Chrome for Android Update
Hi, everyone! We've just released Chrome 150 (150.0.7871.186) for Android. It'll become available on Google Play over
2026-07-25 归档
今日共收录 771 条安全情报，包含 0 个 CVE，408 篇安全通告，以及 82 篇研究论文。
← 返回归档列表Chrome Dev for Android Update
Hi everyone! We've just released Chrome Dev 152 (152.0.7965.2) for Android. It's now available on Google Play.You can se
Which Model Is Actually Serving You? IRIS: Budgeted Black-Box Auditing of Model Substitution and Routing Dilution in LLM Gateways
本文提出 IRIS，一种用于审计商业 LLM 网关（gateway）是否如实提供所声称后端模型的黑盒审计方法。商业网关通常会路由请求到多个模型，但可能暗中替换为更廉价的模型（全流替换），或仅将部分请求（ε 比例）路由到广告模型而其余由另一模
Buzz to Boom: Detecting Message Progression Vulnerabilities in Electron Applications via Segmented Directed Fuzzing
本文针对 Electron 桌面应用中的消息传播漏洞（Message Progression Vulnerabilities, MPVs）提出了一种名为 Proton 的分段定向模糊测试框架。Electron 应用由多个不同权限的进程组成，
An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports
本文提出一种自动化框架，用于从网络安全威胁情报（CTI）报告中提取可到达的攻击链。现有CTI提取方法主要关注指标、实体或TTP标签，但未建模每个攻击步骤的执行条件和结果状态，因此无法支持状态匹配或多阶段攻击链的可达性分析。该框架将每个攻击步
FedLSG: LLM-Enhanced Semantic Calibration for Federated Graph Backdoor Defense
联邦图神经网络（FedGNN）在分布式图数据学习中具有广泛应用，但面临后门投毒攻击的严重威胁。现有防御方法多基于规则，缺乏对攻击触发器的语义理解，容易受到隐蔽触发器的攻击，同时可能破坏良性图结构。为此，本文提出 FedLSG，首个将大语言模
They'll Verify. They Just Won't Act. How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface
本文研究了一个由五个智能体组成的CI/CD流水线（分诊→开发→安全扫描→审查→批准/部署），这些智能体基于来自三家不同提供商的五个独立生产级LLM，并在影子模式下部署LLM防火墙。研究关注单个不受信任的输入——一个请求“使用-遥测”功能的外
Tracing the Shadows: Automatic Tracking and Analysis of Crypto Money Laundering via Transaction Semantic Analysis
论文提出AMLGuard，一种面向账户型区块链的语义感知反洗钱(AML)框架。针对DeFi生态中日益频繁的加密货币安全事件，攻击者通常在被盗后迅速通过复杂交易转移资产、隐藏非法资金来源并最终兑换为法定货币。现有AML方法难以处理DeFi交易
Find Before You Fine-Tune: A Diagnostic Study of Small LLMs for Cybersecurity QA
该论文针对网络安全领域中小型大语言模型（LLM）的微调选择问题，提出了一种任务导向的诊断框架FiT（Find before Fine-Tune）。研究背景是：在网络安全问答（QA）这样的关键领域，微调可以提升领域对齐，但可能侵蚀预训练知识、
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud