MFSA 2026-66Security Vulnerabilities fixed in Firefox for iOS 152.4
MFSA 2026-66Security Vulnerabilities fixed in Firefox for iOS 152.4
2026-07-28 归档
今日共收录 1224 条安全情报，包含 453 个 CVE，382 篇安全通告，以及 98 篇研究论文。
← 返回归档列表APSB26-77: Security update available for Adobe Creative Cloud Desktop Application
APSB26-77: Security update available for Adobe Creative Cloud Desktop Application
iOS 26.6 and iPadOS 26.6
iOS 26.6 and iPadOS 26.6
Traceable LLM Reasoning for Fake-Order Fraud Detection
该论文针对大规模在线到线下（O2O）服务平台中虚假订单欺诈检测面临的挑战，提出了一种基于大语言模型（LLM）的强化学习框架 DeepScrub，旨在解决现有方法依赖专家手工特征、决策黑盒化且可解释性差的问题。DeepScrub 包含三项创新
ZKP Security Tools and Verification: Coverage, Effectiveness, Adoption, and Challenges
本文系统性地研究了零知识证明（ZKP）安全工具和验证方法的现状。ZKP作为隐私和可验证计算的核心技术，已被广泛用于保护价值数十亿美元的区块链和处理敏感个人数据的身份应用。然而，ZKP系统复杂，细微的实现错误可能完全破坏其安全保证，导致攻击者
ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents
本文提出 ContainmentBench，一个基于轨迹的基准测试，用于评估工具使用型 LLM 代理在注入攻击后的遏制能力。现有研究通常以终端策略结果（如是否达成攻击目标）来概括安全性，但相同终端结果可能掩盖不同的暴露后轨迹和授权效用损失。
TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation
该论文提出 TriShieldRAG，一个三环纵深防御框架，用于抵御检索增强生成（RAG）系统中的知识投毒攻击。RAG 通过从外部知识库检索文档来辅助大语言模型（LLM）回答问题，但若知识库接受多方写入，攻击者只需少量对抗性文档即可操控模型
A Structured Cyber Threat Intelligence Dataset Using STIX 2.1 Entities and MITRE ATT&CK Mappings
该论文针对网络威胁情报报告通常以非结构化文本形式存在，导致实体提取和对抗行为分析困难的问题，提出并构建了一个人工标注的结构化CTI数据集。研究者收集了150份英文CTI报告，使用STIX 2.1标准将其转化为图结构，包含4,777个STIX
Ethereum NFT Smart Contracts: Knowledge-Guided Vulnerability Detection with LLM and Code Slicing
该论文针对以太坊非同质化代币（NFT）智能合约中的漏洞检测问题，提出了一种结合漏洞导向代码切片、ERC-721 知识库和受限大语言模型（DeepSeek）分析的方法。研究背景是：现有静态分析工具（如 Slither、Mythril）基于规则
HarnessLLM: Rust Verification Harness Generation with Large Language Models
Rust语言的所有权模型和类型系统提供了强大的内存安全保障，但unsafe代码和运行时panic依然带来显著风险。形式化验证是确保内存安全的关键，然而开发验证harness（验证框架）是一项具有挑战性的手动任务。虽然大语言模型在各类代码分析
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey