护隐私和保持推理质量的场景，如医疗、金融等敏感领域。

Unit 42 发布了对 npm 供应链威胁格局的深入分析，指出自“Shai Hulud”事件以来，攻击者不断演进其攻击方式。报告揭示了新型蠕虫性恶意软件，能够自我复制并横向传播，同时利用 CI/CD 管道实现持久化，并在多个阶段执行恶意操作。攻击者通过伪装成合法包或篡改流行包，将恶意代码注入软件开发流程，进而影响下游用户。分析强调了 npm 生态系统的攻击面包括：恶意包上传、依赖混淆、包劫持、元数据欺骗等。报告还讨论了缓解措施，如使用包签名、启用双因素认证、定期审计依赖、实施最小权限原则等。攻击者背景未明确归因，但推测与国家级APT组织有关。受影响行业广泛，包括金融、医疗、科技等。未提及具体CVE或IOC。

CVE-2026-54458 影响 WWBN AVideo 开源视频平台版本 29.0 之前。该漏洞位于 YPTSocket 插件中，是一个存储型 DOM 跨站脚本（XSS）漏洞。攻击原理：未经认证的远程攻击者可以通过 WebSocket 连接发送恶意构造的 webSocketSelfURI 和 page_title 参数，这些参数未经校验即被存储到内存中的 SQLite 连接表，并广播给所有连接的客户端。客户端 JavaScript 在更新在线用户面板时，将恶意 page_title 直接插入 HTML 模板并通过 jQuery 的 $.append() 方法解析，导致攻击者注入的 HTML 和 JavaScript 代码在管理员浏览器中执行。由于漏洞为存储型，任意管理员查看在线用户面板时都会触发。成功利用可导致攻击者读取非 HttpOnly Cookie 和 CSRF 令牌、以管理员身份发起任意请求、窃取管理员面板 DOM，最终完全接管管理员账户。漏洞 CVSS 评分为 9.6（Critical），影响版本为 29.0 之前。修复方案：升级到 AVideo 29.0 或应用官方补丁（commit 8be71e53ccbe9b84b30870db386fb4d2b11e1c16）。临时缓解措施包括限制对 /plugin/YPTSocket/ 路径的网络访问，仅允许可信任 IP 连接，并启用 Web 应用防火墙规则过滤恶意 query 参数。

Cloud & Application Security

From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise

Next-Gen Identity Security

CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security

CrowdStrike Expands Identity Leadership with OpenID and IDPro

cloud architecture assessment

ransomware and multifaceted extortion defense

Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand

The Identity Problem Hiding in AI Agent Deployments

94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey

Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud

Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This analysis breaks down the attack chain, payload delivery, and recommended defenses. The post Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery appeared first on Microsoft Security Blog.

Security teams have never had more visibility, yet rarely have they felt more uncertain. Signal pours in from endpoints, identities, cloud workloads, and a sprawling mix of third-party tools. The post Turning threat intelligence into decisive action with Defender Experts appeared first on Microsoft Security Blog.

该论文研究了ECS（Elastic Container Service）的快速增长趋势及其伴随的安全考量。作者通过分析大规模数据，揭示了ECS使用量的激增模式，并识别了常见的配置错误、访问控制漏洞以及镜像安全问题。论文提出了一套评估框架，用于量化ECS环境中的暴露面，并通过实证数据证明了当前实践中的安全风险。主要贡献包括：对ECS增长趋势的纵向分析、常见安全问题的分类以及可操作的缓解建议。适合云安全工程师、DevSecOps团队及云服务提供商参考。

该论文研究了用户对基于QR码的攻击（Quishing）的易感性和意识。随着QR码在日常生活中的普及（如支付、登录、信息获取），攻击者开始利用QR码将用户重定向到恶意网站或触发恶意操作。然而，用户对此类威胁的认知和防御能力尚不明确。研究通过在线问卷调查（N=500+）和受控实验室实验，测量了用户在不同情境下扫描陌生QR码的意愿、对QR码攻击的识别能力以及安全行为。结果显示，大部分用户对QR码攻击缺乏警惕性，容易在信任场景（如停车场、餐厅）中扫描未知QR码，且很难区分合法与恶意QR码。用户普遍高估了自己的检测能力，实际表现远低于自我评估。研究还发现，安全提示（如警告标签）对减少扫描行为有一定效果，但并非万无一失。论文贡献在于首次系统性地量化了QR码攻击的用户漏洞，为设计针对性的安全教育和更安全的QR码交互提供了实证依据。

