Ethereum NFT Smart Contracts: Knowledge-Guided Vulnerability Detection with LLM and Code Slicing
该论文针对以太坊NFT智能合约中的漏洞检测问题展开研究。NFT通过智能合约实现所有权、转移、授权和元数据操作，合约漏洞直接威胁数字资产安全。现有静态分析器基于规则高效筛查，但对特定应用逻辑的检测能力有限；而未经约束的大语言模型分析可能被无关
2026-07-27 归档
今日共收录 632 条安全情报，包含 14 个 CVE，301 篇安全通告，以及 58 篇研究论文。
← 返回归档列表Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Denying the Worm: Detecting SANDWORM_MODE and the Emerging Class of AI Toolchain Supply Chain AttacksJul 21, 2026
Denying the Worm: Detecting SANDWORM_MODE and the Emerging Class of AI Toolchain Supply Chain AttacksJul 21, 2026
GitHub, PyPI add time-based defenses against supply chain attacks
GitHub and PyPI (Python Package Index) have introduced a time-based mechanism in the Dependabot dependency management to
Incremental Offline/Online PIR.
该论文提出了一种增量式离线/在线私有信息检索（PIR）协议，旨在降低传统PIR方案在重复查询场景下的通信和计算开销。核心思想是将PIR过程分为两个阶段：离线阶段预先处理数据库并生成辅助数据；在线阶段利用离线结果快速响应查询，同时支持增量更新
A Hardware-Software Co-design for Efficient Intra-Enclave Isolation.
该论文提出了一种硬件-软件协同设计方法，旨在解决可信执行环境（如Intel SGX）中飞地内部隔离效率低下的问题。现有飞地设计通常将整个应用放在同一个安全边界内，缺乏内部隔离机制，导致一旦飞地内某个组件被攻破，整个飞地数据都会泄露。作者设计
SAID: State-aware Defense Against Injection Attacks on In-vehicle Network.
本文针对车载网络（IVN）面临的注入攻击威胁，提出了一种状态感知的防御机制SAID（State-aware Defense Against Injection Attacks on In-vehicle Network）。车载网络是现代汽车
Omnes pro uno: Practical Multi-Writer Encrypted Database.
本文提出了一种实用的多写入者加密数据库方案（Omnes pro uno）。传统的加密数据库通常只支持单一写入者，或者为了支持多写入者而牺牲安全特性或查询能力。该方案在保持与单写入者方案相当的安全性的同时，支持连接查询和范围查询，且性能与现有
NetCap: Data-Plane Capability-Based Defense Against Token Theft in Network Access.
本文提出了一种名为NETCAP的新型防御机制，旨在防止企业网络环境中攻击者利用窃取的访问令牌（如JSON Web Token、OAuth 2.0令牌）进行未经授权的资源访问。当前令牌机制虽然简化了身份验证流程，但存在严重安全隐患：授权主机内
To Shuffle or not to Shuffle: Auditing DP-SGD with Shuffling.
本文研究差分隐私随机梯度下降（DP-SGD）中，使用数据打乱（shuffling）替代传统泊松子采样（Poisson subsampling）时隐私保证的准确性。传统DP-SGD通过泊松子采样随机选择每轮训练批次，但打乱因计算开销低、兼容性