Cloud & Application Security
Cloud & Application Security
2026-09-02 归档
今日共收录 1494 条安全情报，包含 600 个 CVE，479 篇安全通告，以及 120 篇研究论文。
← 返回归档列表From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Falcon Cloud Security July 2026 Release: Helping Security Teams Move Faster in the Cloud
Falcon Cloud Security July 2026 Release: Helping Security Teams Move Faster in the Cloud
CrowdStrike Named Strongest Overall Leader in 2026 Frost Radar™: Cloud Workload Protection Platforms
CrowdStrike Named Strongest Overall Leader in 2026 Frost Radar™: Cloud Workload Protection Platforms
Non-intrusive and Unconstrained Keystroke Inference in VR Platforms via Infrared Side Channel.
本文披露了主流 VR 平台中控制器与头显交互所用红外（IR）信号存在新型侧信道泄漏，并由此提出一种名为 VRecKey 的击键推断攻击。该攻击利用定制化的 2D 红外传感器阵列，非侵入性地截获 VR 控制器发出的环境红外信号，进而重构用户在
Security Attacks Abusing Pulse-level Quantum Circuits.
该论文首次系统性地探索了针对量子电路中门级（gate-level）与脉冲级（pulse-level）接口以及脉冲级量子电路本身的安全攻击。传统量子程序通常基于门级原语定义，但为了提升电路表达能力并支持更优优化，脉冲级电路正被越来越多地采用。
Old MacDonald had a smart farm: Building a testbed to study cybersecurity in smart dairy farming.
本文关注智能农业（特别是奶牛养殖）中的网络安全问题，提出并建设了一个专门用于研究智能农场安全性的测试平台（testbed）。随着现代精准农业和农业科技的发展，农场正逐渐成为典型的网络物理系统（CPS）：现代奶牛场配备了用于动物监测的物联网（
TrajDeleter: Enabling Trajectory Forgetting in Offline Reinforcement Learning Agents.
该论文研究离线强化学习（Offline RL）中的轨迹遗忘（trajectory unlearning）问题。离线强化学习利用预先收集的静态数据集训练智能体，在医疗、能源管理等无法进行在线交互的真实场景中具有广泛应用。然而，随着数据隐私法规
Passive Inference Attacks on Split Learning via Adversarial Regularization.
本文研究拆分学习（Split Learning, SL）场景下的隐私泄露风险，提出了一种名为 SDAR 的新型被动推理攻击框架。拆分学习被视为传统联邦学习的实用高效替代方案，客户端在本地保留部分模型层（即私有模型）并只与服务器交换中间表征，
Understanding Miniapp Malware: Identification, Dissection, and Characterization.
超级应用（Super App）作为集成了大量第三方小程序（Miniapp）的中心化平台，极大改变了移动计算生态，但同时也引入了来自恶意小程序的安全风险。尽管平台内置的小程序商店实行强制审核，恶意小程序仍不断演化，与平台安全机制持续对抗。相较
The File That Contained the Keys Has Been Removed: An Empirical Analysis of Secret Leaks in Cloud Buckets and Responsible Disclosure Outcomes.
该论文针对云存储桶（如 AWS S3、Google Cloud Storage、Azure Blob Storage）中因配置错误导致敏感文件泄露的问题进行了实证研究。研究背景是云服务日益普及，许多开发中的配置文件包含 API 密钥、凭据等
Demo: A Calibrated, Open-Source Toolkit for MitM Cyberattacks Visualization, Analysis, and Traffic Optimization at Connected Intersections.
本文提出 ICVAT，一个开源的中间人（MitM）攻击可视化、分析与交通流量优化工具包，旨在弥补智能交通系统（ITS）领域对 MitM 攻击实际运行后果及工程缓解策略研究不足的问题。与大多数聚焦底层通信协议安全的工作不同，ICVAT 结合