A Seed for Privacy -- semi-automatic privacy-revealing data reminder in databases and data streams arxiv.org
ArXiv paper on pArborist, semi-automatic query growth for privacy-revealing events in DBs and streams, because privacy loves paperwork.
trending30
01 02 Trail of Bits adds a Rust security testing chapter, covering Miri, property tests, Kani, Clippy, and supply-chain vetting.03 Devil in the Lens: Analyzing and Defending Physical Prompt Injection Against Vision-Language Models on Wearable Devices arxiv.orgPhysical prompt injection on AI glasses works across VLMs; the paper also benchmarks a mask filter and semantic detector.04 Attested TLS Was Supposed to Be the Last Trust Boundary. It Isn't. Formal Methods Show How. hackernoon.comProVerif finds CVE-2026-33697, a relay attack that breaks attested TLS binding, so the last trust boundary wasn't.05 Why should a small business care about PQC now? An intro to harvest-now-decrypt-later, crypto-agility, and vendor checklists.06 FINMA Drops The Quantum Hammer: 72% Of Banks Unprepared As Post-Quantum Crypto Deadline Looms + Video undercodetesting.comFINMA's PQC warning: 72% of banks aren't ready, and the article walks through crypto-agility, hybrid TLS, and OpenSSL/liboqs tests.07 Ethereum Foundation on using AI agents to triage protocol bugs, because apparently the hard part is proving the bugs exist.08 TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories arxiv.orgTRACE watermarks LLM-agent trajectories with two keyed channels, trying to survive log deletion and rewriting, which is the annoying part.09 Mini-Programs, Mega-Problems: Unveiling OAuth-based Authentication Misuses in Mini-Programs via Dynamic Analysis arxiv.orgPaper on MINIAUTH, a dynamic crawler for mini-program OAuth bugs, with tens of thousands of apps and one delightful Baidu key-bruteforce...10 Can control-flow attestation catch bending attacks by replaying the path symbolically instead of enumerating it?11 Can you trace a poisoned code completion back to the fine-tuning sample that taught it? CodeTracer says yes, mostly.12 Is SLED ready for PQC, or is this just a polite way of saying nobody knows where the crypto lives?13 Mechanistic jailbreak analysis with paired clean/attacked attribution graphs, finally doing more than waving at prompt gradients.14 Paper on SolSmith, a semantics-aware fuzzing tool that found 25 Solidity miscompiles, because compilers still enjoy surprises.15 ONUG Launches Quantum-Ready Enterprise Advisory Board to Help Enterprises Navigate the Convergence of AI Infrastructure einpresswire.comQuantum-ready advisory board, because the usual enterprise committee apparently wasn't confusing enough.16 Large Language Models (LLMs) and Generative AI in Cybersecurity and Privacy: A Survey of Dual-Use Risks, AI-Generated Malware, Explainability, and Defensive Strategies arxiv.orgHow bad is the dual-use mess? This survey maps LLM cyber use from phishing and malware to explainability and defenses.17 18 DJB critiques the IETF's repeated TLS last call on solo ML-KEM, arguing the process and security story are both wobbly, as usual.19 Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol: An Approval-View Fidelity Gap Across Three Independent Server Implementations arxiv.orgCan MCP tool approvals hide Unicode TAG payloads from humans while still feeding them to the model? Apparently yes.20 OpenSSH 10.4 ships experimental ML-DSA 44 + Ed25519 signatures, plus the usual SSH bugfix pile.21 An essay on CAs revoking Windows code-signing certs for malware, and why PKI was never meant to be a software cop.22 OpenSSH 10.4 release notes: stricter KEX, SFTP/SCP fixes, and an experimental ML-DSA 44 + Ed25519 composite signature.23 What trust assumptions does Robinhood Chain’s Orbit L2 actually make, and how much of it still hinges on Robinhood?24 Off-host auth for AI agents: per-message HMACs, nonce/timestamp binding, and a policy engine the model can't tamper with.25 Arxiv benchmark for polymorphic Sybil poisoning in RAG, with forced exposure and a 4-way failure taxonomy instead of yet another toy attack.26 Governed Individuation: Cryptographically Decoupling an Agent's Learning from Its Authority arxiv.orgPaper on cryptographically freezing an agent's identity so learning can't widen authority, because apparently tools needed a leash.27 Defines conductance-repair evidence graphs for delayed or poisoned security retrieval, plus repair certificates and complexity results.28 A composable leakage framework for adaptive observers, finally unifying transcripts, timing, cache, power, and EM without ad hoc glue.29 OpenSSH 10.4 adds an experimental ML-DSA 44 + Ed25519 composite signature, plus stricter Linux sandbox checks.30 Look-Ahead-Freedom as Temporal Non-Interference: A Verifiable Correctness Property for Backtesting and Agentic Trading Pipelines arxiv.orgPaper formalizes look-ahead bias as temporal non-interference for backtests and trading, with a decidable fragment, naturally.