Latest security news
Page 15
Fri, October 9
Neogen: 435,963 件のアカウント情報が流出
neogen.com / 侵害日 2026-08-29 / 漏洩データ: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Salutations In August 2026, the food and animal safety organisation Neogen was the target of a ShinyHunters "pay or leak" extortion attempt . The group later published data it claimed had been obtained from Neogen. The data consisted largely of corporate contact records and included 436k unique email addresses from mailing lists, employee records and other contacts.
米国防総省にも不正アクセス 個人情報300万人分が平文で漏えいか……発覚までに9カ月
米国防総省の国防人事データセンター（DMDC）のサーバが不正アクセスされ、軍人や元軍人など300万人余りの個人情報が何者かに閲覧されていたことが分かった。米国では連邦捜査局（FBI）もサイバー攻撃を受け、捜査官らの個人情報が流出したと伝えられたばかりだった。
Anthropic、サイバー防御の新たな取り組み「Cyber Mission」 OSS向け無料脆弱性スキャンや重要インフラ防御プログラムも
Anthropicは、社会インフラ保護を支援する「Anthropic Cyber Mission」を発表した。電力や交通などの制御機器防御を担う事業者を支援する「CIDP」と、最上位モデルでOSSの脆弱性を無償スキャンする「OSS Scanner」の2施策を開始し、防御側にAIや研究成果、技術者を提供する。
国家サイバー統括室、不正アクセスによる漏えい事案受け注意喚起 「いつ攻撃受けてもおかしくない」
内閣官房国家サイバー統括室は10月9日、不正アクセスで個人情報を含むデータを窃取する事案を複数確認しているとして、事業者に対策の徹底を求める文書を公開した。具体策として、委託先の管理やアクセスログの点検などを挙げている。
Better ACL S3 control and more
Hi, Wojtek here. Let’s explore this week’s changes in the Rails codebase.
Python 3.15.0 (final) is here!
A brand new Python here for you to enjoy!
デンマークのCPR登録簿への不正アクセスについてまとめてみた
2026年10月5日、デンマークの研究、教育、デジタル化省は、同国の中央個人登録(CPR)で、大量の登録者の情報に第三者が不正にアクセスしたと公表しました。ここでは関連する情報をまとめます。 民間企業の正規アクセスを悪用した情報取得 研究、教育、デジタル化省(Forsknings-, Uddannelses- og Digitaliseringsministeriet)は10月5日、CPRの管理主体であるCPR-administrationenが、第三者が民間企業の正規アクセスを悪用してCPRを照会し、約880万人の登録者の氏名、住所、CPR番号ほかに不正にアクセスしたことを確認したと発表した…
Upcoming Next.js Security Update for Upstream Vulnerabilities
Next.js plans to publish an out-of-band security update next Wednesday, October 14, 2026, addressing two Critical and one High severity vulnerabilities in upstream dependencies.
What's new in Swift: September 2026 Edition
Welcome to “What’s new in Swift,” a curated digest of releases, videos, and discussions in the Swift project and community. The Vapor web framework recently turned ten and celebrated with Vapor Week! We’ve invited one of the authors of Vapor as this month’s guest contributor: Hi, I’m Tim from the Vapor Core Team! 10 years ago, in September, Vapor 1.0 was released, and over the years Vapor has matured into a comprehensive framework for building backends and APIs in Swift. On the anniversary we released the first beta of Vapor 5 , the next major version of Vapor, which is a complete rewrite, re…
PHP 8.6.0 RC3 available for testing
The PHP team is pleased to announce the first release candidate of PHP 8.6.0, RC3. This continues the PHP 8.6 release cycle, whose rough outline is specified in the . PHP Wiki Source downloads of PHP 8.6.0 RC3 are available on the . download page Please carefully test this version and report any issues found in the . GitHub Issues Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the release archive. NE…
Thu, October 8
Building a Public Performance Change Detection Library for MariaDB
Performance engineering inside a database project is usually private. Teams run internal workloads, investigate changes, fix issues, and move on. The knowledge stays inside the company, and the outside world only sees a benchmark graph or a release note. I know this pattern well — I spent more than twenty‑six years doing this work for […] Building a Public Performance Change Detection Library for MariaDB appeared first on MariaDB.org
Django security reporting update
We are no longer accepting new security reports for the Django project through HackerOne. Existing reports submitted through HackerOne will remain open and continue to be handled by the Django Security Team. If you discover a security issue in Django, please follow the reporting process described in the Django security policies . Security issues should be reported by emailing security@djangoproject.com
Open Source milestone – MariaDB’sEcosystem hub hits 200 solutions
New ‘App store of open source’ is one stop shop serving the fast-growing MariaDB community’s needs for applications, developer tools, cloud platforms and projects. The MariaDB Foundation today announces the MariaDB Server Ecosystem Hub has exceeded 200 entries, just six months after launch. The Hub is a curated, open directory of MariaDB Server approved products, […] Open Source milestone – MariaDB’sEcosystem hub hits 200 solutions appeared first on MariaDB.org
[悪用確認] CVE-2015-3306: ProFTPD Improper Access Control Vulnerability
ProFTPD ProFTPD ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-11)
[悪用確認] CVE-2021-3199: ONLYOFFICE Docs Server Path Traversal Vulnerability
ONLYOFFICE Docs ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-11)
[悪用確認] CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability
Strapi Strapi Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-11)
[悪用確認] CVE-2016-3081: Apache Struts Command Injection Vulnerability
Apache Struts Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-11)
[悪用確認] CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability
ISC BIND ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-11)
CyrusOne: 373,460 件のアカウント情報が流出
cyrusone.com / 侵害日 2026-08-05 / 漏洩データ: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets In August 2026, data centre operator CyrusOne was the target of a ShinyHunters "pay or leak" extortion attempt . The group subsequently published data allegedly obtained from the company, which included 373k unique email addresses across records relating to users, sales leads and CyrusOne employees. The data largely consisted of corporate contact information, including names, physical addresses, phone numbers and job titles. It also included support tickets…
IDCFクラウドへのランサムウェア攻撃についてまとめてみた
2026年10月7日、IDCフロンティアは、同社が提供するクラウドサービス「IDCFクラウド」の一部のシステムが第三者からのランサムウェア攻撃を受け、障害が発生していると公表しました。ここでは関連する情報をまとめます。 東日本リージョン1の4ゾーンで仮想サーバーが停止 IDCフロンティアは10月7日の第1報と第2報に続き、10月8日21時2分の第3報で、障害の発生は10月7日午前3時40分頃で継続中と公表した(出典: 1, 2, 3, 4)。対象はIDCFクラウドの東日本リージョン1のうち、tesla、henry、pascal、jouleの4ゾーンで、クラウドサービス上の仮想サーバーの停止と再…
Wed, October 7
Start Your Next KMP App With Kotlin Toolchain 0.13
The Kotlin Toolchain is a unified entry point into Kotlin. It lets you build JVM, Android, iOS, multiplatform, and server-side applications with a simple declarative configuration. With the release of v0.13, we now recommend the Kotlin Toolchain for most new Kotlin Multiplatform (KMP) projects. Earlier this year, we promoted the Kotlin Toolchain to Alpha. Since […]
損保ジャパン、約6万件漏えいか 大和証券・シチズンと同じ委託先への不正アクセスで
損害保険ジャパンは10月7日、事業者向けドライブレコーダー「SMILING ROAD」の問い合わせ対応に使う外部委託先のシステムが不正アクセスを受け、顧客情報が漏えいした可能性があると発表した。氏名や住所のほか、運転アラートの種別や発生日時も含むという。
Laravel 13 now supports MariaDB Vector natively
If your Laravel application runs on MariaDB, you can add semantic search to it without a second database, an external vector service or an extra package. Since Laravel 13.28, vector columns, vector indexes and similarity queries work on MariaDB out of the box. A large part of that work came from community contributors, including Mohamed […] Laravel 13 now supports MariaDB Vector natively appeared first on MariaDB.org
関西国際大に不正アクセス、学生の記録などが外部流出か 授業や手続きにも支障
関西国際大学は10月6日、eポートフォリオシステムへの不正アクセスで、過去に在籍した学生の在学中の振り返りなどの文字情報が外部に流出したと発表した。学内Wi-Fiを含むネットワークを止めており、授業や学生生活にも支障が出ている。
Double Counter: 274,922 件のアカウント情報が流出
doublecounter.gg / 侵害日 2026-10-04 / 漏洩データ: Email addresses, Geographic locations, Names, Usernames In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool . In its disclosure notice, Double Counter advised that attackers gained access to a subset of its data. A corpus of data was subsequently published publicly and contained 275k unique email addresses and Discord usernames. A small number of records belonging to paying subscribers whose purchases were processed via Stripe were also present and i…
Angel One: 6,765,054 件のアカウント情報が流出
angelone.in / 侵害日 2023-04-01 / 漏洩データ: Bank account numbers, Dates of birth, Email addresses, Financial investments, Government issued IDs, Names, Phone numbers, Physical addresses In July 2024, the Indian stock brokerage firm Angel One confirmed that data leaked online related to a breach that occurred in April 2023 . The leaked data included 7.9M user records containing 6.8M unique email addresses, along with names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs) and portfolio holdings. Angel One emphasised that the breach "has no impact on client se…
1億件超えの「楽天会員」情報が闇フォーラムで販売？ 楽天「漏えいは確認されていない」
楽天の会員情報約1億100万件をうたうデータがサイバー犯罪フォーラム上で売りに出されたとの報道があった。楽天グループはITmedia NEWSの取材に漏えいの事実を否定し、投稿に掲載されたサンプルデータも「該当するアカウント等は確認されていない」と回答した。
バイブコーディングで作った公開中のWebアプリ、9割に脆弱性 MSの研究者など調査
米Microsoftやシンガポール国立大学などに所属する研究者らが発表した論文「Understanding the (In)Security of Vibe-Coded Applications」は、AIに自動生成させたアプリケーションに潜む脆弱性の実態と、その原因を調査した研究報告だ。
スカラコミュニケーションズへの不正アクセスについてまとめてみた
2026年10月6日、スカラコミュニケーションズは、同社が提供するFAQシステム「i-ask」の管理サイトへの不正アクセスにより、利用企業の問い合わせ情報が漏えいした可能性があると公表しました。ここでは関連する情報をまとめます。 管理サイトへの不正ログインから遮断まで 株式会社スカラコミュニケーションズ(以下、SC社)によると、2026年10月2日20時30分頃から10月3日8時頃にかけて、第三者がi-askの管理サイトに不正にログインし*1、同社が管理するサーバー上に不正なプログラムを設置したうえで、同一サーバー上で稼働していた利用企業のシステム環境のデータベースから問い合わせ情報を取得した…
ランサム攻撃起因とみられる大阪公立大学のシステム障害についてまとめてみた
2026年10月5日、大阪公立大学は会見を開き、10月2日に発生した情報基盤システムの大規模な障害について、サイバー攻撃、いわゆるランサムウェア攻撃によるものと判断していると説明しました。ここでは関連する情報をまとめます。 2日未明に全キャンパスの基盤システムが停止 2026年10月2日未明、大阪公立大学の情報基盤システムで大規模な障害が発生し、全キャンパスで学内システムの利用が停止した*1 (出典: 2)。障害は、システムの運用を委託する事業者からの連絡で発覚した(出典: 2, 15, 16)。大学は、障害が仮想化基盤システムで発生したと説明している(出典: 12)。会見で配布された資料には…
東洋紡グループのメールアカウントへの不正アクセスについてまとめてみた
2026年9月25日、東洋紡は、グループ会社の従業員が利用するメールアカウントが第三者による不正アクセスを受け、フィッシングサイトへの誘導を目的とした不審メールが送信されたと公表しました。その後、不審メールを受信した別のグループ会社の従業員も不正アクセスを受けたことが公表されています。ここでは関連する情報をまとめます。 東洋紡せんいの従業員アカウントから不審メール 2026年9月24日11時頃、東洋紡せんいの従業員が利用するメールアカウントが第三者による不正アクセスを受け、このアカウントから不審なメールが送信されたことが確認された。その後の調査で、送信先は東洋紡グループの内部と外部の関係者で、…
シンテックホズミの元社員2人が逮捕された営業秘密漏えい事件についてまとめてみた
2026年10月5日、愛知県警は、トヨタ自動車の子会社シンテックホズミの元社員の男女2人を、同社の営業秘密を漏らしたなどとして不正競争防止法違反の疑いで逮捕し、発表しました。ここでは関連する情報をまとめます。 元上司と元部下の2人を逮捕 シンテックホズミは愛知県みよし市に本社を置く搬送用機械装置メーカーで、株主はトヨタ自動車(70%)など(出典: 1, 2)。県警は5日、同社の元社員で元上司の男(48)と元部下の女(60)を、不正競争防止法違反(営業秘密の領得、開示)の疑いで逮捕した(出典: 5, 7)。県警によると、男は設計部長などとして、女は主に設計部で勤務していた(出典: 3)。営業秘密…
VirtusLab assumes responsibility for Scala 2 maintenance
We are happy to announce that VirtusLab has assumed responsibility for maintenance of Scala 2 . This means that VirtusLab, in coordination with the Scala Center and the Scala Core Team, now manages the development of both Scala 2 and Scala 3. Former members of the Scala 2 team at Akka have joined the VirtusLab OSS team, so there will be no impact on Scala 2 maintenance or Scala 2’s future. Our plans for Scala 2 maintenance have long been documented at https://www.scala-lang.org/development/#scala-2-maintenance and the wordings there have not changed. VirtusLab will maintain Scala 2.12 and 2.1…
runc v1.6.0-rc.1 -- "Lo bueno, si breve, dos veces bueno."
This is the first release candidate of the upcoming runc 1.6.0 release. It contains a couple of new features, but is mostly made up of various cleanups (such as the removal of many deprecated APIs) and improvements. This version includes all of the patches backported to runc v1.5.2. Users are strongly encouraged to test our release candidates so we can fix issues before the general release. libcontainer API configs.ToCPUSet now returns a unix.CPUSetDynamic instead of a *unix.CPUSet , and the Initial / Final fields of configs.CPUAffinity and the Nodes field of configs.LinuxMemoryPolicy have ch…
Next.js 16.4
Next.js 16.4 introduces lazy compilation, smaller Turbopack output, React 19.3 features, Cache Components improvements, and new developer tooling.
Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-199)
Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of cross-cluster search requests made through the Remote Cluster Security (RCS) 2.0 model. An authorization check validates a request against one identifying attribute of the target shard, while a separate, indepe…
Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-198)
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds and serializes geometry values produced by scripted runtime fields. Unlike geometry supplied as text, which is subject to a nesting-depth limit, geometry constructed from a script's output is not bounded. An authenticated user wit…
Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-197)
Incorrect Authorization in Elasticsearch Leading to Privilege Escalation Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expan…
Elasticsearch 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-196)
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a specially crafted request containing deeply nested aggregation definitions. Processing this request triggers unbounded recursive execution that exhausts the server process's availab…
Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-195)
Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large description field are created and subsequently accessed, exhausting available heap memory and crashing the affected node. Affected Versions: 8.x: All versions from 8.12.0 up to and including…
Elastic Agent / Endpoint 8.19.22, 9.4.8, and 9.5.5 Security Update (ESA-2026-194)
Uncaught Exception in Elastic Endpoint Leading to Denial of Service Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend's real-time malware prevention and behavioral detection capabil…
Kibana 9.4.8, 9.5.5 Security Update (ESA-2026-193)
Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted to users with Fleet settings administrative access. Successful exploitation could allow an attacker to obtain private cryptographic key material configured for Fleet Server host connections, potentially enabling impersona…
Elasticsearch 9.4.7, 9.5.3, 8.19.23 Security Update (ESA-2026-192)
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used when multiple such resources are retrieved together. A user holding the manage_index_templates cluster privilege can register multiple resources each within the individual limit. Retrieving them toget…
Kibana 9.4.0 Security Update (ESA-2026-191)
Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the same feature did enforce. As a result, a user who held only data-store-level read access to an index, but no corresponding Kibana feature privilege, could retrieve index-derived metric data through Kibana that the properly-authorize…
Elasticsearch 9.4.8, 9.5.5 Security Update (ESA-2026-190)
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130). Affected Versions: 9.x: All versions from 9.2.0 up to and including 9.2.8 All versions from 9.3.0 up to and including 9.3.8 All versions from 9.4.0 up to and including 9.4.7 All versions from 9.5.0 up to and including 9.5.4 No fix is available for the 9.2.x or 9.3.x release lines. Users should upgrade to a supported rele…
Elasticsearch 8.19.22, 9.4.8, and 9.5.5 Security Update (ESA-2026-189)
Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers cat…