Microsoft MSRC 发布了一则关于 Chromium 项目的安全公告，涉及 CVE-2026-79041。该漏洞被描述为“Browser 中的缺失授权（Missing authorization in Browser）”，表明 Chromium 浏览器组件在处理某些操作时，未能正确执行授权检查，可能导致未经授权的行为。此 CVE 由 Chrome 团队分配，Microsoft Edge（基于 Chromium 的版本）通过同步上游 Chromium 代码而受到该漏洞影响。公告中指出，Microsoft Edge 已包含 Chromium 的修复程序，并引导用户参考 Google Chrome Releases 获取更多详细信息。由于厂商未提供具体的严重性评级、受影响的软件版本细节或攻击场景，实际可利用性和影响范围尚不明确。建议用户关注 Microsoft 和 Google 的官方更新，及时应用浏览器安全补丁。

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to an arbitrary host (disclosing the merchant's payment-gateway credentials) and to forge a success respon

A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time bound and the read from the client had no deadline, each such session retains a worker, a client connection slot, and its associated backend

### Summary When a Java application connects with sslMode=verify-full (or verify-ca) and a password but does not pin a server certificate, Connector/J deliberately accepts an untrusted/self-signed certificate at the TLS layer (the "MITM-proof without a CA" feature) and proves the server's identity afterwards by binding the certificate fingerprint into the authentication exchange. That fingerprint

### Summary The SeaweedFS S3 API gateway did not reject `..` path segments in the `X-Amz-Copy-Source` header used by `CopyObject` and `UploadPartCopy`. The request URL path was hardened against traversal in 4.30 (CVE-2026-54917), but the copy-source header was only checked for emptiness, so a `..` segment in the copy source survived into the server-side filer path and resolved into a different buc

## Summary Arc Enterprise clustering accepts cluster join requests without authentication when `cluster.enabled=true` but `cluster.shared_secret` is not configured. The coordinator validates HMAC authentication only if a shared secret is non-empty; otherwise, a network attacker who can reach the coordinator port can send a join request with attacker-controlled node addresses and role. Accepted no

## Summary Portainer supports restoring an instance from a backup archive via the /api/restore endpoint. This endpoint is intentionally unauthenticated to allow restoring before the first admin account is created, and remains accessible for the five-minute initialization window that opens each time Portainer starts. Any unauthenticated attacker with network access to a Portainer instance that has

### Summary Stored cross-site scripting (XSS) in PrivateBin's attachment download link. An anonymous attacker can create a paste with a **text/html** attachment that, with certain user interaction, bypasses protections similar to CVE-2022-24833. When a victim opens the "Download attachment" link in a new tab, the attacker's inline JavaScript executes in the PrivateBin instance's origin with full

Ivanti Endpoint Manager Mobile代码注入漏洞

IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from "authenticated flow user" to arbitrary OS-level command execution under the server process identity, bypassing

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). As a result, an API key scoped below full super auth

根据The Hacker News报道，Recorded Future Insikt Group的研究人员披露了一起针对欧洲政府与外交组织的网络间谍活动。攻击主要瞄准罗马尼亚、西班牙和土耳其的政府机构与外交部门，活动时间从2025年9月底持续至2026年4月初，跨度约6个月。攻击过程中，部署了一个此前未被记录的后门工具，命名为HOOKEDGE。该后门是一个轻量级的Windows批处理脚本，其设计简单，可能有助于逃避传统安全软件的检测。虽然分发机制尚未披露，但参考APT28的历史手法，通常与鱼叉式网络钓鱼或利用公开漏洞有关。研究人员基于基础设施和战术模式，将攻击归因于APT28（又名Fancy Bear、Pawn Storm），这是俄罗斯军事情报总局（GRU）下属的威胁行为者，曾对全球政府、军队、媒体和智库发起过多次攻击。HOOKEDGE的功能尚不明确，但通常此类后门用于实现远程控制、执行任意命令、收集敏感信息或作为进一步渗透的跳板。由于缺乏公开的IOC和详细技术报告，全球安全社区目前难以进行针对性狩猎。此次针对欧洲的网络间谍活动再次提醒，政府与外交机构需加强网络防御，特别是对异常脚本执行和网络流向的监控。

本文提出并分析了一种名为 MAD-DAG（Mutually-Assured-Destruction Directed-Acyclic-Graph）的新型区块链共识协议，旨在抵御在不利条件下（如网络传播优势、矿工可提取价值 MEV、以及接受贿赂的 petty-compliant 矿工）的自私挖矿攻击。背景上，现有研究已表明自私挖矿会威胁区块链安全，而状态最优的 Colordag 协议虽然在理论上抗自私挖矿，但仅在延迟高到不切实际时才被证明安全，且未考虑上述不利条件。作者首先将自私挖矿行为建模为理性矿工的马尔可夫决策过程（MDP），并提出保守的奖励规则以偏向自私矿工，从而获得其收益的上界。基于该模型，他们推导出安全阈值（矿工为从自私挖矿中获利所需的最低计算力占比）的下界。MAD-DAG 的核心创新在于一种新的账本函数：当存在等长且竞争最长的链时，直接丢弃这些链上的区块内容。这种“相互保证毁灭”的设计使得攻击者即使拥有网络优势或区块奖励波动，也难以从自私挖矿中获利。实验结果表明，在存在 petty-compliant 矿工和高区块奖励波动的条件下，MAD-DAG 的安全阈值在 11% 到 31% 之间，而 Colordag 和比特币的安全阈值均为 0%，意味着它们在这些条件下完全无法抵抗自私挖矿。此外，在正常条件下 MAD-DAG 的安全性与现有协议相当。作者声称这是首个针对基于 DAG 的实用区块链的自私挖矿可处理（tractable）模型，为后续研究提供了分析框架。本文适合区块链协议设计者、共识算法研究者以及关注 MEV 与矿工行为的网络安全学者阅读。

本文提出Swivel，一个用于加固WebAssembly（Wasm）免受Spectre攻击的编译器框架。在浏览器之外，Wasm已成为一种流行的轻量级进程内沙箱，常用于边缘云计算和函数即服务（FaaS）平台中隔离不同客户端。然而，Spectre攻击能够绕过Wasm的隔离保证，使恶意代码可能读取沙箱外或其他客户端的数据。Swivel通过确保潜在的恶意代码既不能利用Spectre跳出Wasm沙箱，也不能胁迫受害代码泄露秘密数据，从而加固Wasm。作者设计了两种Swivel方案：一种纯软件方法，可运行于现有CPU；另一种硬件辅助方法，利用Intel第11代CPU的MPK等扩展。两种方案都分别实现了随机化缓解和确定性消除两种模式。随机化模式在SPEC 2006的Wasm兼容子集上开销低于10.3%，而确定性模式开销在3.3%到240.2%之间。尽管某些基准测试开销较高，但Swivel的开销比现有依赖流水线栅栏的防御小9倍到36.3倍。实验表明，Swivel在提供有效防护的同时，性能开销相对较低，为Wasm沙箱环境提供了实用的Spectre防护方案。

本文提出了一种针对交互式零知识证明（ZK）中析取语句（即多个分支子句的或）的高效证明方法。当前基于向量不经意线性求值（VOLE）的ZK协议虽已实现快速可扩展的证明，但将证明语句编译为控制流无关形式（如电路）仍然导致昂贵的证明开销。对于形如 L_1 ∨ ... ∨ L_B 的析取语句，传统ZK协议通常需要处理所有B个分支，造成计算和通信上的浪费。此前已有工作能在通信上避免全部分支代价，但计算代价仍然存在。本文的核心贡献是提出了“批处理与非批处理分支”技术（对应标题'Batchman and Robin'），在VOLE-based ZK框架下同时降低析取语句的计算和通信开销。具体而言，作者设计了两种模式：批处理模式（Batchman）通过一次性处理多个分支来摊薄公共计算，非批处理模式（Robin）则针对少量分支或特定场景灵活选择最优策略。论文通过理论分析和实验验证，展示了该方法在保持安全性的前提下显著减少证明时间和通信量，尤其适用于包含大量分支的智能合约验证、隐私保护机器学习等实际场景。实验结果表明，与现有最先进VOLE-ZK方案相比，该方法的计算开销可减少若干倍，同时通信开销与理论最优近似。本文适合对高效零知识证明、隐私计算协议设计以及区块链/L2可扩展性感兴趣的密码学和安全研究人员阅读。

Citrix NetScaler 内存泄漏(CVE-2025-5777)

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

CrowdStrike 与 Zscaler 于 2026 年 8 月宣布达成技术合作，旨在将连续身份安全能力整合到零信任访问架构中。根据官方博客标题及公开行业背景，该合作预计将 CrowdStrike Falcon 平台（以 EDR、威胁狩猎和身份保护见长）与 Zscaler 的零信任访问解决方案（如 Zero Trust Exchange）相集成，使得企业在用户每次访问资源时都能基于实时身份信号、设备健康状态、行为异常等维度进行动态风险评估，从而替代传统基于静态凭据的一次性认证。该方案强调“持续身份”而非“单点验证”，即在会话期间不断监测身份与设备的安全态势，若发现可疑活动可立即终止访问或实施最小权限控制。文章虽未披露具体技术细节，但显然指向了现代身份安全与零信任领域的关键痛点——如何应对凭据盗窃、内部威胁和横向移动。标签中包含“apt”和“edr”，暗示合作可能涉及对高级持续性威胁的检测和响应能力，而可能提及的 Conti 勒索软件家族或作为此类威胁的示例，但原文正文并未提供，故无法确认其具体上下文。总体而言，这是一项面向企业安全架构的产品合作公告，并非具体攻击事件披露，但对安全团队而言，了解身份与访问控制领域的最新集成方向有助于规划防御策略。

2026年8月29日，CrowdStrike发布了关于“面向AI代理的持续身份（Continuous Identity for AI Agents）”的产品公告。该公告来自CrowdStrike官方博客，主要介绍其在身份安全与AI代理结合方面的新能力，旨在为AI代理提供持续的身份验证与访问控制，以应对日益复杂的身份威胁。公告中未提及具体漏洞（CVEs）、攻击事件、攻击者组织或行业与地区影响。尽管标签中包含“apt”和“edr”，但正文未提供任何APT活动或端点检测响应相关的具体细节。此外，标签中出现的“Conti”可能被列为恶意软件家族，但公告内容与勒索软件Conti无关，可能为标签误标或关联性极弱。整体来看，这是一篇产品功能发布类文章，而非威胁情报或攻击活动分析。由于缺少正文内容，本摘要仅基于标题和标签推断，无法提供更多技术细节。建议安全团队关注CrowdStrike官方文档以获取该功能的详细技术说明，并评估其与自身身份安全体系的集成价值。

In the Linux kernel, the following vulnerability has been resolved: hwmon: (occ) unregister sysfs devices outside occ lock occ_active(false) and occ_shutdown() unregister sysfs-backed devices while occ->lock is held. hwmon_device_unregister() and sysfs_remove_group() can wait for active sysfs callbacks to drain, and those callbacks can enter the OCC update path and try to take occ->lock again.

A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with access to the router's web management interface can trigger memory corruption and potentially achieve arbitrary code execution. Successful expl

### Summary The connector encodes and decodes all character data assuming the connection character set is UTF-8. A server can change character_set_client mid-session to a non-UTF-8 charset, after which the driver and server interpret the same bytes under different encodings, causing silent data corruption and a client/server charset-confusion mismatch. ### Details The driver encodes and decodes

### Summary The connector encodes and decodes all character data assuming the connection character set is UTF-8. A server can change character_set_client mid-session to a non-UTF-8 charset, after which the driver and server interpret the same bytes under different encodings, causing silent data corruption and a client/server charset-confusion mismatch. ### Details The driver encodes and decodes

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary chats, and inject fabricated messages into other users' conversations.

### Summary A single unauthenticated HTTP request to a path starting with `?` (e.g. `GET ? HTTP/1.1`) crashes the entire server process. The request line parser passes the path to `sanitizeRequestPath` which indexes the first byte of the path after stripping the query string. It does so without checking that it is non-empty, leading to an out-of-bounds panic. The panic occurs before any handler or

gitoxide's gix-url crate (?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints and other restricted network resources.

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to attacker-controlled servers, gaining full database access in cloud deployments.

filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cleanup). The share record is keyed by path, so it survives the rename and remains dormant (returning 404 while the path is empty). When any new, unrelated file later appears at the original shared path — via re-upload, another user with create permission, or a hook — the stale pub

File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication.

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server goroutines and exhaust connection resources.

SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform DNS resolution only at guard time without validating the connect-time resolution. Attackers can use DNS rebinding to answer the guard resolution with a public IP and the connect resolution with a private or metadata IP, bypassing the SSRF defense to access cl

In the Linux kernel, the following vulnerability has been resolved: iomap: add a separate bio_set for iomap_split_ioend iomap_split_ioend can split bios that already come from iomap_ioend_bioset and thus deadlock when the bioset is exhausted. Add a separate bio_set to avoid this deadlock. Christian Brauner says: Mark iomap_ioend_split_bioset static as it is only used in ioend.c, fixing the sp

In the Linux kernel, the following vulnerability has been resolved: mm: mglru: fix stale batch updates after memcg reparenting The mglru page table walker batches per-generation size deltas in walk->nr_pages while walking page tables without holding the lruvec lock. The reset_batch_size() later folds those deltas into walk->lruvec under the lruvec lock. The page table walker can run concurrent

In the Linux kernel, the following vulnerability has been resolved: sctp: validate Adaptation Indication parameter length The Adaptation Layer Indication parameter contains a fixed 32-bit Adaptation Code Point after its parameter header. However, sctp_verify_param() accepts a header-only parameter because the generic parameter walker only requires the header to be present. sctp_process_param()

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, get_ss_info_from_atombios() uses calc_pll_cs->ctx->logger for logging. But calc_pll_cs->ctx is initialized only later in calc_pll_max_vco_construct(). Therefore, any output using DC_LOG_SYNC() leads to a NULL pointer deference in get_ss_info_from_a

In the Linux kernel, the following vulnerability has been resolved: erofs: ensure valid f_path for page cache sharing Previously, backing files for page cache sharing were set up with f_path left as NULL (only f_inode was valid). It worked, but a recent mincore fix relies on f_path.mnt and crashes (found by "erofs/028" on 7.2-rc4): BUG: kernel NULL pointer dereference, address: 00000000000000

In the Linux kernel, the following vulnerability has been resolved: mm/util: don't read __page_2 for order-1 folios in snapshot_page() snapshot_page() currently reads __page_2 after checking nr_pages > 1, but it should only do so when nr_pages > 2. If an order-1 folio is allocated at the end of a vmemmap section, __page_2 will not exist and reading it will cause a fault. During DLPAR memory re