该论文研究了针对自动驾驶中LiDAR（激光雷达）目标检测的物理对抗性攻击与防御方法。作者提出了一种新型的物理对抗性攻击——影子攻击（Shadow Attack），通过在目标物体附近投射精心设计的阴影图案，使得LiDAR点云数据产生偏差，从而误导目标检测模型（如PointPillars、PV-RCNN等）产生误检或漏检。攻击者在物理世界中使用可编程投影仪或遮挡物实现阴影投射，攻击效果在真实场景中得到验证。为应对此类攻击，论文进一步提出了基于对抗训练的防御框架，通过在训练过程中引入阴影扰动样本，提升模型对阴影攻击的鲁棒性。实验结果表明，所提攻击能使模型检测精度下降超过50%，而防御方法可将对抗攻击成功率降低至10%以下。该工作首次系统研究了阴影作为物理对抗攻击媒介在LiDAR感知中的影响，揭示了自动驾驶感知系统的新安全威胁，并为防御此类攻击提供了有效思路。适合自动驾驶安全研究员、LiDAR感知算法开发者以及物理对抗攻击研究者阅读。

该论文对2018至2023年间发表的200篇可用隐私与安全（UPS）领域的出版物进行了元研究，这些出版物来自USENIX Security、IEEE S&P、CCS、SOUPS、CHI等12个会议或期刊。同时，作者还分析了这些会议/期刊的81份征稿通知和20份工件征集通知。研究旨在评估当前UPS社区在研究透明度方面的实践及其发展趋势。作者定义了52个透明度标准，并逐一检查每篇论文的报告情况。结果显示，大多数论文报告了其中许多标准，但没有一篇论文实现完全透明。具体问题包括：关键工件（如问卷）经常缺失，阻碍了复制研究；部分信息报告不一致；死链接进一步降低了可用性。回归分析表明，论文长度和描述的研究数量对报告透明度有显著影响，但出版年份和工件评估（AE）流程未观察到影响。基于这些发现，论文为作者、会议/期刊以及程序委员会主席提出了改进研究透明度实践的建议，并建议制定透明度指南。该研究揭示了UPS领域在可重复性和可信赖性方面的重要问题，特别适合安全与隐私研究人员、会议组织者和政策制定者阅读。

该论文提出了一种名为 C2SR（Cybercrime Scene Reconstruction，网络犯罪现场重建）的框架，用于事后取证分析。传统取证方法通常依赖静态证据（如日志、文件快照），难以全面重构攻击者的行动路径和系统性影响。C2SR 通过追踪系统状态变化（包括文件系统、注册表、内存等）来动态重建攻击场景。核心方法包括：① 基于系统调用的因果跟踪，记录进程与资源之间的依赖关系；② 构建状态依赖图（State Dependency Graph），表示不同时刻系统状态的演变；③ 利用图分析方法自动识别关键攻击步骤和受影响对象。实验在真实恶意软件样本和模拟攻击场景上进行，结果表明 C2SR 能够有效重构攻击流程，定位恶意行为入口点，并减少人工分析工作量。该工作对数字取证、恶意软件分析和事件响应具有参考价值。

网络功能虚拟化（NFV）使得以低成本将多种网络功能作为云服务提供成为可能，其中网络测量任务（如重流检测和流量分布估计）是许多核心网络功能的基础，能够提升企业网络的性能与安全性。然而，将网络测量服务部署在第三方多租户云服务提供商中引发了严重的隐私与安全问题。最近研究表明，泄露和滥用流统计信息可能导致严重的网络攻击，如分布式拒绝服务（DDoS）、网络拓扑操纵和投毒等。为此，本文提出 OblivSketch，一种作为云服务的 oblivious 网络测量框架。OblivSketch 利用不经意随机访问机（ORAM）和安全飞地（如 Intel SGX）来保护流统计信息的隐私，确保云服务提供商无法窥探或篡改测量数据。该框架支持多种测量任务，包括重流检测、流量分布估计和熵估计等，并能在保持隐私的同时提供可接受的性能开销。实验结果表明，OblivSketch 在真实网络流量数据集上能够高效运行，与现有非隐私保护方法相比，性能损失在可接受范围内。主要贡献包括：设计了第一个支持多种 oblivious 网络测量任务的原型系统；提出了针对重流检测和分布估计的 oblivious 算法；实验验证了隐私保护下的实用性能。本文适合云安全研究人员、网络管理员以及对隐私计算感兴趣的读者。

本文提出 Mondrian，一种全面的跨域网络分区架构，旨在解决现代网络（如数据中心、企业网络和多租户云环境）中网络分段与安全策略管理的复杂性。现有解决方案（如 VLAN、ACL、SDN 微分段）在可扩展性、动态性和跨域一致性方面存在局限。Mondrian 借鉴艺术家皮特·蒙德里安的绘画理念，将网络抽象为“线”（连接）和“矩形”（分区），通过逻辑网络拓扑描述实现自动化的策略生成与部署。其核心方法包括：1）一种基于图论的分区模型，允许管理员定义高层级的安全约束（如“部门A与部门B不能互通”），系统自动将其转化为底层交换机和防火墙的精确规则；2）支持跨自治域（如不同租户或组织）的策略协商与一致性维护，通过数学规划确保全局无冲突；3）引入动态迁移机制，允许在不中断服务的前提下调整分区。实验在 50 节点物理测试床上进行，验证了 Mondrian 在策略规模达 10^4 条时的可扩展性、策略更新延迟低于 100ms 的动态性能，以及与 BGP 等现有路由协议的兼容性。主要贡献包括：首次提出形式化跨域分区模型，证明了分区一致性问题的 NP 完全性并给出近似算法，以及在真实云网络拓扑上的部署案例。本文适合网络架构师、安全管理员和 SDN 研究人员阅读。

本文针对恶意软件分析沙箱中执行时间参数的选择问题展开研究。沙箱执行时间过长会降低可扩展性，过短则可能导致恶意行为未被完全触发，影响数据收集的质量。然而，目前缺乏关于如何选择最优执行时间的明确指南。为了填补这一空白，作者首次开展了大规模研究，系统评估执行时间对收集事件数量和质量的影响。通过测量系统调用和代码覆盖率随时间的变化，刻画了在沙箱中可观察到的运行时行为比例。最后，基于不同时间窗口收集的数据，实现了机器学习驱动的恶意软件检测方法，并报告了不同时间点观察到的事件的重要性。该研究有助于安全分析师在资源效率和检测有效性之间找到平衡点。

该论文研究了跨孤岛联邦学习（FL）中的记录级个性化差分隐私（DP）问题。现有方法通常假设所有记录具有统一的隐私预算，提供“一刀切”的解决方案，无法满足每条记录特定的隐私需求。作者提出了一个名为rPDP-FL的新型框架，采用两阶段混合采样方案：包括均匀的客户端级采样和非均匀的记录级采样，以应对不同的隐私要求。该框架允许每个记录根据其隐私需求设置个性化的隐私预算，并通过精心设计的采样机制确保整体训练的收敛性和效率。实验部分（在摘要中未详述）可能通过标准数据集验证了该框架在满足个性化隐私约束的同时，保持了模型的效用。该方法适用于多个数据持有者（如医院、银行）在隐私法规要求下协作训练模型，且每个数据点可能有不同的隐私敏感度。论文的核心贡献在于首次系统性地解决了跨孤岛FL中的记录级个性化隐私保护问题，并提出了可实际部署的算法框架。

