2026年5月10日の
セキュリティ情報

Subject: [Technical Alert] Vulnerabilities in Palo Alto PAN-OS, Ivanti EPMM, and Linux Systems

Dear Security Team,

This is a technical update regarding several critical vulnerabilities and threats reported in the latest security intelligence.

■ Overview
- Nation-state actors have been exploiting a zero-day vulnerability in Palo Alto PAN-OS for several weeks.
- A flaw in Ivanti Endpoint Manager Mobile (EPMM) has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog.
- New Linux threats have emerged, including the 'Quasar Linux RAT (QLNX)' fileless implant and the 'Dirty Frag' privilege escalation vulnerability.

■ Scope
- Palo Alto PAN-OS devices
- Ivanti Endpoint Manager Mobile (EPMM)
- Linux-based server environments

■ Action Plan
1. Immediately apply the latest security patches for Palo Alto PAN-OS and Ivanti EPMM.
2. Audit Linux systems for signs of privilege escalation or unauthorized fileless implants.
3. Prioritize remediation based on the CISA KEV catalog guidelines.

■ Reference
- CISA KEV Catalog
- Official Vendor Advisories

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Ollama CVE-2026-7482 (Bleeding Llama) Mitigation

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in Ollama.

■ Overview
A heap out-of-bounds read vulnerability, codenamed 'Bleeding Llama' (CVE-2026-7482), has been identified in the GGUF model loader. This flaw allows a remote, unauthenticated attacker to leak process memory by sending a malicious GGUF file to the /api/create endpoint. The CVSS score is 9.1, indicating a critical risk of data exposure.

■ Scope
- Product: Ollama
- Affected Versions: Prior to 0.17.1

■ Mitigation Steps
1. Verify the current version of Ollama running in your environment.
2. Immediately update to version 0.17.1 or later.
3. Review network access controls to ensure the /api/create endpoint is not exposed to untrusted sources.

■ Reference
- CVE-2026-7482
- Cyera (Bleeding Llama)

Priority: High
Deadline: Immediate

Subject: [Security Advisory] cPanel & WHM Vulnerabilities (CVE-2026-29201, 29202, 29203)

Hi team,

This is a notification regarding critical vulnerabilities discovered in cPanel & WHM.

■ Overview
Three vulnerabilities have been patched that could allow arbitrary file access, remote code execution (RCE), and privilege escalation. Two of these flaws carry a high CVSS score of 8.8.

- CVE-2026-29201 (CVSS 4.3): Arbitrary file read via input validation issue.
- CVE-2026-29202 (CVSS 8.8): RCE via improper validation of the plugin parameter in create_user API.
- CVE-2026-29203 (CVSS 8.8): Privilege escalation/DoS via unsafe symlink handling.

■ Scope
- cPanel & WHM

■ Mitigation Steps
1. Check for the latest security updates via the cPanel & WHM administrative interface or CLI.
2. Apply the latest patches immediately to mitigate the risk of exploitation.

■ Reference
- Official cPanel Security Advisory

Priority: High
Deadline: Immediate

Subject: [Urgent] Critical Linux Kernel LPE Vulnerability "Dirty Frag"

Dear IT Security Team,

We are sharing information regarding a critical local privilege escalation (LPE) vulnerability chain discovered in the Linux kernel, dubbed "Dirty Frag."

■ Overview
Dirty Frag allows a local user to gain root privileges by exploiting the page cache management of sk_buff fragments in the xfrm-ESP and RxRPC modules. Unlike many LPEs, it does not rely on race conditions, resulting in a near 100% success rate.

■ Scope
- Nearly all major Linux distributions.
- Affected components: xfrm-ESP (esp4/esp6) and RxRPC modules.

■ Mitigation Steps
1. Monitor official vendor advisories for CVE assignments and security patches.
2. As a temporary workaround, consider disabling the affected kernel modules if they are not required for your operations.

■ Reference
- Vulnerability Name: Dirty Frag
- Researcher: Hyunwoo Kim (@v4bel)

Priority: High
Deadline: Immediate monitoring and patching upon release.

Subject: [Security Alert] Beware of Fake Claude AI Installation Ads

Hi everyone,

We have been alerted to a malicious campaign using Google Ads to trick Mac users into installing malware under the guise of a 'Claude' AI tool installation.

What you need to do:
1. Always download software directly from official websites. Avoid clicking on 'Sponsored' search results when looking for software downloads.
2. Never copy and paste unknown commands into your Terminal application based on instructions from a website or chat.

Deadline: Immediate

件名: 【共有】Google広告およびClaude.ai共有チャットを悪用したmacOSマルウェア配布について

お疲れさまです。標的型攻撃に関する情報共有です。

■ 概要
Google Adsの検索広告とClaude.aiの共有チャット機能を悪用したマルウェア配布キャンペーンが確認されました。攻撃者は「Claude Code on Mac」などの偽ガイドを用いて、ユーザーにターミナル経由で悪意のあるコマンドを実行させ、マルウェアをインストールさせます。

■ 影響範囲
- macOSを利用している全ユーザー

■ 対応手順
1. 従業員に対し、検索広告経由のソフトウェア導入およびターミナルへの不明なコマンド実行の危険性を周知してください。
2. EDR等のログを確認し、不審なcurl/wgetコマンドによる外部スクリプトの実行がないか監視を強化してください。

■ 参考情報
- BleepingComputer 記事

対応優先度: 高
対応期限: 2026/05/10

Subject: [Threat Intel] macOS Malware Distribution via Google Ads and Claude.ai Shared Chats

Hi team,

This is a notification regarding a current malvertising campaign targeting macOS users.

■ Overview
Attackers are leveraging Google Ads and weaponized Claude.ai shared chats to distribute malware. The attack chain involves tricking users into executing malicious shell commands via the Terminal, impersonating official Apple or Claude support.

■ Scope
- All macOS endpoints

■ Mitigation Steps
1. Issue a security advisory to employees warning against downloading software via sponsored search results and executing unknown Terminal commands.
2. Enhance monitoring for suspicious process executions (e.g., curl/wget piping to sh/bash) on macOS endpoints via EDR.

■ Reference
- BleepingComputer report

Priority: High
Deadline: 2026-05-10