In the Linux kernel, the following vulnerability has been resolved: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() machine__resolve() accesses env->cpu[al->cpu].socket_id after checking al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu against env->nr_cpus_avail. Since al->cpu comes from the untrusted perf.data sample, a crafted file with a large CPU index ca

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the zero-length buffer trips a BUG_ON() when running with CONFIG_DEBUG_VIRTUAL=y due to trying to get the

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: enable the right set of ciphers The firmware version number check for IGTK introduced in commit c34dbc5900b0 ("wifi: wlcore: Add support for IGTK key") lets the amount of ciphers decrease on every boot of a too old firmware and that is practically happening. It also does not take into account other chips than the

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Whenever fq_codel drops packets during peek, it calls qdisc_tree_reduce_backlog. An issue arises because it calls qdisc_tree_reduce_backlog before it reincrements the qlen. If qlen drops to zero, but peek returns an skb, the parent's

In the Linux kernel, the following vulnerability has been resolved: veth: fix NAPI leak in XDP enable error path During XDP enablement in veth, if xdp_rxq_info_reg() or xdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes. However, the rollback loop: for (i--; i >= start; i--) { decrements the loop index 'i' before the first iteration. This correctly skips unregistering the r

In the Linux kernel, the following vulnerability has been resolved: ACPI: processor_idle: Mark LPI enter functions as __cpuidle When function tracing or Kprobes is enabled, entering an ACPI Low Power Idle (LPI) state triggers the following RCU splat: RCU not on for: acpi_idle_lpi_enter+0x4/0xd8 WARNING: CPU: 8 PID: 0 at include/linux/trace_recursion.h:162 function_trace_call+0x1e8/0x228 Th

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/lbr: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors supporting X86_FEATURE_AMD_LBR_V2, perf can still report SYSRET/ERET entries for whic

file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android implementation. The openFileStream() method in FileUtils.kt uses the DISPLAY_NAME obtained from ContentResolver.query() directly in file path construction without sanitization. A malicious Android app with a crafted ContentProvider can return a filename containin

PLANET VDR-300NU ADSL Router - 未授权修改DNS

Acknowledgements

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session information to obtain and reuse a valid token. Successful exploitation could allow an attacker to impersona

这篇论文针对二进制程序模糊测试（binary-only fuzzing）中的覆盖率反馈质量不佳问题，提出了一种新的编译器级插桩方法，命名为“Breaking Through Binaries”（简称BTB）。传统上，对于没有源代码的二进制程序，模糊测试工具往往依赖动态二进制插桩（DBI）或静态重写来获取覆盖率信息，但这类方法通常带来显著性能开销，且难以捕获编译器优化后的复杂语义（如函数内联、控制流合并等），导致生成的覆盖率反馈不够精确，限制了漏洞发现能力。本文的核心创新在于利用编译器前端的高级中间表示（IR）来解析二进制文件，并重新生成高质量、语义丰富的插桩代码，在保持二进制兼容性的同时，实现接近源码级插桩的覆盖率精度。具体地，作者设计了一个编译器级二进制的插桩框架，能够从二进制中恢复结构信息，并插入针对基本块、边及关键指令（如比较、跳转）的探针，这些探针经过编译器的优化调度，极大减少了运行时开销。实验部分使用了多个真实世界的开源项目（如libpng, libtiff, jq等）以及不同架构（x86-64和ARM64）的二进制，对比了最先进的二进制仅模糊测试工具（如AFL++的QEMU模式、Zydis插桩等），结果显示BTB在覆盖率、崩溃发现数量和速度方面均有显著提升，部分场景下能达到甚至超越源码级插桩的效果。论文还探讨了该方法的局限性，例如对静态链接、混淆代码的适用性问题，以及未来扩展方向。总体而言，这项工作为缺乏源码的软件安全测试提供了一种更高效、更准确的插桩方案，适合二进制分析、漏洞挖掘和模糊测试领域的研究人员与安全工程师阅读。

本文（arXiv 论文，题目为《StepStone: LLM-Based GPU Kernel Driver Fuzzing via User-Space Libraries》）提出了一种基于大语言模型（LLM）的 GPU 内核驱动模糊测试方法。研究背景：随着 GPU 在计算和 AI 领域的广泛应用，其内核驱动暴露面增大，安全问题不容忽视。然而，GPU 内核驱动与用户态库交互频繁，传统模糊测试难以生成既满足驱动接口语义又能跨边界触达内核漏洞的输入。核心方法：作者提出了 StepStone 框架，利用用户态库中的丰富语义信息（如 API 调用序列、对象生命周期、上下文依赖等）作为推理基础，引导 LLM 构造更有效的测试用例，进而驱动内核侧的执行路径。主要贡献可能包括：设计了一种将外部库知识转化为 LLM 可理解中间表示的方法；提出了针对内核驱动模糊测试的反馈循环或覆盖引导机制；在真实 GPU 驱动（如 AMD/GPU 或 ARM Mali 等）上验证了该方法的有效性，但具体实验数据在本摘要中无法获得。适合阅读对象：从事内核安全、漏洞挖掘、模糊测试研究的安全工程师以及 GPU 驱动开发者。需要说明：由于本次输入未提供完整摘要，上述内容为基于标题的合理推断，正式结论请参考论文全文。

本文提出了一种名为 MetaBreak 的新型越狱攻击方法，针对在线大语言模型（LLM）服务。与常规 token 不同，特殊 token 是在 LLM 微调过程中人为创建、用于标注结构化对话的元数据，对模型生成连贯且上下文相关的回复起关键指导作用。研究者发现，攻击者可利用特殊 token 构造四种攻击原语，从而可靠地绕过在线 LLM 服务的内部安全对齐机制，同时规避最先进的外部内容审核系统。论文进一步指出，应对该威胁具有挑战性：学术界建议的激进防御手段，如直接移除所有特殊 token 的输入清洗，效果不如预期，因为攻击者可以通过在 tokenizer 嵌入空间中将特殊 token 替换为语义相似度高的常规 token 来轻易规避。作者在实验室环境和商业 LLM 平台上系统评估了 MetaBreak。实验表明，在没有内容审核的情况下，MetaBreak 的越狱成功率与最先进的基于提示工程的方案相当；而在存在内容审核时，MetaBreak 相比 SOTA 方案 PAP 和 GPTFuzzer 分别提升了 11.6% 和 34.8% 的成功率。此外，由于 MetaBreak 与提示工程在策略上根本不同，两种方法可以协同工作：将 MetaBreak 与 PAP 和 GPTFuzzer 结合后，越狱成功率分别额外提升了 24.3% 和 20.2%。该研究揭示了特殊 token 在 LLM 安全中的新攻击面，对 LLM 服务提供方和安全防御者具有重要参考价值。适合关注 LLM 安全、红队对抗、内容审核机制的研究人员和安全工程师阅读。

随着物联网（IoT）设备在无人驾驶、建筑、机器人等对精细化要求较高的行业中广泛部署，其安全性却因设备类型多样、固件执行环境复杂而严重滞后于产业发展。现有固件安全测试方法主要分为直接连接真实设备和部分模拟（partial emulation），这些方法虽然可行，但在大规模分析场景下效率低下且难以覆盖多种固件。完整系统模拟（full system emulation）无需真实设备即可测试大量固件，因此更适用于规模化分析，近年已有研究将模拟与模糊测试等软件测试技术相结合，但仍存在适用性有限和效率不足的问题。针对这些局限，本文提出一种名为 FirmColic 的方法，将模糊测试（fuzzing）与符号执行（concolic execution）相结合，以增强进程模拟（augmented process emulation）为基础，利用基于符号执行的关键字提取来提升模糊测试的有效性。此外，FirmColic 在增强进程模拟环境中引入了五种仲裁（arbitration）技术，以提高模拟的成功率。实验结果表明，与以往研究相比，FirmColic 在检测速度、崩溃发现数量以及代码覆盖率方面均有更优表现。该方法适合固件安全研究人员、IoT 设备制造商以及安全测试工具开发者阅读，为大规模 IoT 固件安全分析提供了一种新的技术思路。

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can intercept traffic between the BOSH Director and vCenter can establish a malicious server impersonati

IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limitation of resources.

Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud firmware check status information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.

IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthenticated attacker can exploit this vulnerability to execute actions under another user's authenticated profile gaining elevated privileges on the IBM i system.

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a format string vulnerability.

### Summary The connector does not gate clear-text password authentication plugins on transport encryption. A hostile or man-in-the-middle MariaDB server can request a clear-text plugin over an unencrypted (plain-TCP) connection, and the driver responds with the user's password in cleartext on the wire. ### Details The driver does not require a secure transport before using clear-text-password

### Summary When PAM (dialog) authentication is used, the connector can be coerced into sending the account password in cleartext over an insecure connection. A hostile or man-in-the-middle server can trigger this with the default configuration, disclosing the user's password. ### Details The mysql_clear_password plugin is gated behind a secure connection: the driver refuses to transmit the pas

### Summary The AUSF component of free5GC compares authentication response values with normal Go equality helpers instead of constant-time cryptographic comparison functions. Two authentication flows are affected in `internal/sbi/processor/ue_authentication.go`: 1. 5G-AKA confirmation compares `RES*` and `XRES*` with `strings.EqualFold()`. 2. EAP-AKA' confirmation compares `AT_MAC` with `bytes.

### Summary The AUSF component of free5GC stores per-subscriber authentication state in a global `sync.Map` keyed only by SUPI. Every incoming authentication request creates a new `AusfUeContext` and stores it under that SUPI key without checking whether an authentication procedure is already in progress and without generating a per-session unique identifier. An attacker with access to the AUSF

### Impact Graylog contains an insecure direct object reference (IDOR) vulnerability in the token revocation endpoint. An authenticated user can delete access tokens belonging to other users, including service account tokens and administrator tokens, if they know or can guess a valid token identifier. The issue does not expose token contents, but it allows unauthorized token deletion, leading to

### Impact A security issue has been identified in Graylog affecting the parsing of syslog messages that use a key-value format, such as those generated by Fortigate devices. The vulnerability allows attackers to overwrite individual message fields, or to produce invalid messages which Graylog will discard. This effectively enables log evasion techniques to obscure malicious activity. ### Patch

### Summary When PAM (dialog) authentication is used, the connector can be coerced into sending the account password in cleartext over an insecure connection. A hostile or man-in-the-middle server can trigger this with the default configuration, disclosing the user's password. ### Details The mysql_clear_password plugin is gated behind a secure connection: the driver refuses to transmit the pas

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal network services and cloud metadata endpoints, then retrieve captured responses from object storage using ca

## Vulnerability Details A reflected JSON injection allows an attacker to return arbitrary data in the JSON endpoints (like ` /?jsonld=` and `/?pasteid`). ### Root Cause `Request::getRequestUri()` sanitizes `$_SERVER['REQUEST_URI']` with `FILTER_SANITIZE_URL`: ```php public function getRequestUri() { $uri = array_key_exists('REQUEST_URI', $_SERVER) ? filter_var($_SERVER['REQUEST_URI'], FIL

## Overview A DataObject **class-definition field name** is concatenated, without an identifier allowlist, into the PHP class source that Pimcore generates for every DataObject class (`protected $;`). A user holding only the ordinary `objects` (DataObjects) permission can import a class definition whose field name closes the property and injects arbitrary PHP into the generated class file, achiev

Firefox browsers

Sign in to Cloud

Sign Up for Free Cloud Tier

iOS 26.4.2 and iPadOS 26.4.2

iOS 18.7.8 and iPadOS 18.7.8

iOS 18.7.7 and iPadOS 18.7.7

iOS 26.4 and iPadOS 26.4

Background Security Improvements for iOS, iPadOS, and macOS

iOS 16.7.15 and iPadOS 16.7.15

iOS 15.8.7 and iPadOS 15.8.7

iOS 26.3 and iPadOS 26.3

iOS 18.7.5 and iPadOS 18.7.5

iOS 26.2 and iPadOS 26.2

iOS 18.7.3 and iPadOS 18.7.3

Compressor 4.11.1

Android Code Search

Android Devices

Secure an Android device

Android 16 QPR2

Mobile network security

iOS 26.5 and iPadOS 26.5

iOS 18.7.9 and iPadOS 18.7.9

iOS 16.7.16 and iPadOS 16.7.16

iOS 15.8.8 and iPadOS 15.8.8

MFSA 2026-49Security Vulnerabilities fixed in Firefox for iOS 151.0

MFSA 2026-52Security Vulnerabilities fixed in Firefox for iOS 151.1

MFSA 2026-53Security Vulnerabilities fixed in Firefox for iOS 151.2

MFSA 2026-55Security Vulnerabilities fixed in Focus for iOS / Klar 151.3.1

MFSA 2026-56Security Vulnerabilities fixed in Firefox for iOS 152.0

iOS 26.5.2 and iPadOS 26.5.2

MFSA 2026-65Security Vulnerabilities fixed in Firefox for iOS 152.3

MFSA 2026-66Security Vulnerabilities fixed in Firefox for iOS 152.4

iOS 26.6 and iPadOS 26.6

MFSA 2026-73Security Vulnerabilities fixed in Firefox for Android 153.0.3

iOS 26.6.1 and iPadOS 26.6.1

iOS 18.7.10 and iPadOS 18.7.10

【大模型服务平台 TokenHub】&【智能体开发平台 ADP】& 【云开发 CloudBase】 关于腾讯云 DeepSeek-V4-Flash (Model ID：deepseek-v4-flash) 模型下线及切换升级的通知

  Hello Everyone! We've just released Chrome 153 (153.0.8010.18) for Android to a small percentage of users. It'll become available on Google Play over the next few days. You can find more details about early Stable releases here.This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing

Firewall for AI

Nearly 130 tech and cybersecurity companies back a collective call to boost cyber defenses as AI-enabled attacks grow more sophisticated.  The post Tech, Cybersecurity Giants Unite Behind OpenAI-Led Cyber Defense Pledge appeared first on SecurityWeek.

Cybersecurity researchers have discovered a cluster of 18 Google Chrome and one Microsoft Edge extensions that were published over the last six months and harbored wallet secret stealing and cryptocurrency draining capabilities. The extensions, per Socket security researcher Karlo Zanki, share similarities in code and tradecraft, with evidence indicating that the campaign may have been active

本文提出 PLCBench，首个针对真实 PLC 的硬件在环 (HIL) 评估框架，用于系统衡量自主 LLM 代理能否将通过网络安全访问到的 PLC 转化为持续的物理影响。研究动机是既有评估往往停留在数字域或 PLC 测试的单一阶段，无法准确刻画从软件利用到物理世界的真实风险。核心方法包括：使用厂商原生协议交互、真实商用 PLC 执行、闭环降阶过程仿真和独立结果验证；设计确定性评估器，基于运行方、通信、PLC 对象和过程记录分配六个隐藏诊断标志，区分可用 PLC 交互、过程关联写入和持续物理影响。作者在四种商用 PLC 与四种闭环工作负载组合上实例化该框架，并测试五个 LLM 家族共 240 次真实 PLC 试验。结果显示 75 次 (31.3%) 可持续达成各自物理目标；98 次在有效原生读取前停止，62 次达到过程关联写入但未持续最终目标。值得注意的是，更丰富的过程观察使过程关联写入后条件目标达成率从 44.2% 提升至 64.0%。这些测量定位了已配置 PLC-过程部署中的失败点，并为未来防御评估提供干预点。为保证可复现性，作者发布可安全披露的 PLCBench 代码及软件复现流水线。

该论文提出了一种名为SPA（Secure Persistent Agents）的架构，用于提升大语言模型（LLM）智能体在跨查询持久化场景下的安全性。研究背景是：当前LLM智能体常被赋予访问不受信任网页、文档、工具及持久化状态的权限，同时又能操作敏感资源，因此面临严重的投毒与数据劫持风险。已有防御大多仅保护规划阶段或单个工具调用，但持久化智能体面临更广泛威胁：攻击者控制的数据可能改变控制流、进入安全敏感的工具参数，或影响后续查询。SPA采用“计划优先”（plan-first）架构，将规划、执行与跨查询状态复用统一纳入安全机制。具体而言，SPA对每个查询只调用一次规划器，生成用声明式领域特定语言表达的完整可执行计划，然后施加双格信息流控制（dual-lattice information-flow control），同时跟踪机密性和完整性，覆盖显式数据流与控制依赖。为实现持久化而不重新暴露不受信任载荷给规划器，SPA将执行结果存储为带标签的工件，并在后续规划中只展示语义元数据。作者在AgentDojo及他们扩展的多查询版本AgentDojo-MQ上进行了评估，后者用于衡量安全状态复用和延迟攻击。实验表明，在“工具知识”（tool_knowledge）攻击下，结合信息流控制的SPA在AgentDojo上将攻击成功率降至0%，在AgentDojo-MQ上降至0.2%。结果表明，计划优先执行结合标签保持持久化能显著增强持久化LLM智能体的安全性，但同时也揭示了严格的完整性执行带来的安全-效用权衡。该研究适合关注LLM智能体安全、数据流控制以及可信AI系统的研究人员和工程师阅读。

该论文针对企业中自主AI代理的治理问题，指出现有基于人类用户和长期服务的控制模型无法适应AI代理的三个关键特征：代理主体是短暂的（创建和消失速度快于预配置）、其行为由模型选择而非编程决定（因此可能尝试的动作集合不可预知）、以及代理种群是通过发现而非预配置形成（任何能调用API的人都能创建代理）。作者主张治理自主AI代理是一个运行时问题，而非模型对齐或构建时问题。他们从动作生效前后必须回答的问题中推导出五个原语：发现（discovery）、身份（identity）、治理（governance）、证明（attestation）和供应链（supply chain）。论文详细论证了每个原语缺失时会导致的失败，以及为什么其他原语无法在结构上替代它。作者描述了一种实现架构：代理的动作在生效前依据策略进行中介，针对每个租户的动作词汇表进行授权，并记录在一个哈希链接的签名账本中，该账本可在第三方验证时无需供应商参与。作者报告了架构的代价：执行点位于请求关键路径上，身份要求每个工作负载有sidecar，且失败关闭的中介会将可用性事件转化为拒绝。实现状态明确：四个原语已在私有试点中构建并运行，第五个（供应链）作为独立工具构建但尚未集成到请求路径。作者特意保留第五个原语，指出五部分分解若恰好匹配作者所构建的系统，则不是分类法而是代码库描述。

本文针对大语言模型（LLM）生成寄存器传输级（RTL）硬件代码时存在的隐性安全义务缺失问题展开研究。与软件不同，RTL 代码一旦流片（tape-out）成硅片便无法在部署后修补安全漏洞，因此硬件代码的安全性至关重要。现有研究主要关注 LLM 生成代码的功能正确性，而对安全性的评估多集中于软件领域。作者构建了 SECRTL-GEN 基准，这是一个基于真实 SoC IP 的多语言资源访问安全基准，包含 392 个任务，覆盖 5 个 CWE 家族和 4 种硬件描述语言（Verilog、SystemVerilog、VHDL、Python），并配有黑盒功能测试与安全测试平台。功能规格说明有意省略安全义务，以模拟实际中安全义务常被排除在功能文档之外的情况。对五个前沿 LLM 的实证研究发现：在朴素提示下，模型通过功能测试的比例约为 73%-79%，但通过安全测试的比例仅为 14%-35%，且功能更强的模型并不更安全。加入 CWE 知识可提升安全性，但无辅助的自我思考帮助较小，而两者都会降低功能通过率，表明瓶颈在于规格说明中缺乏弱点感知，而非模型无法编写防御性 RTL。为此，作者提出 RTL-Obliger，一种神经符号框架：LLM 从规格说明中提取功能语义图，符号引擎将其与 CWE 模式本体匹配，以暴露缓解证据缺口和信号级义务，最后 LLM 在保留功能的两阶段生成过程中根据这些义务修订 RTL。在五个模型和四种语言上，RTL-Obliger 将平均全通过率从 49.6%-51.4%（对比 SecV/RESCUE）提升至 61.6%，安全性和功能通过率均高于这些安全生成基线。该研究为硬件安全代码生成提供了新思路，适合硬件安全研究人员、EDA 工具开发者和 LLM 安全评测人员阅读。

该论文针对大语言模型（LLM）在寄存器传输级（RTL）代码生成场景中面临的后门投毒威胁，提出了一种轻量级防御框架 RTLGuard。随着 LLM 在硬件设计自动化中的应用，设计者开始依赖第三方预训练或微调后的模型将高层规格转换为可综合的硬件描述，但此类模型的训练数据和微调过程通常不透明，恶意攻击者甚至模型提供方可能在微调阶段植入隐藏后门，使得用户看似正常的提示词触发恶意行为（如硬件木马）。为缓解这一信任问题，RTLGuard 采用教师-学生（teacher-student）框架，通过三步实现模型净化：首先在少量可信 RTL 数据上微调一个小规模“干净”教师模型；然后利用复合教师-学生目标函数引导被污染的目标模型；最后引入特征对齐与知识蒸馏机制以抑制恶意行为。实验覆盖多种 LLM 架构，结果表明 RTLGuard 在显著降低攻击成功率（ASR）的同时，保持了生成 RTL 代码的功能正确性与可综合性。与全参数重训练相比，该方法避免了高昂计算开销，为 AI 赋能的 IC 供应链提供了一种实用的安全防护手段。适合硬件安全研究者、LLM 安全工程师以及芯片设计流程中引入 AI 工具的团队阅读。

