#SecurityWeek

キタきつね

@kitafox.bsky.social

16 hours ago

The New Rules of Engagement: Matching Agentic Attack Speed The cybersecurity response to AI-enabled nation-state threats cannot be incremental. It must be architectural.

新たな交戦ルール：エージェントの攻撃速度を合わせる

The New Rules of Engagement: Matching Agentic Attack Speed #SecurityWeek (Apr 7)

www.securityweek.com/the-new-rule...

キタきつね

@kitafox.bsky.social

17 hours ago

Anthropic Unveils ‘Claude Mythos’ – A Cybersecurity Breakthrough That Could Also Supercharge Attacks New AI model drives Project Glasswing, a effort to secure critical software before advanced capabilities fall into the wrong hands.

Anthropic社が「Claude Mythos」を発表 ― サイバーセキュリティにおける画期的な技術だが、攻撃を加速させる可能性もある

Anthropic Unveils ‘Claude Mythos’ – A Cybersecurity Breakthrough That Could Also Supercharge Attacks #SecurityWeek (Apr 7)

www.securityweek.com/anthropic-un...

キタきつね

@kitafox.bsky.social

1 day ago

Google DeepMind Researchers Map Web Attacks Against AI Agents A vulnerability named ‘AI Agent Traps’ allows attackers to manipulate, deceive, and exploit visiting agents via malicious web content.

Google DeepMindの研究者らがAIエージェントに対するウェブ攻撃をマッピング

Google DeepMind Researchers Map Web Attacks Against AI Agents #SecurityWeek (Apr 6)

www.securityweek.com/google-deepm...

Michael Wyres

@mwyr.es

1 day ago

Fortinet Rushes Emergency Fixes for Exploited Zero-Day The improper access control bug in FortiClient EMS allows unauthenticated attackers to execute arbitrary code remotely.

Fortinet Rushes Emergency Fixes For Exploited Zero-Day - https://mwyr.es/ONZjyOLf #securityweek #infosec

Michael Wyres

@mwyr.es

1 day ago

European Commission Confirms Data Breach Linked to Trivy Supply Chain Attack Hackers stole over 300GB of data from the Commission’s AWS environment, including personal information.

European Commission Confirms Data Breach Linked To Trivy Supply Chain Attack - https://mwyr.es/k6NJfSUx #securityweek #infosec

キタきつね

@kitafox.bsky.social

1 day ago

North Korean Hackers Target High-Profile Node.js Maintainers The threat actor behind the Axios supply chain attack has been aiming at other maintainers in its social engineering campaign.

北朝鮮のハッカーが著名なNode.jsメンテナーを標的に

North Korean Hackers Target High-Profile Node.js Maintainers #SecurityWeek (Apr 6)

www.securityweek.com/north-korean...

キタきつね

@kitafox.bsky.social

1 day ago

Fortinet Rushes Emergency Fixes for Exploited Zero-Day The improper access control bug in FortiClient EMS allows unauthenticated attackers to execute arbitrary code remotely.

Fortinet、悪用されたゼロデイ脆弱性に対する緊急修正プログラムを急遽リリース

Fortinet Rushes Emergency Fixes for Exploited Zero-Day #SecurityWeek (Apr 6)

www.securityweek.com/fortinet-rus...

キタきつね

@kitafox.bsky.social

2 days ago

Mobile Attack Surface Expands as Enterprises Lose Control Shadow AI embedded in everyday apps, combined with outdated mobile devices and zero-click exploits, is creating a new and largely unseen mobile risk.

企業が制御を失うにつれ、モバイル攻撃の対象範囲が拡大する

Mobile Attack Surface Expands as Enterprises Lose Control #SecurityWeek (Apr 3)

www.securityweek.com/mobile-attac...

キタきつね

@kitafox.bsky.social

2 days ago

North Korean Hackers Drain $285 Million From Drift in 10 Seconds The attackers prepared infrastructure and multiple nonce-based transactions, took over an admin key, and drained five vaults.

北朝鮮のハッカーがわずか10秒でDriftから2億8500万ドルを盗み出す

North Korean Hackers Drain $285 Million From Drift in 10 Seconds #SecurityWeek (Apr 3)

www.securityweek.com/north-korean...

キタきつね

@kitafox.bsky.social

2 days ago

React2Shell Exploited in Large-Scale Credential Harvesting Campaign Using automated scanning and the Nexus Listener collection framework, the hackers compromised over 750 systems.

React2Shellが大規模な認証情報窃盗キャンペーンで悪用される

React2Shell Exploited in Large-Scale Credential Harvesting Campaign #SecurityWeek (Apr 3)

www.securityweek.com/react2shell-...

キタきつね

@kitafox.bsky.social

2 days ago

Critical ShareFile Flaws Lead to Unauthenticated RCE The vulnerabilities can be chained together to bypass authentication and upload arbitrary files to the server.

ShareFileの重大な脆弱性により、認証なしでリモートコード実行が可能になる

Critical ShareFile Flaws Lead to Unauthenticated RCE #SecurityWeek (Apr 3)

www.securityweek.com/critical-sha...

キタきつね

@kitafox.bsky.social

5 days ago

Sophisticated CrystalX RAT Emerges The malware can spy on victims, steal their information, and make configuration changes on devices.

高度なCrystalX RATが出現

Sophisticated CrystalX RAT Emerges #SecurityWeek (Apr 2)

www.securityweek.com/sophisticate...

キタきつね

@kitafox.bsky.social

5 days ago

Mercor Hit by LiteLLM Supply Chain Attack The AI recruiting firm is investigating the incident as Lapsus$ claimed the theft of 4TB of Mercor data.

メルコール社がLiteLLMによるサプライチェーン攻撃を受ける

Mercor Hit by LiteLLM Supply Chain Attack #SecurityWeek (Apr 2)

www.securityweek.com/mercor-hit-b...

キタきつね

@kitafox.bsky.social

5 days ago

Critical Vulnerability in Claude Code Emerges Days After Source Leak Within days of each other, Anthropic first leaked the source code to Claude Code, and then a critical vulnerability was found by Adversa AI.

ソースコード流出から数日後、Claudeコードの重大な脆弱性が発覚

Critical Vulnerability in Claude Code Emerges Days After Source Leak #SecurityWeek (Apr 2)

www.securityweek.com/critical-vul...

Michael Wyres

@mwyr.es

5 days ago

Apple Rolls Out DarkSword Exploit Protection to More Devices The DarkSword exploit kit has been used by both state-sponsored hackers and commercial spyware vendors.

Apple Rolls Out DarkSword Exploit Protection To More Devices - https://mwyr.es/Zgpe7Q7H #securityweek #infosec

Michael Wyres

@mwyr.es

5 days ago

Cisco Patches Critical and High-Severity Vulnerabilities The bugs could lead to authentication bypass, remote code execution, information disclosure, and privilege escalation.

Cisco Patches Critical And High-Severity Vulnerabilities - https://mwyr.es/0lkIN1y7 #securityweek #infosec

キタきつね

@kitafox.bsky.social

5 days ago

Cisco Patches Critical and High-Severity Vulnerabilities The bugs could lead to authentication bypass, remote code execution, information disclosure, and privilege escalation.

Ciscoが重大度の高い脆弱性に対するパッチを適用

Cisco Patches Critical and High-Severity Vulnerabilities #SecurityWeek (Apr 2)

www.securityweek.com/cisco-patche...

キタきつね

@kitafox.bsky.social

6 days ago

Toy Giant Hasbro Hit by Cyberattack The company is investigating the full scope of the incident, including whether any files have been compromised.

玩具大手ハズブロがサイバー攻撃を受ける

Toy Giant Hasbro Hit by Cyberattack #SecurityWeek (Apr 1)

www.securityweek.com/toy-giant-ha...

キタきつね

@kitafox.bsky.social

6 days ago

FBI Warns of Data Security Risks From China-Made Mobile Apps The agency has not named the problematic foreign-made applications, but TikTok and Temu come to mind.

FBI、中国製モバイルアプリによるデータセキュリティリスクについて警告

FBI Warns of Data Security Risks From China-Made Mobile Apps #SecurityWeek (Apr 1)

www.securityweek.com/fbi-warns-of...

Michael Wyres

@mwyr.es

6 days ago

FBI Warns of Data Security Risks From China-Made Mobile Apps The agency has not named the problematic foreign-made applications, but TikTok and Temu come to mind.

FBI Warns Of Data Security Risks From China-Made Mobile Apps - https://mwyr.es/gyEbNq5U #securityweek #infosec

Michael Wyres

@mwyr.es

6 days ago

US Charges Uranium Crypto Exchange Hacker Jonathan Spalletta exploited smart contract vulnerabilities to steal approximately $55 million in cryptocurrency and cause Uranium to shut down.

