ProfMalPlus: Agent-Coordinated Detection of Malicious NPM Packages via Static-Dynamic Analysis Synergy
开源软件易受针对传递依赖的供应链攻击，尤其恶意代码注入NPM包。现有检测器常存在以下不足：对混淆行为的建模不充分，忽视JavaScript的面向对象特性，静态与动态分析协调不佳，以及行为抽象过程中丢失语义信息。为此，本文提出ProfMalP
2026-07-18 归档
今日共收录 1491 条安全情报，包含 418 个 CVE，581 篇安全通告，以及 194 篇研究论文。
← 返回归档列表xChk: Bring Your Own Identity -- Heterogeneous Assurance with Verifier-Determined Sufficiency
本文提出了 xChk 系统，一种参考身份提供者（IdP），用于实现“自带身份”（BYOI）模式。用户可以通过多种异构证明方式注册，包括政府KYC、企业SSO、WebAuthn/FIDO2、专业网络、实时验证、长期活动数据、行为信号等。这些证
Open-Source Intelligence for Code Provenance and the Security Patterns that Separate Human and Large-Language-Model Implementations of Common Programming Tasks
本研究探讨了现代软件开发中两个重要问题：能否仅通过代码片段本身判断其来源（人类编写还是大语言模型生成），以及这两种来源在实现同一编程任务时是否存在安全模式上的差异。作者构建了一个完全可复现的开源情报管道，利用公开的Stack Overflo
WaterMoE: Expert-Routing-based Watermarking for High Fidelity and Efficiency
本文针对大型语言模型（LLM）水印技术在实际部署中面临的两大挑战——模型性能严重下降和额外推理开销——提出了基于混合专家（MoE）架构的水印方案 WaterMoE。作者首先构建了一个涵盖多种生成任务的综合基准，系统评估了9种代表性水印方法，
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<association>? in the UI and...
CVE-2026-55518
Avo 是一个用于 Ruby on Rails 应用创建管理后台的框架。在版本 3.32.1 和 4.0.0.beta.51 之前，Avo 的关联附加工作流在 UI 和 GET /resources/:resource/:id/:relat
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Least privilege for AI agents: Identity, access, and tool binding
As AI agents become more autonomous, strong identity, access, and auditing controls are critical to keeping them secure.
Microsoft at Black Hat USA 2026: Defending trust in the age of AI and supply chain attacks
Join Microsoft Security at Black Hat USA 2026 for supply chain research, hands-on security experiences, expert conversat
Inside the Search for "Clean" Residential Proxies for Carding
Residential proxies are no longer the silver bullet they once were for carding. Flare explains why cybercriminals increa
Preventing SIM Box Fraud Using Device Model Fingerprinting.
该论文提出了一种利用设备模型指纹识别技术来检测和防止SIM BOX欺诈的新方法。SIM BOX欺诈是一种通过将国际电话伪装成本地电话来绕过国际呼叫费用并用于非法活动的攻击。现有的检测方法主要依赖通话行为分析（如呼叫模式、位置变化等），但攻击