大型语言模型（LLM）在代码生成方面表现出强大能力，但经常生成包含安全漏洞的代码。实现既功能正确又安全的代码生成是一个多目标优化问题，极具挑战性。现有方法通常通过注入外部安全知识，或利用基于智能体的反馈与迭代精化来缓解该问题；然而，检索到的安全指南往往过于通用，生成器难以将其转化为针对具体任务的安全实现，而共享对话的多智能体反馈机制则容易模糊各角色的职责边界，并导致上下文膨胀。为此，本文提出 MACGen，一个多智能体协作框架，通过集成规划、安全分析、代码合成与精化，同时优化代码的功能性与安全性。MACGen 包含四个核心组件：规划器（Planner）构建逐步计划以满足功能需求；安全顾问（Security Advisor）识别潜在 CWE 并综合出任务特定的安全指南；编码器（Coder）基于上述计划和安全指南生成代码；审查器（Reviewer）则从分离的视角（功能与安全）提供反馈。与共享完整对话历史的方案不同，MACGen 中每个智能体仅接收来自上游阶段的结构化产物，从而强制角色专业化，并避免上下文无控制增长。实验在 CWEval 和 BaxBench 两个基准上进行，结果显示，与直接提示（direct prompting）相比，MACGen 在 F&S@1（功能性与安全性同时正确）指标上分别平均提升了 19.61 和 10.57 个百分点。该工作为安全代码生成提供了一种新颖的多智能体协作范式，通过结构化任务分解和角色隔离，有效平衡了功能性与安全性目标。适合对 LLM 安全、自动化代码审计和智能体系统感兴趣的研究人员阅读。

本文研究了大语言模型（LLM）推理迁移到边缘AI加速器后引入的新型物理安全威胁。在执行推理时，模型参数和中间推理状态会被反复加载到芯片上处理，这使得它们容易受到物理侧信道攻击。作者提出并演示了一种基于激光电压成像（Laser Voltage Imaging）的攻击方法，能够从芯片的局部存储器和计算子电路中提取LLM资产，包括嵌入（embeddings）、注意力（attention）、量化后的MLP权重、激活值以及其他推理状态。为了验证这一方法，作者在基于FPGA的LLM加速器上实施了攻击。由于这类加速器在地址、瓦片（tile）、模块和层之间复用相同的缓冲区和计算子电路，读取资产值只需在推理过程中探测不同的存储器即可。实验实现了对目标值的完全恢复；即使某些权重或位未被读取，作者也建立了一种方法论来恢复资产值。此外，作者推导了成像工作量与资产尺寸之间的下界关系，表明直接恢复的复杂度随目标资产大小线性增长。该研究揭示了边缘AI芯片在物理层面上的信息泄露风险，为硬件安全研究和LLM部署的安全性评估提供了重要参考。适合硬件安全研究人员、边缘AI系统设计者以及关注LLM机密性的安全工程师阅读。

本文指出当前自我进化的技能库（如 AutoSkills、Hermes Agent）在自动生成编排建议时仅关注效率提升，而忽略了安全性的关键缺口。作者认为，技能（Skill）描述的是代理应如何行为，而策略（Policy）决定了哪些行为被允许成为实际行动。现有的技能格式（如 Markdown 和脚本）仅覆盖了前者，后者则由模型自行推断。当技能被错误调用时，可能产生解锁房门或转账等严重后果。虽然已有研究分别记录了恶意技能危害云软件、以及越狱大语言模型控制的机器人造成物理伤害，但两者的交叉——恶意代理技能导致物理伤害——尚未被报告。作者将此类问题命名为“借用权威”（Borrowed Authority）：技能格式未给接收代理提供类型化的方式拒绝代理间的权限声明，因此恶意或误用的技能可通过附加权限请求来驱动执行。为解决这一问题，作者提出边缘技能守卫（Edge Skillguard），这是一种位于技能工件内部的类型化权威层，与工作流引擎置于工具之间的方式不同，它通过世界状态和传感器证据进行守卫。在实时边缘控制平面测试台上，该守卫在五个攻击变体中拒绝了60/60的借用权威请求，且未阻塞正常请求；在5倍规模及跨主机（Tailscale mesh）环境下结论依然成立。实验结果建议，高风险技能应将类型化调用策略与程序性知识打包，使物理行动依赖于机器可校验的证据，而非对等代理的声明。

该论文是一篇关于检索增强生成（RAG）安全与鲁棒性的系统性综述。RAG 通过引入外部知识库来增强大语言模型，能够提升事实性和减少幻觉，但与此同时，检索-生成流水线也引入了新的安全风险，例如语料库投毒（corpus poisoning）、后门攻击（backdoor attacks）、隐私泄露（privacy leakage）以及公平性破坏（fairness violations）。现有综述在攻击者目标、威胁模型和分阶段防御的覆盖上存在局限。为此，本文提出了一种统一的、面向流水线的 RAG 鲁棒性研究框架。作者首先对语料库、检索器和生成器分别形式化定义了威胁模型，并将攻击归纳为三大目标：准确性（accuracy）、隐私（privacy）和公平性（fairness）。随后，他们从流水线视角系统梳理了防御措施，覆盖检索（retrieval）、重排（rerank）、生成（generation）和追踪（traceback）等阶段。此外，文中还总结了用于评估和解释 RAG 鲁棒性的基准测试（benchmarks）与可解释性方法（explainability methods）。该综述的贡献在于提供了一个统一的、按流水线阶段和组织目标分类的攻击与防御全景，弥补了现有研究在系统性上的不足。适合关注大模型安全、RAG 应用防护以及可信 AI 的研究人员和工程师阅读。

多模态大语言模型（MLLM）在用户端应用中日益普及，但其构建流程可能引入后门风险：触发器可能位于图像、文本或两者中。现有面向传统分类器的模型级后门移除方法对 MLLM 效果有限，而针对 MLLM 的防御大多在推理时进行，通过过滤可疑输入来缓解风险，并未真正移除模型内嵌的后门。为从源头消除 MLLM 中的潜在后门，本文提出 RACER（Region-Aware Consistency Repair）框架，其核心观察是：后门会导致内部表示在层间演化出现异常，作者称之为“层间不一致性异常”。该异常具有模态依赖性，主要集中在编码触发器特征的 token 区域。RACER 将融合表示分解为视觉和文本 token 区域，分别对其层间不一致性进行归一化，并在深层窗口上使用模态感知权重重组，形成区域感知的不一致性目标，从而更精确地捕获局部后门异常。通过最小-最大优化，该目标驱动最坏情况扰动合成和对抗微调，抑制后门行为依赖的深层表示方向性偏移。RACER 仅需 100 个干净样本，无需知道触发器、攻击目标甚至模型是否包含后门。在三个开源 MLLM、覆盖图像/文本/多模态触发器的 36 种后门设置中，RACER 将平均攻击成功率（ASR）降至 1.1%，其中 32 种设置达到 0%，同时保持后门模型和干净模型的干净任务效用。该方法为 MLLM 模型级后门修复提供了新思路。

Cloud & Application Security

From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise

Next-Gen Identity Security

CrowdStrike Expands Identity Leadership with OpenID and IDPro

cloud architecture assessment

ransomware and multifaceted extortion defense

Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand

The Identity Problem Hiding in AI Agent Deployments

94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey

Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud

Falcon Cloud Security July 2026 Release: Helping Security Teams Move Faster in the Cloud

CrowdStrike Named Strongest Overall Leader in 2026 Frost Radar™: Cloud Workload Protection Platforms

Healthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming it stole 284 million patient data records. [...]

