Di5Guise: 5G Privacy with vSIM
论文提出 Di5Guise 隐私增强架构，解决 5G 网络中 eSIM 设备身份与订阅者身份固定绑定导致的可关联性隐私问题。当前 eSIM 具有固定设备配置文件（包含密钥、证书、唯一 eUICC 标识符），该配置文件永久绑定设备上所有订阅配
#research
共收录 209 条相关情报。
← 返回所有主题15th June – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 15th June, please download our Threat Intelligence Bulletin
obliv-clang: Real-World Oblivious Programming in C++
本文提出 obliv-clang，一个面向 C++ 的编译期检查工具，旨在帮助开发者编写 oblivious（无感知）程序，以防止通过执行时间和数据访问模式泄露秘密的侧信道攻击。传统的侧信道防御通常需要程序员手动改写代码或依赖硬件机制，但
From SQLi to RCE – Exploiting LangGraph’s Checkpointer
By Yarden Porat AI agents need memory. Frameworks like LangGraph provide it through checkpointers – persistence layers t
10caigo贡献值:36000
10caigo贡献值:36000
8th June – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 1st June, please download our Threat Intelligence Bulletin.
Apache Camel JMS 反序列化(CVE-2026-40860)漏洞分析
CVE-2026-40860
Apache Camel JMS 反序列化(CVE-2026-40860)漏洞分析
Hessian 二次反序列化新链从零到一挖掘
Hessian 二次反序列化新链从零到一挖掘
伪装成10086官网流量的Cobalt Strike木马深度分析
伪装成10086官网流量的Cobalt Strike木马深度分析
Java Attach API内存注入
Java Attach API内存注入
Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem
Research by: Alexey Bukhteyev Key Takeaways Introduction When we search Google for a popular piece of software, we usual
1st June – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 1st June, please download our Threat Intelligence Bulletin.
Strengthening Polymorphic Prompt Assembling: Dynamic Separator Generation Against Emerging Prompt Injection Attacks
本文针对大型语言模型（LLM）智能体面临的提示注入攻击，提出了一种增强的多态提示组装（PPA）防御方法。原始的PPA通过从固定池中随机选择分隔符对来隔离用户输入与系统指令，但存在静态池复用导致的“爆炸半径”漏洞：一旦某个分隔符泄露，可在后续
Mind the Gap: Mixtures of Gaussians in Approximate Differential Privacy
本文针对满足 (ε, δ)-差分隐私的标量实值查询函数，设计了一类加性噪声机制，特别关注中低隐私保护水平（即ε较大或δ较宽松）的场景。作者提出的“混合机制”（mixture mechanisms）通过混合多个高斯分布来构造噪声分布，这些高斯
AI Threat Landscape Digest March-April 2026
Executive Summary During the March–April 2026 reporting period, AI use in offensive operations advanced from development
Batch Me If You Can: Coverage-guided RPKI Fuzzing at Scale
资源公钥基础设施（RPKI）已成为保护域间路由安全的关键技术。然而，RPKI软件的安全性测试长期停留在浅层解析阶段，现有模糊测试工具（如AFL++、libFuzzer）因假设每次执行输入单一且独立，无法处理RPKI仓库中数百个相互依赖、经密
25th May – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 25th May, please download our Threat Intelligence Bulletin.
What Gets Measured Gets Managed: Mitigating Supply Chain Attacks with a Link Integrity Management System.
本文针对当前Web应用供应链中资源完整性缺乏有效验证的问题，提出了一种链接完整性管理系统（Link Integrity Management System）。研究背景指出，尽管Web持续增长，但依赖监控工具和资源完整性标准的发展滞后，导致供
Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict
Key Findings Introduction During the recent geopolitical tensions in the Middle East, we reported on multiple Iran-nexus
从客户端加密配置到伪造签名：一次支付金额篡改漏洞的挖掘实录
从客户端加密配置到伪造签名：一次支付金额篡改漏洞的挖掘实录