Latest security news
Page 5
Thu, October 22
番組宣伝システムでメディア関係者情報が流出か - フジテレビ
フジテレビジョンは、番組宣伝システムが侵害され、個人情報が流出した可能性があることを明らかにした。
Splunk, SolarWinds Release Fresh Security Updates
Patched vulnerabilities could allow attackers to execute code, elevate privileges, and leak sensitive information. The post Splunk, SolarWinds Release Fresh Security Updates appeared first on SecurityWeek .
Cisco Patches 34 Vulnerabilities Across Multiple Products
Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks. The post Cisco Patches 34 Vulnerabilities Across Multiple Products appeared first on SecurityWeek .
PHP2Shell Exploitation Started Days Before Patches
Initial attempts were observed on October 17, and mass activity began shortly after patches were released. The post PHP2Shell Exploitation Started Days Before Patches appeared first on SecurityWeek .
PHP脆弱性“PoCフライング公開”の経緯、支援財団が公表 混乱広げた企業を名指しで批判
PHP脆弱性がこれほどまでに世間を騒がせたのは、その緊急性はもちろん、本来伏せておくべきだった情報の先出しが影響している。開発プロジェクトを支援するThe PHP Foundation（PHP財団）が経緯を公開した。
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The incident took place around 4:00 a.m.
カプコン、1177万件漏えい 不正アクセスで
カプコンは10月22日、不正アクセスにより会員サービス「CAPCOM ID」の情報が1177万4247件漏えいしたと発表した。
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system. Each supported line has one fixed version:
Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
Nearly 100 vulnerabilities have been assigned a critical severity rating and Fusion Middleware received the most patches. The post Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU appeared first on SecurityWeek .
侵入検知エンジン「Snort 3」に複数の脆弱性 - Cisco製品にも影響
Cisco Systemsは、オープンソースの侵入検知エンジン「Snort 3」に複数の脆弱性が判明したことを明らかにした。同社の複数製品にも影響があり、修正版を提供している。
Meta Ordered to Pay New Mexico $25 Billion for Deceiving Users About Privacy on Facebook
The $25 billion award far exceeds a $5 billion fine the Federal Trade Commission levied against Facebook in 2019. The post Meta Ordered to Pay New Mexico $25 Billion for Deceiving Users About Privacy on Facebook appeared first on SecurityWeek .
Ciscoのビデオ会議製品に深刻な脆弱性 - 修正版が公開
Cisco Systemsのビデオ会議関連製品「Cisco Expresswayシリーズ」に複数の脆弱性が判明した。リモートから認証なしに任意のコマンドを実行できる脆弱性も含まれる。
New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code. By sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force the server to use thousands of times more memory than it received, enough to run a default server
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches. "The exploit attempt originated from an IP address associated with a commercial anonymization network," CJ Moses,
PHP脆弱性、海外では“政府サイトごと停止”も オランダの電子認証やWikipedia関連サービスなどにも影響
プログラミング言語「PHP」の「緊急」レベルの脆弱性2件を巡り、海外では政府サイトを予防的に停止する動きが相次いだ。オランダは行政ポータルや認証基盤「DigiD」まで止め、フィンランドは政府の公開向けネットサービスを全て停止した。
「PHP」の深刻なRCE脆弱性「PHP2Shell」 - 悪用試行を観測
ウェブサイトをはじめ、広く活用されているプログラミング言語の「PHP」に、認証を必要とすることなくリモートからコードを実行できる深刻な脆弱性が見つかった問題で、すでに悪用を試みる攻撃も観測されている。実証コードも公開されており注意が必要だ。
コミックシーモア、流出は最大約420万件に メールアドレスや生年月日など 不正アクセスの経路特定・遮断は完了
電子書籍ストア「コミックシーモア」を運営するNTTソルマーレは10月21日、不正アクセスによる情報流出の影響範囲について発表した。最大約420万件の会員情報の流出を確認したとしている。
Anthropic、Claudeでソフトウェアのアタックサーフェスを洗い出し・縮小する研究を公開 OpenSSHの修正にも貢献
Anthropicは、AIモデル「Claude」でソフトウェアの攻撃対象領域を分析・縮小する研究結果を公開した。オープンソース25件を分析し、設定矛盾など493件の問題を特定。「OpenSSH」では、認証前に到達可能なコードを約5分の1削減し、最新版に対策が反映された。手法は脆弱性検出サービス「OSS Scanner」に組み込まれる。
NEC委託先への不正アクセスについてまとめてみた
2026年10月20日、NECは委託先がサイバー攻撃を受け、顧客のシステム障害と個人情報を含む情報の漏えいが生じたと公表しました。ここでは関連する情報をまとめます。 委託先の正規アカウント悪用 NECは10月20日、システム開発と保守業務を委託している企業(委託先)が9月下旬にサイバー攻撃を受け、窃取された正規アカウントの認証情報が悪用されたと公表した。これにより顧客において、不正アクセスによる被害と個人情報を含む情報の漏えいを確認したとしている(出典: 1)。NECが挙げた主な被害は2つ。1つは顧客のシステム環境への不正アクセスで、委託先の端末から正規アカウントを用いて行われ、サーバー内のフ…
不正取引も行われた岩井コスモ証券への不正アクセスについてまとめてみた
2026年10月16日、岩井コスモ証券は、インターネット取引のシステムの運用と保守を委託しているトレードワークスのシステムへの不正アクセスにより、顧客情報が漏えいを、また10月20日には売買管理システムへ攻撃により不正取引が行われたことも公表しました。ここでは関連する情報をまとめます。 委託先システムから顧客情報が漏えい 岩井コスモ証券株式会社は10月16日、委託先の株式会社トレードワークスのシステムが第三者による不正アクセスを受け、一部のインターネット取引の顧客情報が外部へ漏えいしたと公表した。対象は4,611名で、情報は氏名、メールアドレスなど。対象者には個別に報告したほか、二次被害は確認…
キャンペーン事務局のシステムに不正アクセス、個人情報が流出 - 国交省
国土交通省は、「住宅省エネ2024キャンペーン」に関する登録事業者の情報が外部に流出した可能性があることを明らかにした。
旅行ゲーム「ワールドクエスト」、PHP脆弱性で即日サービス終了 「古い仕組みのため対策とれず」
旅行ゲーム「ワールドクエスト」の運営は10月21日、同日をもってサービスを終了すると発表した。PHPの深刻な脆弱性に対し「古い仕組みのため十分な対策がとれない」とし、利用者の情報を守ることを理由に挙げた。
「スーパーの冷蔵設備が50度に」フランスの店舗襲ったサイバー攻撃の正体 弱点だらけだったセキュリティ対策
フランスのスーパーマーケットで大量の食品が廃棄される事態を招いた大規模なサイバー攻撃。狙われたのは、冷蔵・冷凍設備の遠隔管理システムだった。今回の事件は、同様のシステムのセキュリティ対策がほとんど置き去りにされてきた実態を見せつけている。
「PHP」脆弱性、2024年に兆候把握も修正難航 - 公開前に混乱
「PHP」で判明した深刻な脆弱性2件をめぐり、PHP Foundationは発見から修正に至る経緯を明らかにした。一部の問題は2024年に把握していたが、リソース不足から対応が長期化。関係者間で調整のうえ情報を公開する予定だったが、公開前に情報が漏洩するなど混乱も生じたという。
米当局、「PHP脆弱性」の即修正を勧告 - 困難ならオフラインに
米サイバーセキュリティインフラセキュリティ庁（CISA）は、プログラム言語「PHP」に深刻な脆弱性2件が見つかった問題で、修正プログラムをただちに適用するよう強く勧告した。更新が困難な場合は、インターネットへの公開を控えることを推奨している。
「GitLab」に深刻な脆弱性 - 旧ブランチにも修正を提供
ソフトウェア開発プラットフォーム「GitLab」に複数の脆弱性が判明した。深刻な脆弱性も含まれており、早急にアップデートするよう強く呼びかけている。
Security advisory: update your JDK (CVE-2026-91403)
On 2026-10-21, OpenJDK published a vulnerability advisory for CVE-2026-91403 (CVSS 9.1), which concerns eight compromised intermediate CA certificates shipped with the JDK. It affects all supported JDK lines: 8, 11, 17, 21, 25 and 27. This is not a Scala issue, but it affects every application running on the JVM, including Scala ones, as well as Scala build tools that use the JDK’s certificates to download dependencies. Am I affected? You are affected if you use JDK 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33, 8u512, or earlier . To check if your JDK is vulnerable, checkout eed3si9n/emudhra-ems…
virtualenv: Builtin creation follows linked environment directories
影響: pip:virtualenv < 21.14.9 → 21.14.9 The builtin creator accepts existing directory symlinks through ensure_dir() and writes environment files through those directories. This permits writes outside the requested destination. Anthropic's OSS Scanner reported this as ANT-2026-MUFJEG11 in virtualenv-20261015-005, received on 15 October 2026. Affected area Directory preparation before environment files are created. Attacker-controlled input Another account must be able to prepare linked entries below the chosen destination before crea…
virtualenv: Deletion recovery can change a symlink target's mode
影響: pip:virtualenv < 21.14.9 → 21.14.9 The deletion error handler obtains permission bits with lstat() but applies them through chmod(), which follows symlinks. On an eligible unlink failure this can change permissions outside the destination. Anthropic's OSS Scanner reported this as ANT-2026-UK90QC27 in virtualenv-20261015-005, received on 15 October 2026. Affected area Permission recovery after a filesystem deletion error. Attacker-controlled input A deletion must fail on a symbolic-link entry and enter the permission-recovery bra…
virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
影響: pip:virtualenv < 21.14.9 → 21.14.9 A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not preserve it as literal data in the shell wrapper. Affected area POSIX console scripts generated by the app-data seeder or pip when the interpreter path requires a shell wrapper. Windows executable launchers are not affected by this path. Attacker-controlled i…
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
影響: pip:Pillow <= 12.3.0 → 13.0.0 ============================================================================ Memory disclosure and segfault in libtiff encoder via crafted TIFF tags Location: src/encode.c:1014 in PyImaging_LibTiffEncoderNew() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A crafted TIFF file of a few hundred bytes makes Pillow copy an attacker-chosen amount of its own process memory into the TIFF it writes back out, or crash the pro…
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
影響: pip:Pillow >= 2.0.0, < 13.0.0 → 13.0.0 ============================================================================ Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO Location: src/libImaging/TiffDecode.c:94 in _tiffWriteProc() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Pillow can write attacker-chosen data past the end of a heap buffer when it saves a TIFF image to an in-memory destination such as io.BytesIO rather than to a file. The…
Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
影響: pip:pillow >= 11.3.0, < 13.0.0 → 13.0.0 Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at encode time. When TIFFWriteScanline fails, the encoder frees its output buffer but leaves the libtiff handle open. Later, when the encoder object is torn down, TIFFClose flushes buffered bytes through the write callback and writes into the freed buffer. An application that re-encodes attacker-influenced images to TIFF in memory can be crashed and is a candidate for remote code execution.…
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
影響: pip:Pillow >= 5.1.0, < 13.0.0 → 13.0.0 ============================================================================ Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle Location: src/PIL/PdfParser.py:505 in PdfParser.rewrite_pages() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A PDF file of a few hundred bytes makes Pillow hang forever, holding one processor core at 100%, when an application tries to append an image to it. Anyone who can s…
Pillow: APNG background disposal allocates full canvas before decompression bomb check
影響: pip:Pillow >= 8.1.0, < 13.0.0 → 13.0.0 ============================================================================ APNG background disposal allocates full canvas before decompression bomb check Location: src/PIL/PngImagePlugin.py:1000 in PngImageFile._seek() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A 126-byte animated PNG file makes Pillow's Image.open() allocate and fill memory sized by the image dimensions the file claims, before Pillow's built-i…
Pillow: MSP RLE decoder expands a tiny file into unbounded memory
影響: pip:pillow >= 4.1.0, < 13.0.0 → 13.0.0 The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels. Details The MSP decoder writes each run into an unbounded io.BytesIO and can expand roughly 85x per run: - src/PIL/MspImagePlugin.py:144-146 Impact Memory-exhaustion denial of service from a tiny crafted image in any application that loads pixels. T…
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
影響: pip:Pillow >= 5.1.0, < 13.0.0 → 13.0.0 ============================================================================ Quadratic-time DoS in PDF save_all (PdfParser.next_object_id) Location: src/PIL/PdfParser.py:629 in next_object_id() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Pillow's PDF writer takes time proportional to the square of the number of frames when it saves a multi-frame image as a multi-page PDF. Anyone who can get an application to conve…
Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()
影響: pip:Pillow >= 5.1.0, < 13.0.0 → 13.0.0 PdfParser's get_value() can recurse without any limit and crash with an uncaught RecursionError. It is reachable through Image.save(im, fp= , format="PDF", append=True) when the existing PDF file is attacker-controlled. This is the same class of bug as https://github.com/advisories/GHSA-r73j-pqj5-w3x7 (the /Prev trailer chain loop, fixed earlier this year), in the same file, but in two different functions that fix did not touch. Details get_value() in src/PIL/PdfParser.py This is a clas…
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
影響: pip:Pillow <= 12.3.0 → 13.0.0 ============================================================================ ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes Location: src/PIL/XbmImagePlugin.py:58 in XbmImageFile._open() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A crafted 512-byte file makes Pillow's Image.open() spend about six minutes of processor time on one core before it gives up with UnidentifiedImageError. Anyone w…
Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
影響: pip:Pillow >= 9.1.0, < 13.0.0 → 13.0.0 ============================================================================ Image.quantize() with empty palette leaks uninitialized stack memory Location: src/libImaging/Palette.c:216 in ImagingPaletteCacheUpdate() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ When an application lets a user supply the palette image for Pillow's Image.quantize(palette=...), the user can get back 512 bytes of the server process's st…
Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()
影響: pip:Pillow >= 5.4.0, < 13.0.0 → 13.0.0 ============================================================================ Quadratic GIF comment concatenation allows DoS in Image.open() Location: src/PIL/GifImagePlugin.py:266 in GifImageFile._seek() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Opening a crafted GIF file with Image.open() takes time that grows with the square of the file's size, so anyone who can submit an image to a service that uses Pillow ca…
Pillow: Infinite loop in MIC n_frames when the embedded TIFF
影響: pip:Pillow >= 7.2.0, < 13.0.0 → 13.0.0 ============================================================================ Infinite loop in MIC n_frames when the embedded TIFF has 3+ IFDs Location: src/PIL/MicImagePlugin.py:86 in MicImageFile.tell() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A crafted 5.6 KB image file makes Pillow loop forever at 100% CPU when an application asks how many frames the image has. This only affects installations that have the o…
Pillow: Quadratic GIF comment copying during save
影響: pip:pillow >= 9.2.0, < 13.0.0 → 13.0.0 On Pillow 12.3.0 and upstream main (ad277e2761b489681e71b51e91367d46b0ceabb9), a GIF with a long comment makes _get_global_header() copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional Moderate severity for crafted-image CPU denial of service, with CVSS-B 6.9 assuming a network service automatically opens unauthenticated uploads and they are resaved as GIFs; impact depends on input-size, concurrency, and worker CPU lim…
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
影響: pip:Pillow <= 12.3.0 → 13.0.0 ============================================================================ NULL dereference in ImagingExpand via rank filters on zero-size images Location: src/libImaging/Filter.c:79 in ImagingExpand() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Applying Pillow's median, minimum, maximum or rank filter to an image with zero width or zero height crashes the whole Python process instead of raising an error. Empty…
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
影響: pip:pillow >= 12.0.0, < 13.0.0 → 13.0.0 Image.merge() checks the mode of every input band except band 0. If band 0 is a single-band I or F image, the native merge routine reads a pixel pointer that is NULL for those modes and the process crashes. The IPTC plugin reaches this from a plain Image.open() followed by a load, and IPTC has no magic-byte prefilter, so a crafted file with no recognizable header can drive it. Details The validation loop skips band 0: - src/PIL/Image.py:3795 iterates for band in bands[1:] and checks mod…
Pillow: Invalid free in FreeType glyph rendering when a stroker is active
影響: pip:pillow >= 10.0.0, < 13.0.0 → 13.0.0 When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If FT_Load_Glyph fails for a glyph, the cleanup path calls FT_Done_Glyph on the glyph variable. That variable is not initialized before the first measurement loop, and in the render loop it is not reset to NULL after each glyph is freed. A malformed font loaded from untrusted bytes can force the load error and reach this free. This is a latent memory-safety defect; whether it cr…
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
影響: pip:Pillow <= 12.3.0 → 13.0.0 ============================================================================ Double free in ImagingScaleAffine on calloc failure via Image.transform Location: src/libImaging/Geometry.c:866 in ImagingScaleAffine() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ There is a double free in Pillow's Image.transform() that crashes the process when an oversized transform runs out of memory. Instead of only raising MemoryErro…