CrowdStrike SafeMind: When the Best Offense Builds the Best DefenseSep 17, 2026
CrowdStrike SafeMind: When the Best Offense Builds the Best DefenseSep 17, 2026
2026-09-25 归档
今日共收录 784 条安全情报，包含 0 个 CVE，390 篇安全通告，以及 100 篇研究论文。
← 返回归档列表New RemControl Android banking malware targets users in Europe and Canada
A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns t
IonQ Targets Quantum Error-Correction Bottleneck With Single-CPU Decoder
IonQ’s new single processor quantum error decoder minimizes the classical computing overhead in quantum error correction
What’s new in Microsoft Security: September 2026
This month's updates help you discover and control local AI agents, extend Zero Trust to agent traffic, and strengthen S
CrowdStrike Named a Leader in The Forrester Wave™: Proactive Security Platforms, Q3 2026Sep 24, 2026
CrowdStrike Named a Leader in The Forrester Wave™: Proactive Security Platforms, Q3 2026Sep 24, 2026
How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers
External security researchers at Accomplish identified a vulnerability in Cloudflare Containers that could expose residu
New Carbonato malware uses AI agents to hijack exposed Docker hosts
A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI
Exposed GitLab project email addresses let attackers push code
Private GitLab email addresses that allow developers to push issues or tasks to a project are being deliberately exposed
FedRAMP VDR & VER: Daily Scans Are Only the Beginning
FedRAMP's new VDR and VER requirements make vulnerability management more continuous, with faster scanning, tighter reme
Hackers now exploit critical Roundcube flaw in code injection attacks
A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to
Windows 11 KB5124010 update released with 46 changes and fixes
Microsoft released the KB5124010 September 2026 non-security preview update for Windows 11 24H2 and 25H2, with 46 change
CISA: Ransomware gangs now exploiting critical TeamCity flaw
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies on Wednesday that ransomware g
OpenAI hacked Australian Medicare govt site, probed data providers
OpenAI agents targeted public data providers in multiple countries, probing some for vulnerabilities and exploiting a se
Microsoft fixes bug that broke Windows File History backup feature
Microsoft has fixed a known issue that breaks the built-in File History backup feature on some Windows systems after ins
Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer
An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudf
Secrets Sprawl Is an Identity Problem That AI Just Made Impossible to Ignore
AI coding agents are changing how quickly developers can build and ship software as well as how quickly credentials can
US Court Sentences Armenian Man to Prison for Ryuk Ransomware Attacks
Karen Vardanyan has also been ordered to pay over $1.2 million in restitution to victims. The post US Court Sentences Ar
Persistent Billable State: Denial-of-Wallet Attacks and Defenses in Tool-Calling LLM Agents
论文研究的是多步工具调用型 LLM Agent 的一个此前被忽视的安全面：会话状态在计费意义上的持久化。这类 Agent 由宿主运行时（host runtime）在轮次之间保存状态，当运行时把外部工具返回的内容带入后续模型输入时，模型服务商
OllamaDrama: Designing and Deploying a Honeypot to Measure Attacks on Exposed LLM Infrastructure
该论文针对一个日益突出但缺乏实证数据的问题展开研究：当自托管的大语言模型（LLM）服务（尤其是 Ollama 这类推理框架的 API）被直接暴露在公网上时，攻击者究竟会做什么。作者指出，尽管公开暴露的 LLM 基础设施持续增长，但业界对其真
LLM Agents Can Easily Tamper With Their Own Traces
该论文聚焦于 LLM Agent 基础设施中的一个被长期默认成立、但实际并不成立的安全前提：Agent 自身的执行轨迹（agent traces）具备完整性，可供异步监控、事件调查与合规审计用来重建「当时究竟发生了什么」。作者指出，现有各类