REPORTS
Fresh threat intelligence we ingest from public vendor and research feeds — each report linked to its original source. Search, filter by source, and open the reference.
Reports
Newest first. Search, filter by source, open the original.
2218 reports · page 31 of 56
lwn_kernel · tlp:amber · 6/15/2026, 1:32:22 PM
Stenberg: curl summer of bliss Daniel Stenberg has announced that curl will not be accepting vulnerability reports from July 1 through August 3, unless the submitter has a paid support contract. He is calling it the "curl summer of bliss". As previously mentioned, we have been under a huge pressure for the last four months or so. Now we need some rest. We do not expect this deluge to be over. [...] If you and your Open Source projects also want to participate in th…
Read original ↗https://lwn.net/Articles/1077946lwn_kernel · tlp:amber · 6/15/2026, 1:04:38 PM
Security updates for Monday Security updates have been issued by AlmaLinux (.NET 9.0), Debian (apache2, chromium, jpeg-xl, librabbitmq, and openssl), Fedora (apptainer, bind9-next, chezmoi, chromium, collectd, composer, dnsdist, gh, python-django5, python-python-multipart, varnish, varnish-modules, vmod-querystring, vmod-uuid, weasyprint, and xorg-x11-server-Xwayland), Mageia (cups, expat, libpng, libssh, memcached, nghttp2, openimageio, packages, proftpd, and radare2), Orac…
Read original ↗https://lwn.net/Articles/1077945cisa_alerts · tlp:amber · 6/15/2026, 12:00:00 PM
CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-20262 Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability CVE-2026-54420 LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant…
Read original ↗https://www.cisa.gov/news-events/alerts/2026/06/15/cisa-adds-two-known-exploited-vulnerabilities-catalogeset · tlp:amber · 6/15/2026, 8:55:00 AM
EvilTokens: A phishing attack that doesn’t steal your password A phishing kit subverting Microsoft’s legitimate authentication flow lets attackers break into accounts without stealing passwords or creating fake login pages EvilTokens: A phishing attack that doesn’t steal your password Award-winning news, views, and insight from the ESET security community English Español Deutsch Português Français TIPS & ADVICE BUSINESS SECURITY ESET RESEARCH About ESET Research Blogpos…
Read original ↗https://www.welivesecurity.com/en/cybercrime/eviltokens-phishing-doesnt-steal-passwordarxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
Choric Masking in Ambient Release Systems: A Finite Certificate Calculus for Trace Indistinguishability under Bounded Audiences arXiv:2606.13967v1 Announce Type: new Abstract: This paper develops a finite certificate calculus for ambient release systems, staged probabilistic environments in which a protected coordinate is not observed directly but can remain statistically readable through visible roles, timing, repeated movement, bounded attention, linked rooms, and post-rel…
Read original ↗https://arxiv.org/abs/2606.13967arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
When Good Verifiers Go Bad: Self-Improving VLMs Can Regress on New Tasks arXiv:2606.14629v1 Announce Type: new Abstract: Verifier-driven self-DPO is a common recipe for self-improving production visual-language models. In this setup, a frozen verifier scores candidate generations, the top- and bottom-scoring candidates form a preference example, and DPO updates the learner. The deployment-time assumption is monotone: a stronger verifier should yield a stronger student. We sh…
Read original ↗https://arxiv.org/abs/2606.14629arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
Detecting Bot Detection: Prevalence, Techniques, and Implications for Web Measurement Research arXiv:2606.14525v1 Announce Type: new Abstract: Browser automation frameworks are essential tools for security and privacy research on the web, yet bot detection scripts increasingly probe their artifacts, threatening measurement validity as automated browsers may be blocked or served different content. Prior work measures detection deployment, while we measure blocking-induced sam…
Read original ↗https://arxiv.org/abs/2606.14525arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails arXiv:2606.14517v1 Announce Type: new Abstract: LLM-based guardrails have emerged as a highly effective defense against prompt injection and jailbreak attacks in autonomous agents. However, we reveal that the very reasoning and task-following capabilities enabling this protection introduce a novel vulnerability: attackers can inject crafted data to trap the guardrail in extended reasoning loops, e…
Read original ↗https://arxiv.org/abs/2606.14517arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
Securing the Future of IoMT in the Post-Quantum Era: An Edge-Native Federated Learning Approach arXiv:2606.14515v1 Announce Type: new Abstract: Internet of Medical Things (IoMT) devices operate under strict resource constraints while handling highly sensitive health data, making security and privacy critical concerns. Federated learning (FL) further complicates this landscape, as model updates exchanged during training may unintentionally expose private medical information. …
Read original ↗https://arxiv.org/abs/2606.14515arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
Breaking TinyML: Why Quantized Neural Networks Need Domain-Specific Security Analysis arXiv:2606.14427v1 Announce Type: new Abstract: Most TinyML hardware accelerators focus on supporting Quantized Neural Networks (QNNs) to meet stringent constraints on power consumption and size. Despite this, the security aspects of quantization within TinyML hardware remain largely unexplored. Although previous studies indicate that QNNs demonstrate similar or enhanced robustness when com…
Read original ↗https://arxiv.org/abs/2606.14427arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
REPOSE: Quantifying the Price of Security in Weakly-Hard Real-Time Cyber-Physical Systems arXiv:2606.14395v1 Announce Type: new Abstract: In contemporary IoT edge devices with real-time requirements, security is primarily enforced through design-time parameters associated with security tasks, leading to mechanisms that operate in an \emph{opportunistic} manner. As a result, security checks are often performed as secondary operations. This approach can result in systems where…
Read original ↗https://arxiv.org/abs/2606.14395arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
AgentCyberRange: Benchmarking Frontier AI Systems in Realistic Cyber Ranges arXiv:2606.14295v1 Announce Type: new Abstract: Frontier AI systems are increasingly capable of cybersecurity tasks, including codebase inspection, vulnerability detection, and exploitation. However, evaluating their offensive capabilities remains constrained by limited access to open, reproducible, multi-host cyber ranges. Existing public benchmarks capture isolated skills such as CTF solving, vulne…
Read original ↗https://arxiv.org/abs/2606.14295arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
Security in a Workflow: Exploring Role-Based Agentic Architectures for Vulnerability Handling arXiv:2606.14261v1 Announce Type: new Abstract: Secure software engineering in practice is a multi-stage workflow involving vulnerability analysis, remediation, and fix verification. However, current LLM-based software security approaches often focus on isolated tasks such as detection or patch generation, with limited attention to agentic architectures reflecting industrial workflo…
Read original ↗https://arxiv.org/abs/2606.14261arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
From Prompts to Responses: Dual-Sided Data Leakage and Defense in Split Large Language Models arXiv:2606.14210v1 Announce Type: new Abstract: Large language models (LLMs) are increasingly deployed in privacy-sensitive domains, where users must balance the risk of data exposure through external APIs against the high computational cost of local deployment. Split learning has therefore emerged as a promising paradigm for LLM fine-tuning and inference under limited local resourc…
Read original ↗https://arxiv.org/abs/2606.14210arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
Security Evaluation of Mobile Banking Applications in Sudan arXiv:2606.14165v1 Announce Type: new Abstract: The rapid digitalization of the Sudanese financial sector has precipitated a surge in Mobile Banking Applications (MBAs); however, this growth has frequently outpaced rigorous security auditing. This study provides a comprehensive technical audit of the four most widely used Sudanese MBAs( Bankak, Fawry, Okash, and Sahil )collectively serving a user base of over 1.6 mi…
Read original ↗https://arxiv.org/abs/2606.14165arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
SkillMutator: Benchmarking and Defending Language-and-Code Cross-modal Attacks on LLM Agent Skills arXiv:2606.14154v1 Announce Type: new Abstract: Large language model (LLM) agents increasingly extend their capabilities at runtime by loading Agent Skills, which pair natural-language specifications (SKILL.md) with executable scripts and resources. Because a skill's behavior relies on both natural-language instructions and executable code, assessing its safety requires cross-m…
Read original ↗https://arxiv.org/abs/2606.14154arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
Hierarchical Identity-Based Signature with Designated Aggregator from Lattices arXiv:2606.14090v1 Announce Type: new Abstract: In hierarchical organizations, authenticating data from multiple users can be complex and resource-intensive. Hierarchical Identity-Based Signature with Designated Aggregator (HIBS-DA) provides an efficient solution by allowing users at different levels to generate signatures that can be combined into a single, compact signature. We first introduce t…
