Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
Intelligence reports
Loading the current evidence view. Navigation and account controls remain available.
Ordering reports and their extracted indicators.
Applying the current filters and ordering.
Forensia intelligence desk · 4,099 source documents · 4,067 stories
Live reporting, advisories and research arranged by editorial readiness. Thin sources stay visible, but they are clearly marked instead of being presented as complete analysis.
On this page
40 documents
Briefs ready now
40
Multi-source clusters
0
Publisher text withheld
16
Security updates for Wednesday
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
US charges Iranians for sprawling hacking campaign on government agencies, universities
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Prevalent AI Raises $22 Million to Expand Data Fabric Platform
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
US Charges 17 Iranian Hackers, Offers $10 Million Rewards for 5 of Them
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Phishing 3.0: The Fight Moves to Agent Versus Agent
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Describing attacks with crime script analysis
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
943 Patches Rolled Out With Oracle’s August 2026 Security Update
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Chrome, Firefox Updates Patch Dozens of Vulnerabilities
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
CareCloud Data Breach Impact Grows to 3.7 Million Individuals
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
SoK: Cross-Chain Transaction Identification and Matching
arXiv:2608.17532v1 Announce Type: new Abstract: Cross-chain bridges, instant cryptocurrency exchanges, and centralized cross-ledger platforms move assets across an increasingly multi-chain ecosystem. However, these systems have repeatedly become targets of high-value attacks and channels for cross-chain money laundering. Cross-chain transactions are substantially harder to analyze than single-chain transactions: no single ledger records an entire cross-chain transfer, its evi…
CryptDough: A Unified Analytics Engine for Secure Multiparty Computation
arXiv:2608.17529v1 Announce Type: new Abstract: We present CryptDough, a unified analytics engine for secure multiparty computation (MPC). CryptDough enables multiple distrusting parties to jointly execute a data analysis pipeline on their private inputs and learn nothing beyond the result (e.g., aggregate statistics). Unlike existing MPC solutions that support a single threat model or workload type, CryptDough provides built-in support for cross-domain analytics (relational,…
Cross-Domain Joint DDoS Detection in Multi-Controller SDN via Confidence-Based Entropy Fusion
arXiv:2608.17507v1 Announce Type: new Abstract: In multi-controller Software-Defined Networking (SDN), Distributed Denial-of-Service (DDoS) attacks exhibit a "dispersed source, concentrated target" pattern across domains, i.e., attack traffic originates from multiple edge-controller domains but converges on a victim in a single aggregation controller domain. While entropy-based DDoS detectors are effective in single-controller settings, their direct application in multi-contr…
KeyPooling: Measuring Where LLM API Relay Paths Collapse Prompt Cache Isolation
arXiv:2608.17485v1 Announce Type: new Abstract: Large language model (LLM) API relays authenticate customers separately but often forward requests through shared provider credentials. Providers scope prompt caches to upstream principals and namespaces, so relay customers mapped to one cache identity can observe each other's cache state. Prior work showed cache sharing at selected endpoints but did not identify which credential, pool, adapter, or nested hop controls the finali…
Decomposition Attacks Across Unlinkable Identities: Limits of Stateful Defenses for LLM Services
arXiv:2608.17445v1 Announce Type: new Abstract: Most large language model services use stateless defenses, which judge only the current request, to refuse harmful tasks. Decomposition attacks exploit this limitation by splitting a harmful task into individually permissible requests and combining their answers. Defending against them therefore requires a stateful monitor that considers requests together. If it can group all requests for one attacker task, it can stop the attac…
FESC: Remodeling Long-Context Private Inference with Encrypted State-Space Models
arXiv:2608.17442v1 Announce Type: new Abstract: Processing long, sensitive documents with machine-learning models requires efficient, privacy-preserving long-context inference. Prior private inference systems optimize or distribute encrypted Transformer attention, but its quadratic token-pair work remains the bottleneck as sequence length grows. Selective state-space models (SSMs) offer linear-time recurrence, yet direct encrypted implementation incurs linear multiplicative d…
Trusted Workflow Relays:Cross-Tenant Email Abuse and Composable Red Team Initial-Access Primitives in Multi-Tenant Clouds
arXiv:2608.17361v1 Announce Type: new Abstract: Cloud applications routinely send notifications through provider-operated mail identities, which improves deliverability but separates the actor who supplies notification parameters from the service principal that originates the message. In three responsibly disclosed and remediated cross-tenant notification workflows, an authenticated actor could reach recipients across tenant boundaries and, to varying degrees, control content…
Fair ASR: Re-Evaluating Black-Box Jailbreaks under Shared Target-Call Budgets
arXiv:2608.17360v1 Announce Type: new Abstract: Reliable jailbreak evaluation is essential for assessing LLM safety, but most existing studies rely solely on attack success rate (ASR) without accounting for its dependence on attack budgets, resulting in unfair comparisons across methods. Existing compute-aware evaluations reduce heterogeneous resources into FLOPs, which is difficult to estimate for black-box models and fails to capture resource-specific constraints. To provid…
FlowShield: cryptocurrency anti-money laundering with transaction semantics parsing and fund flow tracking
arXiv:2608.17355v1 Announce Type: new Abstract: Cryptocurrency anti-money laundering (Crypto AML) is increasingly challenged by sophisticated laundering behaviors that rapidly fragment stolen assets through diverse semantics and across multiple blockchains. Existing Crypto AML methods often simplify transaction semantics, rely on topology-centric signals, or output isolated detection labels. In this paper, we present \textsc{FlowShield}, a Crypto AML framework for transaction…
When Agents Act on Web3: An Attack-Surface Survey of MCP, Skills, and Tool Calling
arXiv:2608.17275v1 Announce Type: new Abstract: AI agents increasingly act rather than merely read: across the Model Context Protocol (MCP) ecosystem, the share of deployed tools that modify external state has risen from 27% to 65% of tool use. When agents exercise this authority on public blockchains through MCP, skills, and tool calling, the consequences of an attack are governed by the blockchain execution layer rather than by conventional software assumptions. This survey…
ADAPTD: Adaptive Detection and Proactive Threat Defense for Autonomous APT attacks
arXiv:2608.17251v1 Announce Type: new Abstract: Advanced persistent threat (APT) actors increasingly employ sophisticated techniques to propagate laterally through segmented enterprise networks. Timely detection and defense depend on cross-subnetwork coordination, yet maintaining global situational awareness generates substantial communication overhead. To manage this tradeoff, flexible monitoring and adaptable containment are imperative. This paper presents ADAPTD, a communi…
COMIC: Reference-Aware Safety Gating for Multimodal Large Language Models
arXiv:2608.17234v1 Announce Type: new Abstract: Multimodal large language models (MLLMs) are increasingly used to interact with screenshots, scanned documents, diagrams, and other visually grounded inputs. This shift introduces a new safety risk: in many multimodal jailbreaks, neither the prompt nor the image is harmful in isolation. Unsafe behavior emerges only when the model binds an apparently benign operation, such as summarizing, translating, or following, to a localized…
PACE: Policy-Attested Contract Execution for Safe AI Agents in Decentralized Finance
arXiv:2608.17220v1 Announce Type: new Abstract: Autonomous AI agents are emerging as interfaces for decentralized finance (DeFi) actions such as swaps, lending operations, and yield management. Because these agents rely on large language models (LLMs) to plan transactions, they inherit the LLM's susceptibility to prompt injection and lack of mechanisms to bind a verifier's approval to the exact transaction ultimately submitted on-chain. We present PACE (Policy-Attested Contra…
The Acknowledgment Point Is the System: Durable Policy-Decision Receipts for AI Audit Evidence
arXiv:2608.17176v1 Announce Type: new Abstract: An AI audit record is useful only if its durability and trust boundary are explicit. Returning a guarded decision before any durable write minimizes latency, but it cannot guarantee that evidence survives an immediate crash. We rebuild RuntimeGuard-AI around this constraint. The resulting research prototype binds each deterministic policy decision to the exact policy source, commits a privacy-minimizing record at a caller-select…
Beyond the Hype: Evaluating LLM Integration and Practical Limitations in Security Operation Centers
arXiv:2608.17154v1 Announce Type: new Abstract: Large Language Models (LLMs) are increasingly being explored within Security Operation Centers (SOCs) to support text-heavy analytical work such as alert contextualization, incident summarization, and drafting investigative artifacts. Despite this interest, practitioners describe critical operational concerns, most notably hallucinations (plausible but incorrect outputs), opaque reasoning, and the verification effort required to…
Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systems
arXiv:2608.17148v1 Announce Type: new Abstract: A personal language agent learns a fact from one audience and may later place it in the prompt it assembles for another. This memory-to-context step is an attack surface: ambiguous or inconsistent channels, cross-audience prying, and poisoned memory can each cause the system to assemble context containing a fact relevant to the query yet unauthorized for the current viewers. We introduce authorization before context: a single, a…
Picture the Epsilon: Pursuing Identity-Level Privacy Guarantees for Images
arXiv:2608.17147v1 Announce Type: new Abstract: Image-to-image face generators are widely used, and visual dissimilarity between their outputs and source images is sometimes treated as evidence of privacy. Auditing whether these systems satisfy formal identity-level (epsilon, delta)-differential privacy requires choosing among several distinct routes for converting embedding-space observations into estimates or bounds on the differential privacy parameter epsilon. We present…
Protocol-Embedded Compliance for Privacy-Preserving, Non-Custodial Digital Payments
arXiv:2608.17145v1 Announce Type: new Abstract: Received wisdom on payments infrastructure strongly supports the custodial, account-based model as a necessity for transaction integrity, auditability and verification; the set of fundamental primitives for regulated digital money exchange, the argument goes, necessitates designated identifiable entities that store and process credentials, perform KYC, and ultimately act as the 'single version of the truth' for compliance remedi…
Digital Twin-Based Intrusion Detection for Vehicle Powertrain CAN Bus Systems
arXiv:2608.17093v1 Announce Type: new Abstract: Existing automotive intrusion detection systems (IDSs) for the Controller Area Network (CAN) largely target discrepancies in message timing, frequency, or sequencing and cannot detect attacks that preserve these properties while manipulating the payload. Digital twins (DTs) have been used to emulate CAN traffic and generate attack scenarios for IDS evaluation, but their use for intrusion detection remains unexplored. This study…
Structured Driving-State Narratives for Small Language Model-Based GNSS Spoofing Detection
arXiv:2608.17092v1 Announce Type: new Abstract: Autonomous vehicles (AVs) depend on reliable Global Navigation Satellite System (GNSS) positioning. However, spoofed GNSS signals can induce plausible but incorrect vehicle states. This study develops a small language model (SLM)-based framework for detecting and classifying GNSS spoofing attacks by comparing vehicle behaviors independently derived from GNSS and other sensing sources. The framework converts independent driving s…
SentryBus: A Multi-Vantage Observability Model and Validated Instrument for I2C Sensor-Interface Manipulation
arXiv:2608.17082v1 Announce Type: new Abstract: Sensor-driven systems in medical Internet of Things devices, drones, and cyber-physical systems commonly trust a measurement once it reaches the embedded processor. An adversary on the digital interface between sensor and processor can supply a plausible value that correct firmware accepts and reports as ordinary telemetry. The hypothesis is that sensor interface manipulation leaves observable evidence on the acquisition path, t…
CUSTOS: Toward Forensic-Ready Zero Trust at the Capture-Containment Boundary
arXiv:2608.17068v1 Announce Type: new Abstract: Zero Trust (ZT) replaces implicit trust with continuous verification, but mutual TLS, ephemeral workloads, identity-centric control, and automated remediation reduce payload visibility, weaken IP-based attribution, and shrink the window for acquiring volatile evidence. We propose CUSTOS, a forensic-ready ZT reference architecture centered on a Forensic Management Point (FMP) that coordinates tiered capture, identity- and policy-…
Remote-Timer-as-a-Service: Efficient Microarchitectural Leakage in the Cloud with Remote Timers
arXiv:2608.17043v1 Announce Type: new Abstract: Edge computing solutions have become a crucial part of the industry, delivering fast, flexible and scalable applications close to the end users, with typical use cases including dynamic content creation, image resizing and chatbots. Cloudflare Workers is one such framework, which handles millions of HTTP requests per second worldwide. To reduce start-up latency, Cloudflare Workers removes process-isolation boundaries between mul…
Probing the Prefill: Detecting Code Vulnerabilities via Latent Activations
arXiv:2608.16970v1 Announce Type: new Abstract: LLM-based code generation is now embedded in mission-critical pipelines, but defenses against vulnerable output remain post-hoc -- static analyzers, fine-tuned classifiers, or an LLM judge that screen completed code, ignoring the generating model's own internal state. We test a narrower, directly measurable question: when an LLM reads a piece of C/C++ code as context, do its hidden activations already carry a signal about that c…
story desk
clustered evidenceWatchGuard Patches Critical Vulnerabilities
developing · new
Microsoft Rolls Out 22 Fresh Security Patches
source only · new
Google Patches 6th Chrome Zero-Day of 2026
developing · new
Cisco Warns of Unpatched Secure Email Flaws, Patches Critical Switch Vulnerabilities
developing · new
Cisco Patches Critical Crosswork, Secure Workload Vulnerabilities
source only · new
filter by source
sharing classification
TLP describes sharing sensitivity, not copyright permission. Reader text is limited to source-provided descriptive material; original reporting stays with its publisher.