Browser Security: Zero-Days Are Only Part of the Problem
Browser Security: Zero-Days Are Only Part of the Problem
2026-08-24 归档
今日共收录 798 条安全情报，包含 82 个 CVE，390 篇安全通告，以及 72 篇研究论文。
← 返回归档列表IDC business value studyTurn security into business growth
IDC business value studyTurn security into business growth
How AI-leading Security Teams Are Building the Agentic SOC
How AI-leading Security Teams Are Building the Agentic SOC
Falcon Secure Access Sets the Standard for Zero Trust Browser Security
Falcon Secure Access Sets the Standard for Zero Trust Browser Security
Beyond the Model: Harnessing Frontier AI for Stronger Cyber Defense
Beyond the Model: Harnessing Frontier AI for Stronger Cyber Defense
make smarter security investments and mitigate future risks
make smarter security investments and mitigate future risks
Inside Astaroth's New Spambot Component
Inside Astaroth's New Spambot Component
Falcon Platform IOAs Arrive in Falcon Next-Gen SIEM to Identify New Threats
Falcon Platform IOAs Arrive in Falcon Next-Gen SIEM to Identify New Threats
CrowdStrike 2026 Threat Hunting Report: Exploitation Window Closes as AI Use Accelerates
CrowdStrike 2026 Threat Hunting Report: Exploitation Window Closes as AI Use Accelerates
CrowdStrike Threat Hunts for Shell Command Obfuscation on VMware ESX
CrowdStrike Threat Hunts for Shell Command Obfuscation on VMware ESX
Google is a Leader in the IDC MarketScape: Worldwide Cybersecurity Consulting Services 2024 Vendor Assessment
Google is a Leader in the IDC MarketScape: Worldwide Cybersecurity Consulting Services 2024 Vendor Assessment
August 2026 Patch Tuesday: One Exploited Zero-Day and 62 Critical Vulnerabilities Among 415 CVEsAug 11, 2026
August 2026 Patch Tuesday: One Exploited Zero-Day and 62 Critical Vulnerabilities Among 415 CVEsAug 11, 2026
Teaching AI to Reason Through Detection Triage
Teaching AI to Reason Through Detection Triage
Benchmaxxing: When the Benchmark Becomes the TargetAug 19, 2026
Benchmaxxing: When the Benchmark Becomes the TargetAug 19, 2026
aiXamine: Unified Black-Box Evaluation of Cross-Dimensional Trade-offs in LLM Safety, Security, and Privacy
本文针对当前大型语言模型（LLM）安全评测中存在的维度割裂问题展开研究。作者指出，现有评测框架通常独立评估安全性、安全性和隐私性，无法捕捉跨维度的失效模式。例如，一个模型可能在安全对齐指标上达到99.3%，却拒绝三分之一的良性查询；或者在所
EchoCoT: Extracting Hidden Chain-of-Thought from Large Reasoning Models
该论文研究了一个此前被忽视的安全问题：能否通过黑盒API交互，从前沿专有大型推理模型（LRM）中近乎逐字地提取隐藏的思维链（Chain-of-Thought, CoT）。隐藏CoT被视为模型的核心资产，尤其是商业模型内部的推理过程，过去普遍
Uncovering and Understanding Hidden Dependencies in the LLM API Reseller Ecosystem via Prefix-Cache Side Channels
本文针对 LLM API 转售商生态系统中隐藏依赖关系带来的安全风险展开研究。随着 LLM API 转售成为访问现代 LLM 服务的常见入口，多层转售形成了不透明的供应链：用户的请求可能经由未披露的上游转售商转发，每一层都可能检查或修改提示
The Software Supply Chain as a Market for Lemons: A Multivocal Review of Trust Signal Collapse
该论文研究开源软件依赖评估中的信任信号可靠性问题。实践者通常使用廉价信号（如星标数、下载量、贡献者活跃度）作为直接代码审查的替代，假设这些信号能反映软件包的真实可信度。既有研究已记录个别信号被操纵，但尚未全面考察所有依赖采纳信号的系统性崩溃
MaliciousSkillBench: A Comprehensive Benchmark for Malicious Agent Skill Detection
该论文提出 MaliciousSkillBench，一个专门用于恶意 Agent Skill 检测的综合基准。Agent Skills 为大型语言模型代理提供可重用的指令包，并可能包含脚本、资源和服务配置，这为恶意行为创造了直接的分发渠道。
TraceGrant: A Contract-Governed Security Framework for the Task-Effect Lifecycle of Networked LLM Agents
本文提出 TraceGrant，一个针对联网大语言模型（LLM）智能体的安全框架，旨在治理其任务-效应生命周期。联网 LLM 智能体通过调用邮箱、云存储、日历、交易平台和 Web 服务等外部资源，执行多步骤任务并产生持久的外部影响。然而，合