US Charges Uranium Crypto Exchange Hacker - https://mwyr.es/LD4SxQpK #securityweek #infosec

キタきつね

@kitafox.bsky.social

1 week ago

Exploited Zero-Day Among 21 Vulnerabilities Patched in Chrome Google has announced fixes for CVE-2026-5281, a zero-day affecting Chrome’s Dawn component.

Chromeで修正された21件の脆弱性のうち、ゼロデイ攻撃が悪用されたものも含まれる

Exploited Zero-Day Among 21 Vulnerabilities Patched in Chrome #SecurityWeek (Apr 1)

www.securityweek.com/exploited-ze...

キタきつね

@kitafox.bsky.social

1 week ago

Stolen Logins Are Fueling Everything From Ransomware to Nation-State Cyberattacks Report shows how industrialized credential theft underpins ransomware, SaaS breaches, and geopolitical attacks, shifting security focus from prevention to detecting misuse of legitimate access.

盗まれたログイン情報が、ランサムウェアから国家主導のサイバー攻撃まで、あらゆる攻撃の温床となっている

Stolen Logins Are Fueling Everything From Ransomware to Nation-State Cyberattacks #SecurityWeek (Mar 31)

www.securityweek.com/stolen-login...

キタきつね

@kitafox.bsky.social

1 week ago

The Next Cybersecurity Crisis Isn’t Breaches—It’s Data You Can’t Trust Data integrity shouldn’t be seen only through the prism of a technical concern but also as a leadership issue.

次のサイバーセキュリティ危機は情報漏洩ではなく、信頼できないデータだ

The Next Cybersecurity Crisis Isn’t Breaches—It’s Data You Can’t Trust #SecurityWeek (Mar 31)

www.securityweek.com/the-next-cyb...

キタきつね

@kitafox.bsky.social

1 week ago

Silent Drift: How LLMs Are Quietly Breaking Organizational Access Control LLMs can write complex Rego and Cedar code in seconds, but a single missing condition or hallucinated attribute can quietly dismantle your organization’s least-privilege security model.

静かなる変化：LLMが組織のアクセス制御をいかに静かに破壊しているか

Silent Drift: How LLMs Are Quietly Breaking Organizational Access Control #SecurityWeek (Mar 30)

www.securityweek.com/silent-drift...

キタきつね

@kitafox.bsky.social

1 week ago

Healthcare IT Platform CareCloud Probing Potential Data Breach The company has disclosed a cybersecurity incident involving one of its electronic health record environments.

医療ITプラットフォームCareCloudがデータ漏洩の可能性を調査中

Healthcare IT Platform CareCloud Probing Potential Data Breach #SecurityWeek (Mar 30)

www.securityweek.com/healthcare-i...

キタきつね

@kitafox.bsky.social

1 week ago

Chinese Hackers Caught Deep Within Telecom Backbone Infrastructure The state-sponsored threat actor deployed kernel implants and passive backdoors enabling long-term, high-level espionage.

通信基幹インフラの奥深くで捕まった中国人ハッカー

Chinese Hackers Caught Deep Within Telecom Backbone Infrastructure #SecurityWeek (Mar 26)

www.securityweek.com/chinese-hack...

キタきつね

@kitafox.bsky.social

1 week ago

RSAC 2026 Conference Announcements Summary (Days 3-4) A summary of the announcements made by vendors on the third and fourth days of the RSAC 2026 Conference.

RSAC 2026カンファレンス発表概要（3～4日目）

RSAC 2026 Conference Announcements Summary (Days 3-4) #SecurityWeek (Mar 27)

www.securityweek.com/rsac-2026-co...

キタきつね

@kitafox.bsky.social

1 week ago

BIND Updates Patch High-Severity Vulnerabilities Specially crafted domains could be used to cause out-of-memory conditions, leading to memory leaks in the BIND resolvers.

BINDのアップデートにより、重大な脆弱性が修正されました

BIND Updates Patch High-Severity Vulnerabilities #SecurityWeek (Mar 26)

www.securityweek.com/bind-updates...

キタきつね

@kitafox.bsky.social

1 week ago

CISA Flags Critical PTC Vulnerability That Had German Police Mobilized Police in Germany physically warned organizations about the critical PTC Windchill vulnerability tracked as CVE-2026-4681.

CISAがPTCの重大な脆弱性を指摘、ドイツ警察が動員される事態に発展

CISA Flags Critical PTC Vulnerability That Had German Police Mobilized #SecurityWeek (Mar 27)

www.securityweek.com/cisa-flags-c...