该论文基于对30名具有加密代码更新经验的开发者和安全专家的半结构化访谈，系统研究了在实践中更新加密代码（如替换旧加密算法、升级库版本、迁移到新标准）时的实际做法、经验教训和面临的挑战。研究发现，开发者普遍依赖经验法则和社区最佳实践，缺乏系统性的更新指南；组织因素如时间压力、遗留系统兼容性和团队知识分布显著影响更新决策；正式的安全测试和验证机制在实践中经常被省略。论文提出了一个描述加密代码更新过程的框架，并指出了自动化工具、更好的文档和跨团队沟通机制可改进的领域。该研究为开发安全工具、改进API设计和组织安全策略提供了实证依据。

无人机开源飞控 PX4-Autopilot堆栈溢出漏洞 CVE-2025-15150

MongoDB内存泄漏 CVE-2025-14847(MongoBleed)

1Panel 代理证书验证绕过导致任意命令执行漏洞(CVE-2025-54424)

ModelContext Inspector 未授权访问漏洞(CVE-2025-49596)

llamaindex SQL 注入漏洞(CVE-2025-1750)

Screen 本地权限提升漏洞(CVE-2025-23395)

Zabbix认证后SQL注入漏洞(CVE-2024-42327)

ProjectSend认证绕过漏洞(CVE-2024-11680)

PyTorch库RPC框架反序列化RCE漏洞(CVE-2024-48063)

Grafana认证后DuckDB-SQL注入漏洞(CVE-2024-9264)

SPIP BigUp Unauthenticated RCE(CVE-2024-8517)

Rejetto HFS 远程命令执行漏洞(CVE-2024-39943)

Apache HugeGraph-Server Command Execution In Gremlin（CVE-2024-27348）

Zabbix 后台延时注入(CVE-2024-22120)

CrushFTP 认证绕过漏洞（CVE-2024-4040）

Alert for CVE-2026-21992

Alert for CVE-2025-61884

Alert for CVE-2025-61882

Alert for CVE-2024-21287

Alert for CVE-2022-21500

Alert for CVE-2021-44228

Linux 内核提权 CVE-2026-31431(copy-fail)

Alert for CVE-2026-35273

【安全通告】Linux Kernel "GhostLock" 本地权限提升漏洞风险通告（CVE-2026-43499）

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk

Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack

### Summary The Local REST API's `/vault/{path}` endpoints (GET/PUT/PATCH/POST/DELETE) percent-decode the request path *inside the handler — after* Express has already routed and normalized it, then hand it to the Obsidian vault adapter with no confinement check. A literal `../` is resolved/rejected at the routing layer (→ 404), but `%2F` is not a separator there, so `..%2F..%2F` survives routing

本文是第2届ACM安全与可信超级应用研讨会（SaTS '24）的介绍。超级应用（Superapps）是一类集成了多种服务（如支付、社交、出行）的平台，近年来在移动生态中快速普及。然而，其高度集成的特性带来了新的安全与隐私挑战，例如跨服务数据泄露、权限滥用、恶意插件等。本次研讨会旨在汇聚学术界与工业界的研究者，共同探讨超级应用的安全机制、可信计算基础、用户隐私保护、恶意行为检测等关键问题。会议可能包括原创研究论文、系统设计、实证分析以及未来方向讨论。尽管摘要未提供具体技术细节，但该研讨会反映了当前超级应用安全领域的最新关注点和研究趋势。

本研究从信息论角度系统分析了生成模型（如LLM）输出水印的取证能力，构建了从检测、归因、提取到定位的“取证阶梯”，并量化了每级阶梯所需的样本长度（token数）代价。核心创新在于提出了“信息轮廓”概念ν(t)=I(S;X_t|X_{<t})，刻画每个token关于秘密S（用户身份或载荷）的信息量。主要定理证明：对于统计无失真的水印方案，要在一段文本中归因到N个用户之一，所需token数为Θ(log N/h)，其中h是信源熵率，且常数因子精确到(1+o(1))，这是首个紧的多用户归因熵率定律；提取ℓ比特载荷需要Θ(ℓ/h)个token。理论还揭示两个真实间隙：一是存在一段长度Θ(log N)的窗口，该区间文本可证明由机器生成但无法归因；二是足迹-分辨率不确定原理。实验在GPT-2、Pythia-410M和Qwen2.5上验证了理论预测常数。

本文提出了一种名为“Proof in a Bottle (PiB)”的长期可验证秘密共享方案，旨在应对量子计算对传统可验证秘密共享（VSS）的威胁。传统VSS（如Pedersen承诺）在Shor算法运行的密码学相关量子计算机（CRQC）面前不再安全。PiB的核心思想是将验证性与长期绑定解耦：在量子计算尚未成熟的“量子前窗口”内，使用标准的Pedersen承诺实现零知识、公开可验证的一致性；同时，将秘密份额集合的带盐索引哈希锚定到不可变公共账本（如区块链）上，从而将量子前窗口内建立的绑定关系延续到量子后时代。该方案本质上是“先承诺，后揭示”，保护今天的诚实交易免受未来量子敌手的攻击。PiB不依赖量子安全假设，而是利用时间差：绑定发生在量子威胁成为现实之前，后续只需保持哈希和账本的完整性。实验分析表明，PiB在计算和存储开销上可行，适用于长期托管、遗嘱执行等需要超长时效的秘密共享场景。

论文提出 EXP-SEC 框架，旨在为基于深度学习的网络入侵检测系统（DL-based NIDS）生成的告警提供可解释性，使得安全运营中心（SOC）的分析师能够理解告警背后的原因。现有可解释性方法（如 xNIDS）在复杂网络流量特征依赖（如特征重叠分组、组间重要性差异）方面处理能力不足，且生成的解释往往不够直观。EXP-SEC 包含三个核心模块：（1）取证模块：从告警关联的原始流中隔离出最可能触发告警的可疑数据包或流；（2）解释模块：采用创新的分组级可解释性算法，能够处理特征之间的重叠分组和非均匀重要性，生成特征与分组级别的归因权重；（3）多阶段映射模块：将解释模块输出的特征/分组级解释，通过层次化映射转换为安全分析师易读的领域特定解释（例如“某IP的异常连接频率”）。实验基于最新的 DL-based NIDS（如 CNN、LSTM 等）进行评估，结果表明：在分组级和重叠感知的解释效用指标上，EXP-SEC 显著优于 xNIDS；在传统特征级指标（描述准确性、稀疏性、稳定性）上与 xNIDS 相当。此外，论文还给出了一个案例，展示 EXP-SEC 生成的解释格式如何帮助分析师快速定位攻击模式。该工作适合 SOC 分析师、入侵检测系统开发者和可解释 AI 研究人员阅读。

该论文针对Android应用隐私与安全审计中数据流分析任务存在的重复分析成本问题，提出了一种基于知识复用的系统性解决方案FlowArk。在批处理模式下，多个代理实例分别处理不同的污点源到汇点的数据流分析任务，但由于代码复用导致不同数据流路径共享相同代码片段，传统方法中相互隔离的代理实例会重复分析这些共享代码，浪费API预算并限制可扩展性。FlowArk通过将已完成分析的历史知识蒸馏为可复用的知识候选，并封装成可匹配的知识条目，在后续代理实例的上下文中注入匹配的知识，从而避免重复分析。实验在50个开源Android应用的4,685个数据流分析任务上评估，基于OpenCode实现。结果表明，FlowArk在保持相似分析质量的同时，将端到端API成本降低26.83%，且在100美元预算下完成的任务数比标准OpenCode多36.66%（1060 vs 776）。该工作为大规模自动化数据流分析的高效部署提供了新思路。