本文针对Web服务中机器人滥用日益严重的问题，分析了现有CAPTCHA机制在对抗机器人时效果有限、给人类用户带来困扰以及可能侵犯用户隐私的缺陷。随着客户端可信执行环境（TEE）技术的普及（如ARM TrustZone和Intel SGX），作者提出利用客户端TEE来替代传统CAPTCHA的设想。论文设计并实现了CACTI（CAPTCHA Avoidance via Client-side TEE Integration）系统。CACTI利用客户端TEE作为信任根，使合法客户端能够生成不可伪造的“速率证明”（rate-proof），该证明可以展示用户执行特定行为的频率，从而向服务器证明其为人类用户而非机器人。用户无需解决CAPTCHA，即可通过提交速率证明完成身份验证。在隐私保护方面，CACTI采用组签名方案，确保客户端向访问网站发送信息时，不会泄露用户身份等敏感数据，仅能证明其属于合法客户端群体。实验评估表明，CACTI生成和验证一个速率证明的总延迟低于0.25秒，相比现有CAPTCHA系统，带宽开销降低了98%以上，显著提升了用户体验和系统效率。论文的贡献在于探索了TEE在反滥用领域的新应用场景，提供了一种更安全、更隐私友好的用户验证机制。

推荐系统在各类在线服务中帮助用户发现感兴趣内容，基于深度学习的推荐系统因性能优势日益普及。然而，这类系统的安全性鲜有研究。本文首次系统研究针对深度学习推荐系统的数据投毒攻击。攻击者通过注入精心构造评分的虚假用户，操纵系统输出，使攻击者选定的目标物品被推荐给大量正常用户。作者将攻击建模为一个优化问题，目标是最大化正常用户收到目标物品推荐的数量，但该问题属非凸整数规划，难以精确求解。为此，作者提出多种启发式或近似技术来高效求解。在三个真实数据集（含小规模与大规模）上进行实验，结果表明所提攻击成功率显著优于已有攻击方案。此外，作者还尝试基于评分模式统计特征区分正常用户与虚假用户，以检测此类攻击；但实验显示即便部署此类检测器，攻击依然有效，且仍强于现有攻击。该研究揭示了深度学习推荐系统的数据依赖脆弱性：攻击者无需访问模型内部，仅通过向系统注入少量伪造评分即可实现攻击目标。其主要贡献包括：首次系统性定义并研究该问题、提出可扩展的攻击优化框架、验证了攻击的有效性与检测的困难性。对于推荐系统开发者和安全从业者而言，理解此类攻击机制对构建健壮的推荐服务至关重要。

本文提出 SquirRL，一个利用深度强化学习自动分析区块链激励机制攻击的框架。区块链的激励机制（如矿工奖励）对无许可区块链的安全运行至关重要，它激励参与者维护共识协议。然而，设计激励兼容的机制极具挑战，目前大多数公有链的激励机制缺乏严格的安全验证。SquirRL 的核心思路是将攻击者的策略建模为强化学习中的智能体，通过与环境（区块链协议和激励规则）交互来发现可获利的攻击策略。作者首先通过成功复现已知攻击来验证框架的有效性，表明深度强化学习能够自动发现复杂的攻击行为。该框架有望推动区块链激励机制的安全性分析从人工推演转向自动化探索，降低分析门槛并提高覆盖度。论文适合区块链安全研究者、协议设计者以及关注自动化攻防对抗的机器学习安全从业者阅读。

该论文针对基于深度神经网络（DNN）的网络流量分析系统，提出一种在实时场景下通过盲对抗扰动（blind adversarial perturbations）来欺骗此类系统的方法。流量分析系统常部署于网络边缘，通过分析加密流量的模式（如包长度、时序、方向）来识别用户行为、推断应用类型或检测恶意活动。作者指出，现有的对抗攻击多需要白盒访问或离线计算，难以应用于实时流量传输场景。因此，他们提出一种黑盒的盲扰动生成技术，该技术不依赖目标DNN模型的梯度或内部结构，而是通过观测输入输出关系在线构造扰动，并将其注入到实际流量中，使流量分析器产生错误分类，同时尽量保持网络通信的正常功能。论文的主要贡献包括：设计了一种高效的实时扰动生成算法，适用于高速网络环境；在多个流量分析任务（如网站指纹识别、应用分类）上验证了攻击的有效性；分析了扰动对通信性能（如延迟、包大小）的影响。实验结果表明，该方法能以较低扰动开销达到高攻击成功率，揭示了现有DNN流量分析系统在对抗环境下的脆弱性。该研究属于防御视角下的威胁研究，提醒安全社区需考虑流量分类模型的鲁棒性问题。

该论文针对Web环境中JavaScript反调试技术（Anti-Debugging Techniques）被恶意网站广泛使用以阻碍动态分析的问题，提出了一种自动化检测与分类方法。作者首先对Alexa Top 100万网站进行了大规模爬取，收集了网页中内联脚本和外部脚本，并设计了一套基于静态特征与动态执行相结合的检测框架。该框架通过识别调试器API调用（如debugger语句、console调试方法、定时器干扰等）、控制流混淆模式以及异常执行流程来判定脚本是否包含反调试逻辑。针对检测到的样本，作者进一步开发了细粒度分类器，将反调试技术划分为基于调试器检测、基于时间差异、基于代码执行环境等不同类别。实验结果表明，在收集的约2000万段脚本中，有相当比例的网站至少包含一种反调试技术，且这些技术多集中在恶意软件分发、广告欺诈和钓鱼页面中。论文还评估了现有浏览器防检测机制的不足，并讨论了潜在的对抗策略。该研究为蓝队人员理解恶意脚本的规避行为提供了系统性视角，也为设计更健壮的动态分析沙箱和自动化爬虫提供了参考依据。由于本文仅为摘要，具体数据细节和实验参数需查阅全文。

TASE（Transactional-memory-Accelerated Symbolic Execution）是一篇关于通过事务性内存降低符号执行延迟的研究论文。符号执行是一种强大的程序分析技术，常用于漏洞挖掘、程序验证等领域，但其高昂的运行时开销严重制约了在延迟敏感场景下的应用。TASE针对具有少量符号状态的符号执行应用提出了一种混合执行策略：在执行路径时，优先采用原生执行方式处理具体值，仅在遇到符号值或建模函数时才挂起原生执行并切换到解释执行；一旦不再遇到符号值，则恢复原生执行。论文的核心创新有三点：一是设计了一种摊销成本的技术，使得判断值是否为符号值的检查开销分摊到少量指令中；二是利用硬件支持的事务性内存（Intel TSX）实现原生执行的可回滚性，当检测到（即使延迟检测到）符号值被使用时可无副作用地回滚；三是通过这种机制避免了传统符号执行中频繁的解释开销。实验表明，TASE在延迟敏感的符号执行应用（例如验证客户端-服务器交互中客户端的行为）上具有显著提升潜力的效果。这篇论文主要面向对符号执行性能优化感兴趣的安全研究者和工具开发者，为构建更高效的符号执行引擎提供了新思路，但并未直接涉及特定漏洞或攻击场景。

