CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
2026-07-17 归档
今日共收录 1302 条安全情报，包含 372 个 CVE，507 篇安全通告，以及 120 篇研究论文。
← 返回归档列表cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery
Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. Th
Turning threat intelligence into decisive action with Defender Experts
Security teams have never had more visibility, yet rarely have they felt more uncertain. Signal pours in from endpoints,
Least privilege for AI agents: Identity, access, and tool binding
As AI agents become more autonomous, strong identity, access, and auditing controls are critical to keeping them secure.
AI Agents Broke the Security Playbook. Here's What Replaces It.
Traditional security workflows were built for environments that changed at human speed. Token Security explains why AI a
CyberBunker 2.0 - A Domain and Traffic Perspective on a Bulletproof Hoster.
本文对知名子弹头托管服务商 CyberBunker 2.0 进行了深入分析，重点从域名和网络流量两个维度揭示其运营模式。研究首先收集了与该服务相关的域名注册数据，发现其使用大量随机生成的域名、频繁更换注册商和顶级域，并利用隐私保护服务隐藏真
Vest: Verified, Secure, High-Performance Parsing and Serialization for Rust.
本论文针对 Rust 语言中解析和序列化操作的安全性与性能挑战，提出了一种名为 Vest 的新型框架。Rust 以其内存安全著称，但手写解析器和序列化器仍然容易出错且效率低下。现有方案（如 serde）虽提供自动化，但缺乏形式化验证，且难以
TRex: Practical Type Reconstruction for Binary Code.
本文提出了一种名为TRex的实用二进制代码类型重建方法。二进制代码缺乏类型信息，给逆向工程和安全分析带来困难。TRex通过结合静态分析和动态执行轨迹，利用符号执行和约束求解技术，从二进制代码中推断出变量的原始类型（如整数、指针、结构体等）。
QUICforge: Client-side Request Forgery in QUIC.
QUIC协议因近期标准化及各大科技公司的推动而日益普及，成为新一代传输层协议。然而，对其安全性的全面审查至关重要。本文首次系统分析了QUIC协议设计本身（而非常见漏洞）所引发的客户端请求伪造攻击。研究聚焦于三种攻击模式：协议冒充、流量放大以
Focusing on Pinocchio's Nose: A Gradients Scrutinizer to Thwart Split-Learning Hijacking Attacks Using Intrinsic Attributes.
该论文研究分割学习（Split Learning）场景下的劫持攻击防御问题。分割学习是一种分布式机器学习范式，允许多个参与方在不共享原始数据的情况下协作训练模型，但存在安全漏洞：攻击者可能劫持模型参数或梯度，窃取敏感信息。作者提出了一种名为
REDsec: Running Encrypted Discretized Neural Networks in Seconds.
REDsec 是一个基于全同态加密 (FHE) 的私有机器学习推理框架，旨在解决 MLaaS 场景中的隐私泄露风险。核心创新在于利用三元神经网络（权重约束为 {-1,0,1}）的独特性质，在密文域高效实现推理计算。REDsec 提出了新的数
PolySphinx: Extending the Sphinx Mix Format With Better Multicast Support.
混合网络（Mix networks）是一种隐藏通信元数据的成熟技术，但在群组通信场景中开销较高，阻碍了其实际应用，因为群组通信是现代通信模式的重要组成部分。本文提出“PolySphinx”，一种扩展Sphinx混合格式的混合网络格式，旨在高
Who Left the Door Open? Investigating the Causes of Exposed IoT Devices in an Academic Network.
该研究针对一所大学的企业网络，系统调查了其中暴露Telnet和FTP服务的IoT设备存在的根本原因。研究者首先对网络进行扫描，发现了185台IoT设备，涵盖30个暴露Telnet的设备型号和49个暴露FTP的设备型号。随后向设备所有者发送安
Hidden Backdoors in Human-Centric Language Models.
本文研究了针对人类中心型自然语言处理（NLP）系统的隐蔽后门攻击，提出两种生成自然且隐蔽触发器的后门植入方法。第一种方法利用同形字替换（homograph replacement），通过视觉上相似但编码不同的字符（如拉丁字母与西里尔字母）替