iOS 18.7.10 and iPadOS 18.7.10
iOS 18.7.10 and iPadOS 18.7.10
2026-08-26 归档
今日共收录 1656 条安全情报，包含 834 个 CVE，420 篇安全通告，以及 108 篇研究论文。
← 返回归档列表Chrome Stable for iOS Update
Hi everyone! We've just released Chrome Stable 152 (152.0.7977.64) for iOS; it'll become available on App Store in the n
Firewall for AI
Firewall for AI
Unpatched Calix flaw lets hackers bypass NAT to expose internal devices
An unpatched vulnerability in Calix GS7 XGS (GS5239XG) residential routers used by multiple U.S. broadband providers all
Not All Tokens Are Equal: Region-Aware Consistency Repair of Backdoors in MLLMs
本论文研究多模态大语言模型（MLLMs）中的后门安全问题。MLLMs在用户端应用中被广泛部署，但其构建流程可能引入后门风险，触发器可能位于图像、文本或两者之中。现有模型级后门移除方法主要针对传统分类器，在MLLMs上效果有限；而针对MLLM
Towards Automated Cyber Threat Intelligence Elicitation in Underground Forums
本文针对地下论坛中网络威胁情报（CTI）被动收集效果下降的问题，提出了一种基于多智能体大语言模型（LLM）的主动情报获取系统 DarkBot。传统上，CTI 依赖被动监控，但随着论坛用户对大规模数据收集的认知增强，有价值的情报逐渐转移到私密
RAGSentinel: Certifiable Geometric Consensus for Robust Retrieval-Augmented Generation
检索增强生成（RAG）通过在外挂文档中检索并引用相关内容，显著提升了大型语言模型回答的事实性与时效性，但同时引入了新的安全攻击面：攻击者若能在知识库中注入精心构造的对抗性文档，这些文档一旦被检索进入上下文窗口，就可能操纵模型的输出，使其偏向
FIDES: A Concordance Protocol for LLM-Generated Trading Strategies
本文提出 FIDES，一个用于评估 LLM 生成交易策略的测量协议。作者指出，当用户要求 LLM 提供交易策略时，模型通常会返回三类产物：自然语言 rationale、可执行代码实现以及运行后的历史业绩记录。然而，这三者是否真正一致很少被检
AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems
该论文提出了 AgentFlow，一种面向 LLM Agent 系统的以数据流为中心的策略语言与运行时强制框架。研究背景是：LLM Agent 越来越多地读取不受信任的内容、调用外部工具、访问私有数据并委托其他 Agent 执行任务，安全危
ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a cr...
CVE-2026-80138
CVE-2026-80138 是 ClipBucket V5 Web 安装程序中存在的一个高危命令注入漏洞。该安装程序在处理 php_cli_filepath 参数时，未能进行充分的输入验证或转义，直接将用户提供的值传递给 shell 执行
A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi of the...
CVE-2026-79911
CVE-2026-79911 是 TOTOLINK N600R 路由器固件 4.3.0cu.7647_B20210106 中存在的一个严重安全漏洞。漏洞位于 CGI 处理程序组件中的 /cgi-bin/cstecgi.cgi 文件，具体函数
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey