Latest security news
Page 14
Thu, October 15
Wed, October 14
KotlinConf Recap: Lessons from Verifone’s Architect on Kotlin in Mission-Critical Payments
This article was written by an external contributor. Yuri Geronimus’s four-year-old son once asked him what his job was. Yuri told him he writes books: books that describe what he wants to change in the physical world. His son didn’t fully get it. Neither would most engineers: if you understand the words in your application […]
Crunchbase: 559,908 件のアカウント情報が流出
crunchbase.com / 侵害日 2026-01-22 / 漏洩データ: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Social media profiles In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters "pay or leak" extortion attempt . Data allegedly obtained from the company was subsequently published publicly and included 560k unique email addresses, largely belonging to leads and business contacts. Other data included names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. Crunchbase later confirmed that a threat ac…
デンマークの880万人分流出、原因はパスワード「123456」 ハッカー「侵入は難しくなかった」 現地報道
デンマークの中央個人登録簿「CPR」から約880万人分の個人情報が流出した問題で、攻撃者を名乗る人物が同国紙Politikenに手口を明かした。侵入には、照会権限を持つ民間企業のパスワード「123456」を使ったという。
Perseid 0.1.0 is now available
I am very pleased to announce that, after a long hiatus, Perseid 0.1.0, a set of utilities for versioning PostgreSQL database schemas, has been released. Perseid 0.1.0 is available from: Codeberg Git repository: https://codeberg.org/perseas/perseid Documentation is available at: https://perseas.codeberg.page/perseid/ Perseid is the successor to Pyrseas . It provides dbtoyaml and yamltodb to extract a PostgreSQL database schema as YAML and to generate or apply SQL to bring a target database into agreement with a YAML specification. This initial release supports SQL SCHEMAs, TABLEs, COLUMNs and…
Better HTTP/1 connection reuse
Go 1.27 includes a change to the HTTP client that can make programs sending many sequential HTTP/1 requests significantly faster.
[悪用確認] CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-17)
[悪用確認] CVE-2026-105133: Ahsay AhsayCBS Improper Authentication Vulnerability
Ahsay AhsayCBS Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-17)
[悪用確認] CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco Secure Email Gateway Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-17)
[悪用確認] CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability
Ahsay AhsayCBS Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-17)
containerd 2.3.7
Welcome to the v2.3.7 release of containerd! The seventh patch release for containerd 2.3 contains various fixes and updates including security patches. Security Updates containerd CVE-2026-95839 GHSA-5p7c-hggf-c748 GHSA-8647-2jxj-p2rc GHSA-hc94-p972-ch66 Highlights Container Runtime Interface (CRI) Apply hardening to not follow symlinks for container log files ( #14301 ) Image Distribution Apply hardening to reject image references with ".." path components ( #14281 ) Runtime Apply hardening to allowlist socket domains in the default seccomp profile ( #14248 ) Snapshotters Apply hardening to…
containerd 2.2.10
Welcome to the v2.2.10 release of containerd! The tenth patch release for containerd 2.2 contains various fixes and updates including security patches. Security Updates containerd CVE-2026-95839 GHSA-5p7c-hggf-c748 GHSA-8647-2jxj-p2rc GHSA-hc94-p972-ch66 Highlights Container Runtime Interface (CRI) Apply hardening to not follow symlinks for container log files ( #14300 ) Image Distribution Avoid hang and data corruption during multipart image fetch ( #14316 ) Apply hardening to reject image references with ".." path components ( #14280 ) Runtime Apply hardening to allowlist socket domains in…
containerd 2.4.2
Welcome to the v2.4.2 release of containerd! The second patch release for containerd 2.4 contains various fixes and updates including security patches. Security Updates containerd CVE-2026-95839 GHSA-8647-2jxj-p2rc GHSA-hc94-p972-ch66 Highlights Container Runtime Interface (CRI) Apply hardening to not follow symlinks for container log files ( #14302 ) Image Distribution Fix excessive memory usage during image pulls when registry downloads outpace content writes ( #14342 ) Apply hardening to reject image references with ".." path components ( #14282 ) Runtime Apply hardening to allowlist socke…
containerd 2.0.14
Welcome to the v2.0.14 release of containerd! The fourteenth patch release for containerd 2.0 contains various fixes and updates including a security patch. Security Updates containerd GHSA-hc94-p972-ch66 Highlights Container Runtime Interface (CRI) Apply hardening to not follow symlinks for container log files ( #14299 ) Runtime Apply hardening to allowlist socket domains in the default seccomp profile ( #14251 ) Snapshotters Apply hardening to filter ID-mapping labels from image annotations during unpack ( #14270 ) Please try out the release binaries and report any issues at https://github.…
nginx-1.30.6 stable and nginx-1.31.7 mainline versions have been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery vulnerability when using TLS session ticket key rotation (CVE-2026-97629), and use-after-free vulnerability when using ngx_http_ssi_module with AIO (CVE-2026-97205).
2026-10-14 nginx-1.30.6 stable and nginx-1.31.7 mainline versions have been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery vulnerability when using TLS session ticket key rotation (CVE-2026-97629), and use-after-free vulnerability when using ngx_http_ssi_module with AIO (CVE-2026-97205).
Bagisto MariaDB Vector Semantic Search
I’m always interested to see how MariaDB Vector is being used in real applications, beyond the usual demos and simple similarity-search examples. In this guest post, the team behind Bagisto takes a very practical look at semantic search for e-commerce using MariaDB Vector. What I particularly like is that they don’t stop at showing it […] Bagisto MariaDB Vector Semantic Search appeared first on MariaDB.org
Announcing .NET 11 Release Candidate 2
.NET 11 Release Candidate 2 is available with improvements across libraries, runtime, SDK, MSBuild, NuGet, F#, ASP.NET Core, .NET MAUI, and Windows Forms. The post Announcing .NET 11 Release Candidate 2 appeared first on .NET Blog .
r8.3.13
r8.3.13
r8.0.34
r8.0.34
r7.0.45
r7.0.45
防災情報配信サービス「SpeeCAN RAIDEN」への不正アクセスについてまとめてみた
2026年10月13日、アルカディアは、同社が運営する防災情報配信サービス「SpeeCAN RAIDEN」が第三者による不正アクセスを受け、個人情報が漏えいした可能性があると公表しました。ここでは関連する情報をまとめます。 不正アクセスの開始から全サービスの復旧まで アルカディアが10月19日に公表した「不正アクセスの経過と当社の対処について」によると、不正アクセスは10月11日6時26分に始まった。原因は、添付ファイルを公開しているメディアサーバーに、内部のURLにアクセスできるディレクトリパストラバーサルが存在していたこと。内部ソースファイルが取得されて設定ファイル内のサービス間ログイン用…
Tue, October 13
キャッシュレスサービス「IDARE」、約13万人の個人情報漏えい 残高や取引履歴なども
プリペイド式のキャッシュレスサービス「IDARE」を運営するFivotは10月13日、不正アクセスにより約13万人分の個人情報が漏えいしたと発表した。
フランス国内の小売チェーンで発生した冷凍冷蔵設備の遠隔操作についてまとめてみた
2026年10月12日、フランスの複数の小売チェーンで、店舗の冷凍冷蔵設備が遠隔操作され食品の廃棄に至るサイバー攻撃が明らかになりました。ここでは関連する情報をまとめます。 小売各社の店舗で庫内温度が上昇 2026年10月11日夜から12日未明にかけて、フランスの複数の小売チェーンの店舗で冷凍冷蔵設備が遠隔操作され、設定温度が50度にされた(出典: 4, 5, 8)。不正操作の開始時刻は店舗により異なり、パリ近郊でSuper UやMonoprixを運営する店舗経営者は午前3時頃に警報を受けたと説明し(出典: 9)、Intermarché Grand-Couronne店(セーヌ=マリティーム県)…
Agents on Rails: Stage 3. Can a model build on its own work?
Now that we understand better how agents deal with contained tasks and contained codebases, it’s time to push them a little harder. Stage 3 adds a set of large multi-step tasks that test how well a model can build on its own work over multiple sessions without turning it into a hot mess. We’ve also greatly expanded the variety of apps we test the models on.
Python 3.16.0 alpha 1 is now available
The first developer preview of Python 3.16 is ready for testing.
[悪用確認] CVE-2026-96951: Microsoft Windows Command Injection Vulnerability
Microsoft Windows Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-16)
[悪用確認] CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti Connect Secure Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-16)
Sharecare: 318,185 件のアカウント情報が流出
sharecare.com / 侵害日 2026-08-12 / 漏洩データ: Dates of birth, Email addresses, Employers, Genders, Government issued IDs, Job titles, Marital statuses, Names, Phone numbers, Physical addresses In August 2026, the digital health company Sharecare was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data it claimed was taken from Sharecare's systems, containing 318k unique email addresses. Most of the data consisted of B2B sales and marketing records with names, physical addresses, phone numbers, job titles and employers. The data also included a small…
.NET and .NET Framework October 2026 servicing releases updates
A recap of the latest servicing updates for .NET and .NET Framework for October 2026. The post .NET and .NET Framework October 2026 servicing releases updates appeared first on .NET Blog .
Community Spotlight: Slava Rozhnev and SQLtest.online
Open source runs on people. Not only the engineers who commit code, but everyone who builds tools, answers questions, writes tutorials and shows up when help is needed. Slava Rozhnev, creator of SQLtest.online, is one of those people for MariaDB. He has been creating SQL quizzes with the MariaDB Foundation for a while now, and […] Community Spotlight: Slava Rozhnev and SQLtest.online appeared first on MariaDB.org
Durable Task in the Real World: What Problems Does It Actually Solve?
Five practical examples of when durable execution makes sense, when it does not, and what it means for AI agents. The post Durable Task in the Real World: What Problems Does It Actually Solve? appeared first on .NET Blog .
Mon, October 12
PowerDNS DNSdist 2.1.3 and 2.0.11 Released
Today we released DNSdist 2.1.3 and 2.0.11, fixing several issues. The notable one fixes an issue where incoming DNS over TLS and DNS over HTTPS connections could have been wrongly terminated early, when the OpenSSL provider is in use. We advise all users providing DNS over TLS or DNS over HTTPS to upgrade, but to be clear this is NOT a security issue.
GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8
On October 12, 2026, we released versions 19.4.2, 19.3.5, 19.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). 19.3.4 had a bug that affected merge request pages when the Ona integration was enabled. This is fixed in 19.3.5. These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. All GitLab Dedicated tenants were patched using an internal release before this patch release was published. GitLab releases fixes…
Ruby 4.1.0-preview1 Released
We are pleased to announce the release of Ruby 4.1.0-preview1. Ruby 4.1 introduces Ractor local GC, Windows support of YJIT, autoload_relative, and adds many improvements. Ractor improvements A lot of work has gone into making Ractors more stable, performant, and usable. These improvements bring Ractor implementation closer to leaving experimental status. The default GC now runs per Ractor : each Ractor collects its own heap on its own thread without stopping the others, and a stop-the-world collection only runs when it is really needed (explicit full GC.start , shareable-object growth, recla…
Scala 3.10 released!
Scala 3.10 released! We are happy to announce Scala 3.10.0 , the first release of the new Scala Next series. This release stabilizes SIP-67 , moves three SIPs into preview, and starts dropping legacy language features that have been deprecated for several minor releases. Scala 3.3 LTS and Scala 3.9 LTS put compatibility with Scala 2.13 first. Now, nearly five years after Scala 3.0, Scala 3.10 starts removing legacy syntax and features that have been deprecated for several minor releases. The standard library also starts using more Scala 3 features, such as inline and extension methods. Binary…
Sun, October 11
AnthropicのAIモデルが米国政府サイトへ意図しない送信を行っていた事案についてまとめてみた
2026年10月9日、Anthropicは、評価や社内利用の中で自社のAIモデルClaudeが実在のウェブサイトやシステムに対して意図しない行動をとっていたとする報告を公表しました。一部は米国の政府機関のサイトが関係するとしています。ここでは関連する情報をまとめます。 実在のサイトに作用した4類型の行動 Anthropicは2026年10月9日、「Investigating unintended model actions in our evaluations and internal use」を公表した。評価や社内利用の中でClaudeが外部の組織や個人に関わる実在のサイトやシステムに作用し…
Yandexのデータセンター障害についてまとめてみた
2026年10月8日、Yandex Cloudは可用性ゾーンru-central1-bで電源が途絶し、サービスが利用できない状態になっていると告知しました。その後、Yandexはデータセンターがドローン攻撃を受けて火災が起き、稼働が完全に停止したと公表しています。ここでは関連する情報をまとめます。 可用性ゾーン ru-central1-b の電源障害 以下、Yandex Cloudの告知の時刻はモスクワ時間。Yandex Cloudのステータスページには、10月8日1時31分に可用性ゾーンru-central1-bで電源が途絶したと記録されている。重大度は利用不能(Unavailable)で、…
国内で相次ぐ不正アクセスに対する注意喚起についてまとめてみた
2026年10月7日から9日にかけて、個人情報保護委員会、JPCERT/CC、国家サイバー統括室、IPAなどの各機関が、国内組織で相次ぐ不正アクセスによる個人情報の漏えいを受けた注意喚起を公表しました。ここでは関連する情報をまとめます。 BIツールや従業員向けシステムも被害に JPCERT/CCは10月8日に公開した注意喚起で、「2026年9月前後」に国内組織で不正アクセスによる個人情報等の漏えい被害が相次いでいるとした。複数の製品やサービスで被害が発生している中、「技術的な情報の共有が不足しており、把握している情報は限定的かつ断片的」とも記している。同注意喚起は、普段から断続的、散発的に発生…
Sat, October 10
Bun v1.4.3
To install Bun v1.4.3 curl -fsSL https://bun.sh/install | bash # or you can use npm # npm install -g bun Windows: powershell -c " irm bun.sh/install.ps1|iex " To upgrade to Bun v1.4.3: bun upgrade Read Bun v1.4.3's release notes on Bun's blog Thanks to 8 contributors! @alii @cirospaciari @dylan-conway @eastlondoner @jarred-sumner @robobun @sosukesuzuki @steipete
Bun v1.4.3
Fixes 166 issues, addressing 122 👍. bun check, a TypeScript type checker built into Bun that is 3x to 6.4x faster than tsc 7, --check for bun run, bun build and bun test, 67–89% less idle CPU, Bun.FetchSession, experimental Bun.ModuleGraph, --disallow-code-generation-from-strings, up to 2.7x faster large node:http responses, a JavaScriptCore upgrade with faster JSON.parse, faster rejected-promise handling, CompressionStream compression levels, If-Range support in Bun.serve, bun install skips tarballs it won't install, lower bun build memory with many entry points, [hashN] output names, profi…
コミューンの「Commune」への不正アクセスについてまとめてみた
2026年10月9日、コミューンは、同社が運営する「Commune」「Commune for Work」が外部の第三者による不正アクセスを受け、一部のコミュニティで会員情報が外部の第三者に漏えいしたと公表しました。ここでは関連する情報をまとめます。 全コミュニティを停止 不正アクセスは2026年10月5日18時ごろに始まった。コミューンは10月6日にこれを検知し、通信遮断と防御措置を実施*1。(出典: 2)コミューンは10月6日21時ごろから全コミュニティをメンテナンスモードに切り替えてサービスを停止し、詳細の調査、対策、データの復旧を行った。10月7日にはメンテナンス中に残っていた通信経路を…
Deno is joining Cloudflare
Putting ourselves in the best place to build the future of the web
Fri, October 9
ヤマハ・スズキも漏えいか 交流サイト基盤「コミューン」不正アクセス、計30万会員に影響の恐れ
オンラインコミュニティー作成サービスを手掛けるコミューン（東京都品川区）は10月9日、「Commune」「Commune for Work」といったサービスが不正アクセスを受け、約30万7000会員分の情報が漏えいした可能性があると発表した。同社のサービスを使って交流サイトを運営していたスズキやヤマハもそれぞれ影響を公表している。
NewsPicks、メアド32.3万件やクレカ情報の一部36.2万件漏えいか【訂正あり】
ユーザベースは10月9日、「NewsPicks」の管理ツールへの不正アクセスについて、漏えいした可能性のある情報の最大件数を公表した。クレジットカード情報の一部が約36万2000件、メールアドレスが約32万3000件に上り、氏名や住所、勤務先も含まれる。
韓国の銀行狙ったサイバー攻撃、犯人は「中国在住の26歳」か Claudeで作られた“履歴書”から浮上
米CrowdStrikeは10月7日（現地時間）、韓国の金融機関を狙ったサイバー攻撃の攻撃者が、中国在住の26歳の人物である可能性を示す分析結果を公表した。攻撃者が使ったAIツールの履歴に、本人のものとみられる個人情報が残っていたという。
光回線代理店営業担当による競合事業者への不正アクセスについてまとめてみた
2026年10月8日、警視庁は光回線の販売代理店「オフィシャル」の営業担当2人を、競合する事業者の顧客マイページに不正アクセスした疑いで逮捕したと発表しました。ここでは関連する情報をまとめます。 営業担当2人の逮捕 警視庁サイバー犯罪対策課は10月8日、埼玉県所沢市の光回線販売代理店「オフィシャル」の営業担当の40歳と38歳の2人を、不正アクセス禁止法違反と不正競争防止法違反(営業秘密の取得、使用)の疑いで逮捕したと発表した。2人は容疑を認めている(出典: 5, 6, 8)。被害事業者はインターネットプロバイダの「hi-ho」(ハイホー)とされる(出典: 7)。逮捕容疑は2025年10月3日と…