Meta agrees to $18 billion settlement over teen social media harms
Meta has reached a proposed settlement worth up to approximately $18 billion with a bipartisan coalition of 52 attorneys
2026-08-27 归档
今日共收录 918 条安全情报，包含 88 个 CVE，417 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Boston Scientific says cyberattack disrupted operations globally
Medical technology company Boston Scientific has been targeted in a cyberattack that disrupted some of its IT systems, c
Hackers target Microsoft SharePoint RCE chain with PoC exploit
Attackers are now targeting a chain of two Microsoft SharePoint vulnerabilities that can allow them to execute arbitrary
Snowflake ends service-account passwords. Now comes the hard part
Snowflake is ending password authentication for legacy service accounts, forcing organizations to migrate them to passwo
Ubiquiti patches three max severity security vulnerabilities
Ubiquiti has released security patches for three new maximum-severity vulnerabilities that threat actors can exploit rem
Microsoft tests new privacy controls for Windows 11 desktop apps
Microsoft has begun testing new privacy controls that will let Windows 11 users choose which desktop applications can ac
Hackers now exploit critical Gitea flaw in code injection attacks
Attackers are now exploiting a critical-severity vulnerability in the Gitea self-hosted Git service, according to the U.
NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions
Cybersecurity researchers have disclosed details of a new adversary-in-the-middle (AitM) phishing toolkit called NovaCoo
INTERPOL Operation Jackal IV Arrests 58, Identifies 263 in Global Cyber Fraud Crackdown
An eight-month INTERPOL operation targeting West African organized crime groups has led to arrests of 58 people and the
The MFA Identity Trap: When Authentication Creates a False Sense of Security
Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenti
Closing the Gap: Automated Discovery of Secure Dockerfile Reference Standards via Semantic Clustering in Enterprise Inner Source
容器化已成为企业软件交付的主流方式，但用于构建容器镜像的 Dockerfile 往往包含安全配置错误和结构性技术债。现有开源研究成果难以直接应用于企业内部（inner-source）环境，因为专有上下文和隔离的治理机制使得通用发现失效。针对
Here is a GIFT: Enforcing User Data Isolation in LLM Serving via GPU Information Flow Tracking
本文针对LLM（大语言模型）推理服务中用户数据隔离的隐私保护问题提出了一种新系统GIFT（GPU信息流追踪系统）。在共享基础设施上，LLM服务框架通常处理大量可能包含敏感信息的用户数据，且这些数据在CPU侧由服务框架管理，在GPU侧由LLM
Reassembling Distributed Risk: Trajectory-Conditioned Action Generation for Multi-Turn Agent Safety
本文研究工具使用的大语言模型（LLM）代理在安全方面面临的独特挑战。与仅生成文本不同，代理的动作会直接影响外部系统，因此安全风险不仅限于文本内容，还扩展到动作层面。作者聚焦于多轮分解攻击：攻击者将一个有害目标拆分成多个单独看都合理的请求和工
SkillShield: Prompt-Space Security Skills for LLM Coding Agents
本文提出 SkillShield，一种针对 LLM 编码代理（coding agent）的提示空间安全防御方法。编码代理通常以开发者的权限编辑文件和执行 shell 命令，因此恶意请求可能直接转化为有害操作或功能性恶意软件。现有防御各有局限
EVOMAL: Self-Poisoning in Self-Evolving Coding Agents
自我进化的LLM编码智能体（如基于大型语言模型的编码助手）能够通过模仿共享技能库中的技能来编写自己的工具，从而不断提升能力。然而，这种自我进化机制存在安全隐患。本文首次识别出该过程中的“自我投毒”漏洞：当智能体在编写新技能时，如果检索到恶意
Poisoning Agentic Alpha: Adversarial Vulnerabilities Across Roles and Architectures in Multi-Agent Trading Systems
本论文研究基于大语言模型的多智能体交易系统中的对抗性漏洞。这类系统由多个专业智能体（如分析师、研究员、交易员、风险经理）通过结构化通信协作，产生交易决策，正从研究原型快速走向控制真实资产的实际部署。作者指出，智能体间的通信虽然提升了系统有效
InjecMEM: Memory Injection Attack on LLM Agent Memory Systems
大型语言模型（LLM）代理系统正越来越多地集成记忆子系统，以实现持久化的个性化和交互连续性。然而，这一便捷功能可能引入新的安全漏洞。本文提出了一种名为 InjecMEM 的新型记忆注入攻击范式，攻击者仅需一次交互（无需对记忆存储进行读取或编
StepGuard: Learning Step-Level Guardrails with Scalable Supervision and Safety-Utility Balancing
本文提出 StepGuard，一种面向 LLM 智能体的步骤级（step-level）防护模型。LLM 智能体通过工具调用与外部环境交互，带来文件修改、信息泄露、未授权操作等安全风险。现有防护方法通常在整个轨迹完成后才进行审计，缺乏执行前的
Vulnerable Code Search: Transferable Attack for Code Language Models
该论文针对当前代码检索系统所依赖的神经代码语言模型（CLMs）的对抗脆弱性展开研究。可靠且高效的代码检索对开发者生产力与代码复用至关重要，然而现有搜索工具背后的模型容易受到针对非功能性文本元素（如标识符）的对抗攻击，攻击者可在不改变代码功能
A Self-Evolving Multi-Agent Framework Defense against LLM Jailbreak Attacks
本文针对大型语言模型（LLM）在越狱攻击（jailbreak attacks）下的脆弱性提出了一种自我进化的测试时防御框架。越狱攻击通常利用角色扮演、混淆、代码变换以及多步间接提示等技术来诱导模型产生有害输出。现有防御大多静态部署，无法积累