「うちの会社、大丈夫かな？」

Subject: [Security Alert] WordPress RCE Vulnerabilities (CVE-2026-60137, CVE-2026-63030)

Dear IT Administration Team,

This is a notification regarding critical vulnerabilities identified in WordPress Core.

■ Overview
Two vulnerabilities, CVE-2026-60137 (Blind SQL Injection) and CVE-2026-63030 (Route Confusion in REST API), can be chained to allow an unauthenticated remote attacker to perform Remote Code Execution (RCE) and extract sensitive data from the database. Public PoCs are now available, increasing the risk of exploitation.

■ Scope
- Product: WordPress Core
- Affected Versions: Versions prior to the security patches

■ Mitigation Steps
1. Update WordPress Core to the latest stable version immediately.
2. Verify that the update has been successfully applied across all instances.

■ Reference
- Official WordPress Security Advisory

Priority: High
Deadline: Immediate

Subject: [Security Advisory] OpenSSL 'HollowByte' Vulnerability Mitigation

Dear IT/Security Team,

We are sharing information regarding a memory exhaustion vulnerability in OpenSSL named 'HollowByte'.

■ Overview
Due to a flaw in how OpenSSL handles TLS handshake headers, an attacker can send a small (11-byte) request that forces the server to allocate up to 131 KB of memory. This can lead to a Denial-of-Service (DoS) condition. Notably, this fix was released silently without a CVE or official advisory.

■ Affected Scope
- All OpenSSL versions prior to 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21.

■ Mitigation Steps
1. Identify the OpenSSL version currently in use across your infrastructure.
2. Update to the following fixed versions:
- OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6, or 3.0.21.

■ Reference
- Okta Red Team Report

Priority: High
Deadline: Immediate

Subject: [Intel] North Korean Campaign Targeting Developers (REF9403)

Dear Team,

We are sharing intelligence regarding a new campaign by North Korean-linked actors targeting developers.

■ Overview
Attackers are using fake job recruitment and coding tests to distribute malware. The malicious payload is fragmented and hidden within SVG flag images using Base64 encoding. When a developer runs the project (e.g., via `npm run dev`), the code is reassembled and executed to steal browser credentials and cryptocurrency wallets.

■ Scope
- OS: Windows, macOS, Linux
- Target: Developers executing unverified code from external recruitment sources.

■ Recommended Actions
1. Alert development teams to avoid executing code provided by unknown recruiters on local machines.
2. Mandate the use of isolated sandbox environments or VMs when evaluating external projects.
3. Increase monitoring for unusual network traffic or credential theft indicators on developer workstations.

■ Reference
- Elastic Security Labs (REF9403)

Priority: Medium
Deadline: Immediate awareness

Subject: [Security Alert] Exploitation of SonicWall SMA Zero-Days

Dear IT/Security Team,

We are sharing information regarding a critical vulnerability in SonicWall SMA appliances.

■ Overview
The Inc Ransomware group is exploiting a chain of two zero-day vulnerabilities in SonicWall SMA appliances to gain root-level access to the devices.

■ Scope
- SonicWall SMA (Secure Mobile Access) appliances

■ Action Plan
1. Check the SonicWall management portal or official support site for the latest security patches.
2. Apply the latest firmware updates to all affected devices immediately.
3. Review system logs for any unauthorized administrative access or suspicious configuration changes.

■ Reference
- SonicWall Official Advisory

Priority: High
Deadline: Immediate