\textsc{IH-Benchmark}: A Conflict-Centered Benchmark for Instruction-Hierarchy Robustness in LLM Applications
该论文提出了 IH-Benchmark，一个专注于指令层级鲁棒性的基准测试，用于评估大型语言模型（LLM）在接收来自不同优先级的冲突指令时的行为。现有基准大多仅关注单一层级边界或使用有限的工具调用覆盖。IH-Benchmark 覆盖了直接系
2026-07-29 归档
今日共收录 1422 条安全情报，包含 510 个 CVE，504 篇安全通告，以及 114 篇研究论文。
← 返回归档列表SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents
本文针对AI编码助手（如Cursor、Claude Code、GitHub Copilot）中技能文件（skill files）的供应链安全威胁展开研究。编码助手通过安装领域特定的Markdown技能文件来定制化行为，这些文件可从公共注册中
ZIMPAF & RedPhuzz: High-fidelity Web Application Fuzzing via Branch, Language Construct, and Function Call Monitoring
本文提出 ZIMPAF 运行时解释器插桩技术和 RedPhuzz 模糊测试器，以解决现有 web 应用模糊测试的三个关键限制：低效的插桩、对执行环境缺乏了解以及有限的 web 领域知识。ZIMPAF 实现了一种新颖的多粒度运行时解释器插桩，
ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents
该论文针对工具使用型LLM代理（Tool-using LLM Agents）面临的关键安全问题——注入后遏制（Post-Injection Containment）进行了深入研究。现有提示注入（Prompt Injection）评估通常仅以
TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation
检索增强生成（RAG）通过从外部知识库检索文档来辅助大语言模型回答，降低了幻觉并支持私有数据，但同时也引入了知识投毒的风险：攻击者只需注入少量对抗性文档即可操控模型输出。PoisonedRAG 攻击表明，仅需 5 个精心设计的文档就能使未防
ZKP Security Tools and Verification: Coverage, Effectiveness, Adoption, and Challenges
零知识证明（ZKP）已成为隐私保护和可验证计算的核心技术，广泛应用于保障价值数十亿美元的区块链系统以及处理敏感个人数据的身份应用。然而，ZKP系统实现复杂，微小的实现错误可能完全破坏其安全保证，使攻击者能够伪造资产或身份证明。为此，研究人员
Traceable LLM Reasoning for Fake-Order Fraud Detection
本文针对大型线上到线下（O2O）服务平台中虚假订单检测的挑战，提出了一种基于大语言模型（LLM）的可追溯推理强化学习框架DeepScrub。现有方法通常依赖专家设计特征、做出黑盒决策且可解释性有限。DeepScrub包含三项创新：首先，语义
A Structured Cyber Threat Intelligence Dataset Using STIX 2.1 Entities and MITRE ATT&CK Mappings
网络威胁情报（CTI）报告通常以非结构化格式编写，这给提取关键实体和对抗行为带来了困难。尽管现有研究提供了提取工具、知识图谱框架和基于MITRE ATT&CK映射的数据集，但能够保留复杂实体关系并规范化对抗行为的报告级数据集仍然有限。为解决
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and...
CVE-2026-64863
CVE-2026-64863 影响 goshs（一个功能丰富的单二进制文件服务器，面向红队和开发者）在 2.1.4 之前版本。漏洞位于 httpserver/server.go 中的 wdGuard 处理 WebDAV MOVE 方法时，将
goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Pa...
CVE-2026-62325
CVE-2026-62325 是 goshs 文件服务器中的一个认证绕过漏洞，影响版本 2.1.3 至 2.1.4。goshs 是一个功能丰富的单二进制文件服务器，面向红队和开发者。在版本 2.1.4 之前，sftpserver/sftps
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey