2026年5月11日の
セキュリティ情報

Subject: [Security Alert] Critical Vulnerabilities in Next.js/React and Linux Kernel

Dear Team,

This is a technical briefing regarding several critical security updates and emerging threats.

■ Overview
1. Multiple high-severity vulnerabilities including SSRF, XSS, and DoS have been patched in Next.js (13.x-16.x) and React Server Components (19.x).
2. A local privilege escalation vulnerability named "Dirty Frag" is being exploited in the wild affecting major Linux distributions.
3. A new Linux backdoor, "PamDOORa," is targeting PAM modules to steal SSH credentials.

■ Scope
- Next.js 13.x-16.x / React Server Components 19.x
- Major Linux distributions (Dirty Frag)
- Linux systems utilizing the PAM framework (PamDOORa)

■ Mitigation Steps
1. Update Next.js and React to the latest patched versions immediately.
2. Review the use of xfrm-ESP and RxRPC kernel modules and disable them if not required to mitigate Dirty Frag.
3. Perform integrity checks on PAM modules to detect potential PamDOORa infections.

■ Reference
- Vercel Official Advisory
- Linux Distribution Security Bulletins

Priority: High
Deadline: Immediate

Subject: [Intel] Detection of AI-Generated Zero-Day Attacks and APT Activity

Dear Team,

We are sharing intelligence regarding the use of generative AI in creating zero-day exploits.

■ Overview
Google GTIG has identified the first case of a zero-day attack where the exploit code was generated by AI. Notably, the AI targeted a 'logical vulnerability' (specifically bypassing 2FA) rather than traditional memory corruption. Reports indicate that state-sponsored actors from China, North Korea, and Russia (including APT27, APT45, etc.) are actively integrating AI into their vulnerability research and malware development workflows.

■ Scope
- Organizations using open-source web management tools.
- Entities targeted by CN/KP/RU state-sponsored APTs.

■ Recommended Actions
1. Conduct security reviews focusing on authentication logic and flow (e.g., 2FA bypass scenarios).
2. Enhance detection capabilities to identify AI-generated code patterns in malicious samples.
3. Ensure all public-facing management interfaces are fully patched and hardened.

■ Reference
- Google Threat Intelligence Group (GTIG) Report

Priority: High
Deadline: Ongoing monitoring and review recommended

Subject: [Intel] Zero-day exploit for Web Admin Tool developed via AI

Dear Team,

We are sharing intelligence regarding a zero-day exploit targeting a popular open-source web administration tool, which was likely developed using AI.

■ Overview
Google Threat Intelligence Group (GTIG) discovered an exploit designed to bypass two-factor authentication (2FA). The analysis indicates high confidence that an LLM was used to weaponize the vulnerability, evidenced by textbook Pythonic formatting and hallucinated CVSS scores within the script's docstrings.

■ Scope
- Unnamed popular open-source web-based system administration tool.

■ Action Items
1. Review and apply the latest security patches for all deployed web administration tools.
2. Enhance monitoring of privileged account access logs for signs of 2FA bypass or unauthorized access.
3. Evaluate current defense-in-depth strategies considering the acceleration of vulnerability discovery via AI.

■ Reference
- Google Threat Intelligence Group (GTIG) Report

Priority: Medium
Deadline: Immediate review

Subject: [Security Alert] Ollama Heap Out-of-Bounds Read Vulnerability (CVE-2026-7482)

Dear IT/Security Team,

We are sharing information regarding a critical vulnerability in Ollama.

■ Overview
A heap out-of-bounds read vulnerability (CVE-2026-7482, CVSS 9.1), named 'Bleeding Llama', has been identified in the GGUF model loader. This allows an unauthenticated attacker to leak sensitive process memory, including API keys, environment variables, and user conversation data, by utilizing the /api/create and /api/push endpoints.

■ Scope
- Product: Ollama
- Affected Versions: Versions prior to 0.17.1

■ Mitigation Steps
1. Update Ollama to the latest patched version immediately.
2. Restrict network access to the Ollama server to trusted IPs only.
3. Audit logs for suspicious model creation requests or unauthorized data exfiltration via /api/push.

■ Reference
- CVE-2026-7482
- Cyera Security Research

Priority: High
Deadline: Immediate

Subject: [Security Alert] Critical Privilege Escalation Vulnerabilities in Microsoft Entra ID / Azure IAM

Dear IT Security Team,

We are sharing critical information regarding privilege escalation chain attacks targeting cloud IAM systems.

■ Overview
Critical vulnerabilities in token validation logic, such as those in Microsoft Entra ID (CVE-2025-55241) and Azure WAC (CVE-2026-20965), allow attackers to bypass MFA and Conditional Access policies to gain Global Administrator privileges. Some of these flaws have been assigned a CVSS score of 10.0.

■ Scope
- Microsoft Entra ID Tenants
- Azure WAC (Windows Admin Center) managed machines and tenants
- RustFS (specific permission configurations)

■ Action Plan
1. Audit sign-in logs for privileged accounts (e.g., Global Admins) to detect unauthorized access from unusual locations or devices.
2. Review and restrict the use of legacy APIs and re-evaluate Conditional Access policies.
3. Ensure all cloud infrastructure and management tools are updated to the latest secure versions provided by the vendor.

■ Reference
- CVE-2025-55241, CVE-2026-20965

Priority: High
Deadline: Immediate