Read original ↗https://arxiv.org/abs/2606.14090arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
Defending the Core: A Centrality-Based Protection Strategy for Supply Chain Security in npm Dependency Network arXiv:2606.14036v1 Announce Type: new Abstract: The modern software supply chain, taking Node Package Manager (npm) dependency network for example, relies heavily on shared open-source dependencies. While this promotes rapid development, it introduces systemic vulnerabilities as well. Concerning this potential risk, we analyze the npm dependency network by modeling …
Read original ↗https://arxiv.org/abs/2606.14036arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
Same-Origin Policy for Agentic Browsers arXiv:2606.14027v1 Announce Type: new Abstract: Agentic browsers integrate autonomous AI agents into web browsers, enabling users to accomplish web tasks through natural-language instructions. The same-origin policy (SOP) is a fundamental browser security mechanism that prevents unauthorized automated cross-origin data flows induced by scripts. However, whether SOP remains effective in agentic browsers is an open question that has not …
Read original ↗https://arxiv.org/abs/2606.14027arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
Pseudonym Scheme Based on Hybrid Certificates for Security Credential Management System in Vehicular Communications arXiv:2606.14008v1 Announce Type: new Abstract: In recent years, the Institute of Electrical and Electronics Engineers (IEEE) and the European Telecommunications Standards Institute (ETSI) have developed a series of security communication standards for vehicular communications. These standards include mechanisms such as the Security Credential Management System…
Read original ↗https://arxiv.org/abs/2606.14008arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
Hidden in Plain Sight: Benchmarking Agent Safety Against Decomposition Attacks with DECOMPBENCH arXiv:2606.13994v1 Announce Type: new Abstract: LLM-based Agents are becoming increasingly capable and widely deployed, creating growing incentives for adversarial misuse in the real-world. A key emerging threat is Decomposition Attacks \cite{glukhov2024breach, jones2024adversaries} in which a harmful task is broken into simpler, benign subtasks that evade safety mechanisms when e…
Read original ↗https://arxiv.org/abs/2606.13994arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
Software Dark Matter: Gazing at Uncharted Files to Navigate SBOM Integrations arXiv:2606.13966v1 Announce Type: new Abstract: Modern software supply chains have evolved into vast, heterogeneous networks where transparency - the granular understanding of all software components - is now a critical security requirement. While Software Bills of Materials (SBOMs) have emerged as the primary mechanism for this transparency, current industry practices rely on a metadata-centric pa…
Read original ↗https://arxiv.org/abs/2606.13966arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
Side-Channel Attacks Bypass Protection in 3D Printers arXiv:2606.13952v1 Announce Type: new Abstract: Active Motor Noise Cancellation (AMNC) ships in commercial fused deposition modeling (FDM) 3D printers as a hardware countermeasure against acoustic side-channel attacks that target intellectual property (IP). We present the first empirical evaluation of a deployed AMNC countermeasure, using a public dataset of synchronized acoustic and vibration recordings from two AMNC-equ…
Read original ↗https://arxiv.org/abs/2606.13952arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
Crypto x AI, AI x Crypto: A Survey arXiv:2606.13892v1 Announce Type: new Abstract: The intersection of crypto x AI is spawning papers, products, online posts, and companies. All the surrounding buzz, though, obscures what exactly has been done, what the opportunities and challenges are, and what open questions deserve attention. This survey paper asks what AI can do for blockchain-based technologies (broadly construed as "crypto") (crypto x AI), and vice versa (AI x crypto).…
Read original ↗https://arxiv.org/abs/2606.13892arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
RTL-Arrow: Hardware-to-Cloud Bridge arXiv:2606.13865v1 Announce Type: new Abstract: Hardware Security at Willamette is a Willamette University affiliated research group studying the hardware-software interface of security critical services. Within our program, we noticed many researchers spent considerable development time learning to understand and manually parse traces-of-execution of hardware designs which are used to identifying whether vulnerabilities or weaknesses aris…
Read original ↗https://arxiv.org/abs/2606.13865arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
Information Flow Paths from RTL Traces arXiv:2606.13860v1 Announce Type: new Abstract: Security validation is an important yet challenging part of the hardware design process, yet, by convention, validation engineers are tasked with defining the threat model, specifying the relevant security properties, detecting any violations of those properties, and assessing the consequences to system security, each of which is manually intensive and may introduce errors. The combined te…
Read original ↗https://arxiv.org/abs/2606.13860arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
Smart Blockchain-Based Access Control for the Internet of Things arXiv:2606.13798v1 Announce Type: new Abstract: Securing access control in large-scale Internet of Things (IoT) deployments requires mechanisms that adapt to risk while preserving low latency for benign traffic. Permissioned blockchains such as Hyperledger Fabric offer auditability through smart contracts, but static endorsement policies impose the same validation depth on all requests, regardless of security p…
Read original ↗https://arxiv.org/abs/2606.13798arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
SEVRA-BENCH: Social Engineering of Vulnerabilities in Review Agents arXiv:2606.13757v1 Announce Type: new Abstract: Large language model (LLM) reviewers are increasingly used in pull-request (PR) workflows, where their approvals help decide which code is merged into a repository. This raises a question that benchmarks for static vulnerability detection or code generation do not address: can an automated reviewer reject a malicious contribution when the attacker controls both…
Read original ↗https://arxiv.org/abs/2606.13757arxiv_cs_cr · tlp:amber · 6/15/2026, 4:00:00 AM
FreoStream:Enhancing Stream Guardrails via Future-Aware Reasoning and Safety-Aligned Optimization arXiv:2606.13737v1 Announce Type: new Abstract: Stream guardrails enable token-level safety detection before full responses are generated. However, they often make overly conservative judgements and block those sensitive but safe tokens, which is known as over-refusal. Due to lack of full context, they also fail to detect implicitly harmful content from jailbreaking. To address …
Read original ↗https://arxiv.org/abs/2606.13737snyk_blog · tlp:amber · 6/15/2026, 12:00:00 AM
The Government Just Banned an AI Model. An Engineer's Perspective. A government order abruptly took down a powerful AI model, exposing a new kind of supply chain risk for engineering teams. Security leaders need contingency plans before the next model disappears. The Government Just Banned an AI Model | Snyk You need to enable JavaScript to run this app. Skip to main content Platform Platform Snyk AI Security Platform Modern security in a single platform Snyk AI Workflows A…
Read original ↗https://snyk.io/blog/government-ban-ai-model-engineer-perspectivelwn_kernel · tlp:amber · 6/14/2026, 6:47:53 PM
The 7.1 kernel has been released Linus has released the 7.1 kernel . " So it's only Sunday morning back home, but it's Sunday afternoon where I am right now, so I'm doing the 7.1 release at the regular time - just not in the regular timezone. " Significant changes in 7.1 include the removal of support for some old 486-based architectures, some new clone() flags making process management easier, BPF support for io_uring, zero-copy-I/O support for the ublk user-space block dri…
Read original ↗https://lwn.net/Articles/1077758snyk_blog · tlp:amber · 6/14/2026, 1:00:00 PM
When a Government Pulls an AI Model: What the Fable 5 and Mythos 5 Suspension Means for Security Teams On June 12, 2026, a US export-control directive led Anthropic to disable Claude Fable 5 and Mythos 5 worldwide over a reported jailbreak. The reported trigger was a code-analysis capability that defenders use routinely. Here is what happened, how the security community read it, and what security teams can take from it. When a Government Pulls an AI Model: What the Fable 5 …
Read original ↗https://snyk.io/blog/fable-mythos-suspension-security-takeawaysunit42 · tlp:amber · 6/12/2026, 10:00:14 PM
Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered Unit 42 has discovered a new macOS Tahoe 26 forensic artifact that tracks user menu selections across the operating system. Learn more here. The post Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered appeared first on Unit 42 . Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered Menu Tools ATOMs Security Consulting About Us Under Attack? Threat Research Center Insights General General Tra…
Read original ↗https://unit42.paloaltonetworks.com/new-macos-artifact-discoveredlwn_kernel · tlp:amber · 6/12/2026, 7:38:09 PM
[$] An overlayfs update In a shortened session in the filesystem track at the 2026 Linux Storage, Filesystem, Memory Management, and BPF Summit , Amir Goldstein gave an update on the overlayfs union filesystem . There are some new features over the last few years that he wanted to mention, along with looking at the status of nesting overlayfs layers. The composefs use case that was discussed at the summit in 2023 has led to some interesting changes to overlayfs.
Read original ↗https://lwn.net/Articles/1077052ars_security · tlp:amber · 6/12/2026, 7:26:47 PM
PeopleSoft 0-day affecting hundreds of organizations steals gigabytes of data Vulnerability in the Oracle-owned PeopleSoft software is about as critical as they come. One of the world’s most active ransomware groups exploited a critical vulnerability in Oracle’s PeopleSoft software suite and used it to target about 100 customers and extort at least one of them to pay up in exchange for not leaking stolen data, researchers said. The group, tracked as ShinyHunters, had been e…
Read original ↗https://arstechnica.com/security/2026/06/peoplesoft-0-day-affecting-hundreds-of-organizations-steals-gigabytes-of-datahuggingface_blog · tlp:amber · 6/12/2026, 3:56:10 PM
olmo-eval: An evaluation workbench for the model development loop olmo-eval: An evaluation workbench for the model development loop Hugging Face Models Datasets Spaces Buckets new Docs Enterprise Pricing Website Tasks HuggingChat Collections Languages Organizations Community Blog Posts Daily Papers Learn Discord Forum GitHub Solutions Team & Enterprise Hugging Face PRO Enterprise Support Inference Providers Inference Endpoints Storage Buckets Log In Sign Up Back to Artic…
Read original ↗https://huggingface.co/blog/allenai/olmo-evallwn_kernel · tlp:amber · 6/12/2026, 1:41:22 PM
Hundreds of AUR packages compromised Hundreds of orphaned packages hosted by the Arch User Repository (AUR) have been compromised by an attacker who has added a malicious npm package ( atomic-lockfile ) that can exfiltrate sensitive data. The project is currently working on cleaning up the mess. There is a list of affected packages and post (possibly NSFW domain) by "sodiboo" with additional information. Arch Linux users (or users of Arch-based distributions) that use AUR pa…
Read original ↗https://lwn.net/Articles/1077718lwn_kernel · tlp:amber · 6/12/2026, 1:12:50 PM
Security updates for Friday Security updates have been issued by AlmaLinux (.NET 10.0, .NET 8.0, .NET 9.0, bind, expat, httpd:2.4, kernel, kernel-rt, mod_http2, openssl, poppler, redis, redis:7, samba, and unbound), Debian (ironic, kernel-wedge, libinput, linux-base, and neutron), Fedora (kernel, openssl, vaultwarden, and vaultwarden-web), Mageia (erlang-hex_core, erlang-rebar3, gnupg2, and sqlite3), Red Hat (buildah, podman, and skopeo), SUSE (flannel, gdk-pixbuf-loader-lib…
Read original ↗https://lwn.net/Articles/1077703cisa_alerts · tlp:amber · 6/12/2026, 12:00:00 PM
CISA Adds One Known Exploited Vulnerability to Catalog CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26…
Read original ↗https://www.cisa.gov/news-events/alerts/2026/06/12/cisa-adds-one-known-exploited-vulnerability-catalogtrail_of_bits · tlp:amber · 6/12/2026, 11:00:00 AM
Factoring "short-sleeve" RSA keys with polynomials What happens when the bits of an RSA private key are heavily biased toward 0 instead of being randomly generated? The public key’s bits could be biased enough for us to detect these incorrectly generated keys in the wild. Together with Hanno Böck of the badkeys project, we found hundreds of unique keys that not only have this property, but can be quickly factored. We also found the bug that led to many of these keys and anal…
Read original ↗https://blog.trailofbits.com/2026/06/12/factoring-short-sleeve-rsa-keys-with-polynomials