CISA shares advice on isolating vital systems during cyberattacks
The U.S. and Australian governments have released new guidance urging critical infrastructure organizations to prepare t
2026-07-30 归档
今日共收录 1598 条安全情报，包含 743 个 CVE，444 篇安全通告，以及 115 篇研究论文。
← 返回归档列表vBulletin fixes critical pre-auth RCE flaw with public exploit
A critical vulnerability in the vBulletin forum software allows unauthenticated attackers to execute arbitrary PHP code
Better security starts with better questions
Learn how better questions, trusted AI, and human judgment help security leaders make confident decisions and build resi
Anthropic confirms Claude is down worldwide
Claude is down for some users, with Anthropic confirming elevated errors across multiple AI models. The disruption is ca
Health-ISAC warns of rising ShinyHunters data theft attacks on healthcare
Health-ISAC, a cybersecurity information-sharing organization for the health sector, is warning healthcare and medical t
OpenAI agent used exposed credentials at 4 services in Hugging Face breach
In a new update, OpenAI says its AI models also used publicly exposed credentials to compromise accounts on four third-p
Hackers disrupt over 30 Minnesota water utilities in coordinated OT attack
The Minnesota IT Services (MNIT) agency activated its cybersecurity incident response capabilities across the entire sta
Windows 11 KB5101684 update released with 42 changes and fixes
Microsoft has released the KB5101684 preview cumulative update for Windows 11 24H2 and 25H2, which 42 bug fixes and ad
These near-mint ASUS Chromebook refurbs are only $145
Buying a new computer in 2026 is a unique experience. Rather than deal with incredibly high tech prices, more shoppers a
Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js
Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access tro
Not In My Git Yard: Catching Backdoors at Commit and Release Time
该论文提出了一种名为 Lily 的自动化方法，旨在增强开源软件开发和发布流程对代码级后门注入的防御能力。代码级后门是通过恶意提交、篡改的发布包或受损的第三方依赖等途径，植入隐蔽触发条件的恶意代码，对开源项目构成持续威胁。现有持续集成（CI）
Stemma: Induced Decision Regions Reveal LLM Provenance
该论文针对大型语言模型（LLM）的来源测试问题，即判断一个可疑LLM是否与某个源LLM属于同一谱系。现有的黑盒方法通常基于响应级别的特征（如输出文本的统计特性）来推断谱系关系，但这些特征在模型适应或部署过程中可能发生改变，即使底层语义保持不
Architectural Backdoors in Vision-Language Model Supply Chains via Representation Steering
该论文揭示了视觉-语言模型（VLM）供应链中的新型安全威胁。VLM通常通过模型供应链进行部署，其中预训练检查点、架构定义、文本编码器和导出计算图等组件由第三方分发，并在下游服务中复用。这种复用模式创建了一个关键的安全信任边界：VLM部署不仅
Decision-Level Hijacking: Injecting Cognitive Bias into Large Language Models via Bit-Flip Attacks
该论文提出了一种针对大语言模型（LLM）的新型攻击范式——决策级劫持（Decision-Level Hijacking）。攻击者通过部署后仅翻转极少量权重比特（Bit-Flip Attack）的方式，在不触发违规内容或降低模型功能的前提下，
On-Policy Distillation for LLM Safety: A Routing Approach to Template-Robust Realignment
针对大型语言模型（LLM）的微调范式存在严重安全隐患：恶意数据提供者可在下游数据中嵌入有害行为，使模型在保持专业技能的同时，按需违背人类价值观。现有安全重对齐防御方法普遍面临三大局限：1）频繁导致专业技能的灾难性遗忘；2）当防御者无法观测攻
MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair
这篇论文提出了 MemSecBench，一个专门评估智能体（agent）记忆系统生命周期安全的基准。研究背景是：当前大型语言模型（LLM）驱动的智能体常使用记忆系统来保留和复用历史交互信息，但这种设计也引入了安全风险——攻击者可能将恶意指令
HoF-Bench: Rediscovering Real AI-Discovered CVEs Without Frontier Models
本文提出了 HoF-Bench，一个用于评估基于大语言模型（LLM）的漏洞分析器的基准测试集。该基准测试源自 AISLE 公司的公开 Hall of Fame 列表，包含 95 个由 AI 系统发现的实际 CVE，涉及 OpenSSL、cu
AgentSnare: Learning to Delay, Divert, and Defuse Autonomous Penetration Agents
该论文针对大型语言模型（LLM）驱动的自动化渗透测试代理提出了一种动态欺骗防御系统——AgentSnare。传统防御依赖预置静态诱饵，但高级攻击代理能逐步识别并绕过这些诱饵，最终将攻击目标重新聚焦于真实目标。为解决此问题，AgentSnar
Before Agents Speak: Pre-hoc Failure Risk Inference in Multi-Agent Systems
该论文聚焦于基于大语言模型（LLM）的多智能体系统（MAS）中一个关键的安全问题：局部幻觉通过智能体间通信链传播、放大，最终引发级联故障。现有防御措施多为事后范式（post-hoc），即在危险行为出现后才识别故障，此时有害影响可能已在智能体
Forecasting Trajectory-Level Safety Risks in Black-Box Multi-Turn Interactions
随着大型语言模型从独立助手演变为自主代理，确保其安全性需要超越点式风险评估，理解风险如何在长程轨迹中浮现和展开。在多轮交互中，恶意意图可以分解到看似无害的轮次中，并通过交互轨迹逐渐重建，最终导致安全失败。现有防护措施大多是被动的，检测已经发