xChk: Bring Your Own Identity -- Heterogeneous Assurance with Verifier-Determined Sufficiency
本文提出了一种名为 xChk 的参考身份提供商，用于实现“自带身份”（Bring Your Own Identity, BYOI）模式。在 BYOI 中，用户可以通过多种异构证明方式进行注册，包括政府 KYC、企业 SSO、WebAuthn
2026-07-16 归档
今日共收录 1958 条安全情报，包含 992 个 CVE，550 篇安全通告，以及 113 篇研究论文。
← 返回归档列表Open-Source Intelligence for Code Provenance and the Security Patterns that Separate Human and Large-Language-Model Implementations of Common Programming Tasks
本研究针对开发者从两个截然不同的来源获取代码的现状——一是Stack Overflow等平台上积累的人类答案，二是大型语言模型（LLM）的输出——提出了两个核心问题：第一，能否仅从代码本身恢复其出处处（人类还是模型）？第二，两种来源在完成相
Efficient and Privacy Aware Edge Cloud Collaborative Inference for Large Language Models
本文提出了一种面向大型语言模型（LLM）的高效且保护隐私的边缘-云协同推理框架。当前，设备端LLM推理面临响应延迟、硬件资源有限和用户隐私保护的三难困境。完全在云端推理虽然计算能力强，但会暴露用户提示和对话数据；而完全在设备端推理对于大多数
MindReader: Using LLMs to Encourage Memorable and Secure Password Replacement
用户被迫更换密码时，常常会生成原密码的可预测变体（如增加数字或改变大小写），这给攻击者提供了可乘之机。本文提出并评估了 MindReader 工具，该工具利用大型语言模型（LLM）帮助用户生成既容易记忆又难以被攻击者猜测的密码替换方案。Mi
Securing LLMs in the Wild: Privacy and Security Challenges at the Edge
该论文研究了大型语言模型（LLM）从云端向边缘和本地部署迁移过程中面临的安全与隐私挑战。作者指出，边缘设备有限的计算和内存资源迫使采用量化、剪枝、模型分区和参数高效微调等激进优化手段，这些优化在提升效率的同时可能引入新的漏洞或加剧已有的安全
LLM-Guided Program Evolution for Targeted Black-Box Attacks on Perceptual Hash Algorithms
该论文提出了一种基于大语言模型引导的演化框架（结合GigaEvo和OpenEvolve），用于对感知哈希算法（PHA）实施有针对性的黑盒第二图像攻击。感知哈希算法广泛应用于图像篡改检测，但对抗性扰动的鲁棒性研究不足。作者设计了一个复合评分函
PromptGraph: Graph-Guided Prompt Sanitization for Balancing Privacy and Utility in LLM Inference
本论文针对大型语言模型（LLM）服务中的隐私保护问题提出了一种新的提示清洗方法PromptGraph。LLM推理过程中，用户的敏感信息不仅可能通过显式标识符（如姓名、电话号码）泄露，还可能通过看似无害的文本片段之间的上下文关联被推断。现有的
The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)
Unit 42 发布了对 npm 供应链威胁格局的深入分析，指出自“Shai Hulud”事件以来，攻击者不断演进其攻击方式。报告揭示了新型蠕虫性恶意软件，能够自我复制并横向传播，同时利用 CI/CD 管道实现持久化，并在多个阶段执行恶意操
WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote ...
CVE-2026-54458
CVE-2026-54458 影响 WWBN AVideo 开源视频平台版本 29.0 之前。该漏洞位于 YPTSocket 插件中，是一个存储型 DOM 跨站脚本（XSS）漏洞。攻击原理：未经认证的远程攻击者可以通过 WebSocket
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud