CrowdStrike SafeMind: When the Best Offense Builds the Best DefenseSep 17, 2026
CrowdStrike SafeMind: When the Best Offense Builds the Best DefenseSep 17, 2026
2026-09-29 归档
今日共收录 1279 条安全情报，包含 376 个 CVE，505 篇安全通告，以及 100 篇研究论文。
← 返回归档列表CrowdStrike Named a Leader in The Forrester Wave™: Proactive Security Platforms, Q3 2026Sep 24, 2026
CrowdStrike Named a Leader in The Forrester Wave™: Proactive Security Platforms, Q3 2026Sep 24, 2026
Cyber Defense Summit 2026Crafted to equip elite security professionals with the strategies, tools, and insights needed to outmaneuver increasingly sophisticated, AI-enabled adversaries and build resilient cyber ecosystems.Watch the keynotes on YouTube
Cyber Defense Summit 2026Crafted to equip elite security professionals with the strategies, tools, and insights needed t
OpenAI is preparing “o,” an always-on ChatGPT assistant that could handle email
OpenAI is testing a new always-on assistant called "o", and references to the unannounced feature briefly showed up on t
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intru
A Win for Defenders: CrowdStrike and NVIDIA Extend Security Across the AI StackSep 28, 2026
A Win for Defenders: CrowdStrike and NVIDIA Extend Security Across the AI StackSep 28, 2026
Japan's Keio confirms ransomware attack disrupted business systems
Keio Corporation (Keio), a major private railway operator in Japan, said its network was hit by a ransomware attack over
Times Car confirms data breach affecting 6.6 million user accounts
Japanese car-sharing service Times Car has confirmed that approximately 6.6 million user accounts were compromised in a
Dutch police confirm arrest in ShinyHunters hacking investigation
Dutch police have confirmed that a 24-year-old Amsterdam man arrested earlier this month was detained as part of an inve
Over 16,000 Supabase databases expose PII, passwords, auth tokens
Researchers found more than 16,000 misconfigured Supabase databases exposing readable tables with personally identifiabl
80,000+ Organizations Had AI Logins Stolen: From Shadow AI to LLMjacking
Infostealer logs exposed AI account credentials and sessions tied to more than 80,000 corporate domains, creating risks
US soldier gets 70 months in prison for extorting 10 tech, telecom firms
A former U.S. Army soldier has been sentenced to 70 months in prison for hacking and extorting at least 10 U.S. technolo
IAM for AI agents: A Practical Enterprise Framework
What is IAM for AI agents? AI agents authenticate, invoke tools, and act across enterprise systems with delegated autho
Silent Failures in Agentic Security Evaluation: A Validated Harness for Tool-Call Mediation Under Indirect Prompt Injection
本文聚焦 LLM Agent 安全评测的「有效性」问题。当 LLM Agent 能够调用具备特权能力的工具（文件读写、邮件发送、代码执行、外部 API 等）时，它就成为间接提示注入（IPI, Indirect Prompt Injectio
"Nothing to See Here'': Unintended Disclosure through Revision Traces of LLM Deliverables
该论文研究 LLM 助手在「为用户代笔、面向第三方收件人」场景下的一类隐私泄露：用户或模型在私有草稿阶段引入某个条目（如密码、密钥、内部信息），随后又将其删除或替换；模型虽然从交付内容中删掉了该条目，却在陈述这次编辑时把它重新说出来，作者称
ReproBench: Benchmarking LLM Agents on Reproducing Vulnerability From Scratch
该论文关注大语言模型（LLM）代理在网络安全任务中的评测问题。现有基准大多采用“后环境”评测范式，即直接向代理提供源代码、容器或可执行二进制，从而跳过了真实漏洞分析中最关键的环境重建环节。作者提出核心问题：代理能否仅凭一个 CVE 编号，自
API Secrets Should Never Become Tokens in the LLM's Vocabulary: A Threat Analysis of API Credential Handling in LLM Agent Systems and an Empirical Evaluation of a Vault-Mediated Execution Boundary
这篇论文指出，随着具备工具调用能力的大模型（LLM）智能体被广泛部署，API 凭证管理的问题性质发生了根本变化：它不再只是"密钥存放是否加密"的存储安全问题，而升级为"密钥会不会进入模型执行链路"的执行安全问题。作者提出的核心论点是：一旦密
SEABench: Benchmarking Endogenous Misalignment In Self-Evolving Agents
该论文研究自演化 LLM 智能体（self-evolving LLM agents）在部署后持续修改自身"装备"（harness，包括控制器指令、记忆管理协议、可复用工具与技能）所带来的内生失配（endogenous misalignmen
CoSec: Benchmarking Agent Security in Communities
该论文针对 LLM 智能体（LLM Agent）在多用户、多社区协作环境中的信息隔离与授权合规问题，提出了名为 CoSec 的可执行安全基准。研究背景是：现有智能体安全评测大多聚焦单用户、单会话、静态权限的场景，而真实部署中的智能体往往运行
Climbing the Hill: Prompt Injection Red-Teaming Against Frontier Models with Curriculum Reinforcement Learning
该论文聚焦大语言模型（LLM）及其衍生的智能体（agent）应用所面临的提示注入（prompt injection）安全风险，研究如何自动化地对前沿模型开展红队测试。现有基于强化学习（RL）的红队方法通常训练一个“攻击者 LLM”来生成注入