Chrome for Android Update
Hi, everyone! We've just released Chrome 151 (151.0.7922.71) for Android. It'll become available on Google Play over
2026-07-30 归档
今日共收录 1598 条安全情报，包含 743 个 CVE，444 篇安全通告，以及 115 篇研究论文。
← 返回归档列表Beta Channel Update for ChromeOS / ChromeOS Flex
The Beta channel is being updated to OS version 16733.33.0 (Browser version 151.0.7922.56) for most ChromeOS devices.If
ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents
本文提出ContainmentBench，一个基于轨迹的基准测试，用于评估使用工具的LLM代理在遭受提示注入后的遏制能力。现有的评估通常只关注端点安全（如是否达成攻击目标或策略违规），但相同端点结果可能掩盖不同的暴露后轨迹和授权效用损失。C
SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents
本文针对AI编码代理（如Cursor、Claude Code、GitHub Copilot）中技能文件（Skill File）带来的新型供应链攻击面，提出了一种成本高效的运行时恶意检测系统SkillGate。技能文件是Markdown格式的
ToxScreen: Detecting Whether an LLM Has Been Poisoned
随着大语言模型（LLM）在医疗、金融等高风险领域的部署，攻击者可能通过投毒训练数据植入后门：在推理时，特定触发器（trigger）会隐蔽地操纵模型行为。本文提出一个现实场景下的防御问题：防御者仅拥有模型权重的白盒访问权限、了解关注的特定行为
IH-Benchmark: A Conflict-Centered Benchmark for Instruction-Hierarchy Robustness in LLM Applications
该论文提出 IH-Benchmark，一个以冲突为中心的基准测试，用于评估大语言模型（LLM）应用中的指令层次鲁棒性。研究背景是，当LLM收到来自不同优先级的冲突指令时，其行为可靠性对安全部署至关重要。现有基准仅覆盖部分层次边缘或使用有限的
ZIMPAF & RedPhuzz: High-fidelity Web Application Fuzzing via Branch, Language Construct, and Function Call Monitoring
该论文提出了ZIMPAF和RedPhuzz两个系统，以克服现有Web应用模糊测试工具的三大局限性：插桩效率低、缺乏执行环境知识、以及有限的Web领域知识。ZIMPAF是一种运行时解释器插桩工具，实现了多粒度插桩，不仅能提供分支覆盖率，还能监
TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation
检索增强生成（RAG）通过引入外部知识库，使大语言模型能够基于检索到的文档生成答案，从而减少幻觉并适应快速变化的信息。然而，RAG 系统面临知识投毒攻击：攻击者只需上传少量对抗性文档，就能操纵模型输出错误答案。PoisonedRAG 研究显
ZKP Security Tools and Verification: Coverage, Effectiveness, Adoption, and Challenges
零知识证明（ZKP）已成为隐私和可验证计算的核心技术，广泛应用于保护处理数十亿美元的数字货币区块链以及处理敏感个人数据的身份应用。然而，ZKP系统复杂，细微的实现错误可能完全破坏其安全保障，使攻击者能够伪造货币或身份证明。为此，研究人员和从
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitati...
CVE-2026-48449
CVE-2026-48449 是 Adobe Campaign Classic (ACC) 中一个严重的不正确授权漏洞。攻击者可以在无需用户交互的情况下，远程利用此漏洞，在受害者会话上下文中执行任意代码。由于漏洞影响范围发生变化（Scope
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey