Overview Recently, NSFOCUS CERT monitored that GitLab released a security update to fix the GitLab Remote Code Execution Vulnerability (CVE-2026-97229). Due to insufficient validation of regular expressions in GitLab's CI/CD configuration, unauthenticated attackers can construct special regular expressions within the CI/CD configuration to trigger an integer overflow during compilation, thereby...
Author: NSFOCUS
NSFOCUS SecLLM Model on CyberGym Technical Report
Overview SecLLM-3.6-27B is a specialized cybersecurity model developed by NSFOCUS for complex security tasks. In the CyberGym Level 1 evaluation, SecLLM-3.6-27B achieved a 91.37% task success rate under a fixed task-interaction and tool-execution framework, representing an absolute improvement of 36.86 percentage points over the 54.51% base model. ModelSuccess RateAbsolute ImprovementQwen3.8-27B...
AI Security Incident Case: Fake Claude Installation Page Delivered Malware via ClickFix
Overview On October 9, 2026, Push Security disclosed a malvertising campaign targeting Claude users. Attackers set the landing domain of a Google search ad to bing.com, leveraging Bing's own click redirects and multi-layer cloaking to guide users to a counterfeit Claude download page and execute ClickFix-style attacks. Ad platform reviewers...
NSFOCUS Monthly APT Insights – July 2026
Regional APT Threat Situation In July 2026, the global threat hunting system of the FUYING Lab detected a total of 21 APT attack activities. These activities were primarily concentrated in regions including East Asia, Eastern Europe, Middle East, South Asia, Southeast Asia, and South America as shown in the figure...
NSFOCUS Recognized in Gartner® Emerging Market Quadrant for AI Application Security
SANTA CLARA, Calif., Septempber 22, 2026 – Recently, global business and technology insights company Gartner® released its "Emerging Market Quadrant for AI Application Security — Established Vendors" report. NSFOCUS, recognized for its capabilities in the field of AI application security, was selected into the "Specialists" quadrant. In its report "Forecasting the...
AI Security Incident Case: Trusted AI Platforms Become a New Channel for Malware Distribution
Overview On September 11, 2026, the Huntress SOC released a set of cases tracked over a nine-month period. The conclusion ran counter to their own expectations: what is currently being exploited more frequently in the AI domain is not the models or the AI companies themselves, but rather the everyday...
