⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers ru
2026-10-27 归档
今日共收录 787 条安全情报，包含 0 个 CVE，405 篇安全通告，以及 97 篇研究论文。
← 返回归档列表Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub
Genesys Hack Exposes Customer Data From Internal Systems
The Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not affected. The post Genesys Hack Exposes C
Reva: Real-Time Vulnerability Detection through Contextual Probing of Large Language Models
A vulnerability costs more to fix the later it is discovered. As coding agents generate code faster than developers can
Adversary Brains: Hypothesis-Based Logical Signatures for Threat Actor Detection with LLMs
An adversary brain is an LLM-based model of a threat actor's behavior, held as an evolving logical signature: a hypothes
Then there is prompt injection, a malicious email, ...: The Wild Wide West of OpenClaw Agentic System Security
AI-powered personal assistant frameworks such as OpenClaw combine LLM reasoning, persistent memory, tool invocation, loc
Can Open Be Too Open? On the Security and Trustworthiness of Fully Transparent LLMs
There are different levels of transparency for LLMs: open weights, open data, and/or open pipeline. Recently, more inter
GuardRAG: A Post-Retrieval Defense against Poisoning Attacks in Retrieval-Augmented Generation
Retrieval-Augmented Generation (RAG) enhances the factual grounding of Large Language Models (LLMs) by incorporating ext
Steering for Safety, Hijacking for Profit: Trojan Threats in the LLM Activation Steering Supply Chain
As large language models (LLMs) are increasingly integrated into Web search, online recommendation, and intelligent deci
The Target Agent Is Its Own Best Critic but a Poor Proposer: Self-Improved Red Teaming
Automatic red teaming increasingly relies on large language models (LLMs) to iteratively diagnose failed attacks and pro
Scope-Gap Injection: Exploiting Evaluator Channel Blind Spots in the OpenClaw Agent Security Competition
This paper introduces Scope-Gap Injection (SGI), an indirect prompt injection method for multi-stage LLM-agent safety pi
From Representations to Computational Trajectories: Intrinsic Fingerprinting for Large Language Model Provenance Verification
Large language models (LLMs) are valuable digital assets, yet their weights can be easily modified after unauthorized ac
SentryBench: A Cost-Sensitive Benchmark for Adversarial Robustness of Tool-Using LLM Agents in Public-Safety Deployments
Large language model (LLM) agents are increasingly wired to consequential tools that send public alerts, dispatch respon
SymLift: Neural Semantic Lifting for Compile-Free Vulnerability Detection in Context-Incomplete Code Fragments
Missing project context can prevent build-dependent analyzers from constructing program relations required for vulnerabi
Repairing Broken Access Control in Web Applications with LLMs: An Empirical Benchmark Study
Broken access control (BAC) ranks among the most severe web-application vulnerability classes, yet its automated repair
Reversible Pseudonymisation of Documents Sent to External LLMs: an Open Bilingual Benchmark and an Engine
Professionals send working documents to external large language models. A common safeguard is reversible pseudonymisatio
CVE-to-ATT&CK Mapping via Evidence-Constrained Ranking
Mapping CVEs to MITRE ATT&CK techniques helps defenders translate vulnerability information into hypotheses about advers
Enhancing LLM-Based Vulnerability Detection via Representation-Aware Logical Ensemble
Automated vulnerability detection in C source code is a long-standing challenge, as traditional static analysis tools of
Ring-0 by Default: Agents as Operating Systems (AaOS)
LLM agents now read and write files, start processes and subagents, fetch network content, load third-party extensions,