本文提出了一种实用的盲成员推断攻击方法（Blind Membership Inference Attack），针对机器学习模型的隐私泄露问题。成员推断攻击旨在判断某个具体数据样本是否被用于训练目标模型（如深度神经网络），从而直接威胁用户隐私。现有攻击方法主要分为两类：基于影子模型（shadow model）的攻击和不依赖影子模型的攻击。前者通过训练与目标模型行为相似的影子模型来推断成员关系，其成功率高度依赖影子模型与目标模型之间的可迁移性；后者仅拥有对目标模型的黑盒探测访问权限，但由于缺乏带有真实成员标签的足够样本，其推断未知样本的能力显著弱于基于影子模型的方法。本文的贡献在于提出一种全新的盲攻击框架，通过差分比较（differential comparisons）来有效利用目标模型对多个输入样本的输出差异，从而在无需训练额外影子模型的前提下，在一定程度上弥补传统无影子模型攻击在样本标签不足方面的缺陷。该框架从数学上分析了差分比较信号的可用性，并设计了相应的推断策略。实验结果（基于多个数据集的验证）表明，所提方法在盲设定下能够达到与影子模型攻击相近乃至更优的推理性能，同时显著降低攻击成本。本文适合关注机器学习隐私、对抗性攻击与防御的研究人员、模型部署方以及隐私合规工程师阅读。

该研究源自浙江大学等机构，针对NVIDIA GPU平台上地址空间布局随机化（ASLR）机制的实现缺陷展开系统分析。研究首先逆向梳理了NVIDIA驱动与用户态运行时库在GPU虚拟地址空间上应用ASLR的具体逻辑，发现其熵源质量、随机化时机以及布局更新策略存在多个薄弱环节。通过大量实验测量与对比，论文量化了现有ASLR在GPU场景下的有效熵值，证明其远低于理论上限，并进一步展示了利用这些缺陷可能绕过ASLR防护的攻击场景。研究中还讨论了跨进程信息泄露、内核驱动与用户态运行时之间的协同攻击面，以及不同GPU架构和驱动版本之间的差异。论文的核心贡献在于首次系统性地剖析了GPU ASLR的设计与实现风险，提出了针对该平台的攻击模型，并给出了增强随机化强度、改进熵源管理以及调整运行时库分配策略等防御建议。该工作有助于安全社区重新审视GPU作为通用计算设备时的内存安全隔离边界，为GPU驱动及固件安全审计提供了参考。

该论文针对浏览器扩展漏洞检测的挑战，提出了一种名为 CoCo 的新型检测方法。浏览器扩展在浏览器功能上增加额外能力，同时也引入了新的攻击面，恶意网页可以利用扩展 API 进行权限提升。传统的静态分析方法难以处理动态 JavaScript 特性，例如将函数调用作为数组查找一部分的情况。而现有的抽象解释技术主要针对轻量级服务器端 JavaScript，无法有效扩展到客户端扩展代码，因为抽象域中会出现对象爆炸问题。CoCo 通过结合覆盖引导（coverage-guided）技术与并发抽象解释（concurrent abstract interpretation）来解决这一问题。覆盖引导有助于提高代码路径的探索效率，并发执行则利用多核资源来缓解对象爆炸带来的性能瓶颈。论文通过实验验证了 CoCo 在检测浏览器扩展漏洞方面的有效性和效率，相比已有方法能够发现更多漏洞类型并减少误报。该研究对浏览器安全、扩展程序分析和客户端静态分析领域具有重要参考价值。

本文是首项针对 Kubernetes 控制平面中第三方插件与应用程序权限过大的系统性安全研究。Kubernetes 作为当前主流的容器编排系统，其控制平面通常会运行各类第三方插件（如监控、日志、网络、存储等组件）来辅助集群管理，这些第三方应用往往被授予较高权限。作者指出，这些第三方应用的安全状况此前未被系统性地审视过，而一旦其中一个应用被攻破或存在恶意行为，攻击者可能借助其过度授权横向移动并最终控制整个集群。研究围绕“第三方应用权限过大”这一核心问题展开，分析了相关权限模型、Kubernetes 基于角色的访问控制（RBAC）机制以及第三方应用常见的权限申请模式，并提出了攻击路径的威胁建模方法。论文的主要贡献包括：首次系统性地梳理了 Kubernetes 第三方应用的安全风险面，设计了针对该风险的攻击链分析方法，并通过实验验证了在真实集群环境中利用过度权限可实现集群级接管。该工作为云原生安全领域提供了新颖的研究视角，也为 Kubernetes 集群管理员和插件开发者提供了安全加固依据。适合云原生安全研究人员、Kubernetes 运维及安全工程师阅读。

该论文研究移动即时通讯软件中普遍使用的联系人发现（Contact Discovery）功能所引发的隐私问题。联系人发现允许用户通过通讯录快速找到同样使用该应用的好友，但其实现方式可能泄露用户的社交关系甚至整个通讯录信息。论文指出，当前主流移动聊天应用中部署的联系人发现方法存在严重的隐私缺陷，攻击者可能利用这些缺陷大规模枚举或推断用户的联系关系，甚至获取未注册用户的隐私数据。研究主要通过分析现有协议和实现，展示这些隐私问题的具体表现形式和影响范围，并可能提出改进的隐私保护方案。由于仅获得摘要，具体技术细节、实验设计和结果未能包含，但该工作对移动应用安全、隐私工程和通信协议设计有重要参考价值，适合移动安全研究人员、即时通讯服务提供商及隐私保护开发者阅读。

安全多方计算（MPC）允许多方在不暴露各自输入的情况下协同计算函数。传统上，MPC 编译通常将高级语言程序转化为布尔电路或算术电路，然后执行电路求值。然而，这种电路表示方法并不适应具有复杂控制流（如 if-else 分支、循环、动态跳转等）的程序，因为将这类控制流编译为电路往往会导致指数级增长的电路规模或需要展开所有可能的执行路径，造成极高的编译和运行成本。为缓解该问题，此前的研究提出了在 MPC 内部模拟完整 CPU 的方法，从而允许直接运行未做电路化转换的指令集程序。这种方式虽然能表达任意控制流，但是其代价同样高昂：每一轮求值都需要模拟 CPU 的完整指令周期，包括指令获取（fetch）、解码（decode）、执行（execute）、内存访问（RAM access）等操作，这些步骤本身都会产生额外的 MPC 计算与通信开销，导致整体性能大幅下降。针对这一困境，本文（根据标题）提出了一种基于可变指令集架构（VISA）的通用 MPC 编译器设计思路。VISA 的核心思想或许是通过设计一种可动态调整的指令集，使得编译器能够针对不同的程序特征选择或生成合适的指令表示，从而在电路编译和 CPU 模拟之间取得一种更灵活的折衷，以期减少不必要的 CPU 模拟开销，同时保留对复杂控制流的友好支持。本文的目标可能是提出一个通用的编译框架，使 MPC 能够更高效地处理真实世界中包含大量控制流的程序。鉴于目前仅公开了摘要，具体的架构设计、指令集定义、编译算法、安全证明以及实验评估结果尚未披露。

### Summary Several of AIIR's verification and policy paths could return a success/"verified" result without actually enforcing the control they represent — they could **fail open** rather than fail closed. For a tool whose purpose is trustworthy verification, a consumer relying on these gates may have treated unverified or non-conforming input as verified. Found during an internal adversarial ha

无人机开源飞控 PX4-Autopilot堆栈溢出漏洞 CVE-2025-15150

MongoDB内存泄漏 CVE-2025-14847(MongoBleed)

1Panel 代理证书验证绕过导致任意命令执行漏洞(CVE-2025-54424)

ModelContext Inspector 未授权访问漏洞(CVE-2025-49596)

llamaindex SQL 注入漏洞(CVE-2025-1750)

Screen 本地权限提升漏洞(CVE-2025-23395)

Zabbix认证后SQL注入漏洞(CVE-2024-42327)

ProjectSend认证绕过漏洞(CVE-2024-11680)