随着AI音乐生成技术的快速发展及其在商业平台上的广泛应用，对生成音乐进行可靠溯源和归属认证的需求日益迫切。然而，现有的音频水印研究主要针对语音，而音乐具有复杂的结构和丰富的声学纹理，直接应用语音水印方法面临巨大挑战。大多数现有方法都是事后式（post-hoc），即在生成完成后添加人耳无法感知的微扰来嵌入水印，而非将水印作为内容的一部分进行生成。这种解耦方式导致水印易于受到各种变换攻击，尤其是神经编解码器重合成攻击，该攻击会丢弃无法感知的残留信号，从而破坏水印。此外，由于生成与水印过程分离，攻击者可以绕过或省略水印步骤，削弱了水印的可靠性。为了解决这些问题，本文提出了MusicMark，这是首个面向音乐生成的生成式水印框架。MusicMark在生成过程中将水印消息嵌入到语义潜在空间中，使水印成为音乐内容不可分割的一部分，从而确保对多种攻击特别是神经编解码器重合成的鲁棒性。具体而言，作者在基于扩散的生成模型中引入了一个水印适配器，在去噪步骤中逐步嵌入水印消息。水印适配器和检测器通过联合目标进行训练：一方面通过约束加水印后的潜在变量接近未加水印的参考潜在变量来保持生成质量；另一方面通过攻击增强训练提高鲁棒性。实验表明，MusicMark在包括神经编解码器重合成在内的多种攻击下显著优于事后式基线方法，同时保持了相当的生成质量。此外，论文还引入了一种翻唱歌曲攻击，即转换歌声但保留音乐内容，测试表明MusicMark比事后方法更具鲁棒性。该研究为音乐版权保护和内容溯源提供了新的技术路径，适合AI安全研究人员、音乐生成平台开发者以及版权保护从业者阅读。

现代车载网络面临内部电子控制单元（ECU）和外部车联网（V2X）通信不断扩大的攻击面。联邦学习（FL）作为一种去中心化范式，被用于在不牺牲数据隐私的前提下部署入侵检测系统（IDS）。然而，车载FL-IDS文献存在方法论碎片化和实验设置不切实际的问题。本文呈现了一篇系统化知识（SoK）论文，统一了车载攻击面的分类学，评估了FL拓扑结构，并映射了投毒攻击和推理攻击等对抗性威胁。通过审计60多篇出版物，识别出反复出现的陷阱：人为的独立同分布（IID）数据划分、依赖琐碎的基准测试、对抗性评估薄弱、以及忽略实时CAN总线约束。最后，定义了一个前瞻性研究议程，并概述了将车载FL-IDS从乐观仿真过渡到安全现实部署所需的最低基准测试要求。

本文针对基于IoMT的远程老年人护理系统中的安全与隐私挑战，提出了一个名为Secure Edge Gateway (SEG) 的综合安全架构。现有研究未能同时满足三个相互依赖的需求：GDPR合规的边缘层假名化、针对老年人的零交互可用性约束，以及基于STRIDE的威胁验证。SEG框架通过软件仿真验证，在ESP32-WROOM-32家庭网关上实现了MAC地址白名单、HMAC-SHA256加密假名化（在网络传输前执行）、AES-128-CBC有效载荷加密和TLS 1.3传输安全，符合GDPR第25条和第32条。验证方法包括软件仿真、全面的STRIDE威胁建模（覆盖所有六类威胁）、攻击树分析、九项监管义务的GDPR合规映射，以及根据第35条进行的数据保护影响评估（DPIA）。已发布的基准测试表明，在类似IoT部署中，MQTT比HTTP能耗低6-8%；边缘处理可实现低于50毫秒的响应延迟，而纯云系统延迟为200-700毫秒。结果表明，在资源受限的IoMT老年人护理部署中，GDPR合规与运营效率是互补而非竞争的目标。该架构为设计安全、隐私合规且可用的远程医疗系统提供了参考。

SonicWall warns that threat actors have been exploiting two SMA1000 vulnerabilities, tracked as CVE-2026-15409 and CVE-2026-15410, in zero-day attacks and urges customers to install the newly released security updates. [...]

OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or later.

Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link values before rendering feed item titles and Read More links as anchor href attributes, allowing an attacker-controlled feed to provide a javascript: URI that executes when clicked in the Dashy origin. This issue is fixed in version 3.2.0.

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized modification of dashboard configuration and potential service disruption. This issue is fixed in version 4.0.8

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection that bypasses validateGitUrl() dangerous parameter checks and can execute commands through local or SSH-s

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Repomix MCP server attach_packed_output and read_repomix_output flow can register and read arbitrary local .json, .txt, .md, or .xml files without the file_system_read_file runSecretLint() safety check or Repomix packed-output validation, allowing MCP callers to bypass the local file-read secret-scanning boundar