2026年5月12日の
セキュリティ情報

Subject: [Security Alert] cPanel/WHM Vulnerabilities and New Linux Malware Threats

Dear IT Administration Team,

This is a technical briefing regarding several critical security threats.

■ Overview
1. High-risk vulnerabilities (CVE-2026-29201/2/3) affecting cPanel/WHM allow for privilege escalation and remote code execution.
2. New Linux-targeted malware, including the fileless Quasar Linux RAT (QLNX) and the PamDOORa backdoor (hijacking PAM framework), have been detected.
3. A supply chain attack on JDownloader's official site distributed a Python-based RAT.

■ Scope
- cPanel/WHM installations
- Linux server environments (especially developer environments)
- Ivanti Mobile Device Management users

■ Mitigation Steps
1. Immediately update cPanel/WHM and Ivanti products to the latest patched versions.
2. For Linux systems, ensure SELinux is enabled, disable SSH root login, and monitor system file changes in the PAM framework.
3. Rotate API keys for services like Braintrust if exposure is suspected.

■ Reference
- Vendor official advisories and FreeBuf reports.

Priority: High
Deadline: Immediate

Subject: [Info] Proposal for Linux Kernel "Emergency Disable Switch" and Vulnerability Mitigation

Hi all,

We are sharing information regarding a new proposal for Linux kernel vulnerability mitigation.

■ Overview
A Linux kernel maintainer has proposed an "emergency disable switch" to allow privileged users to temporarily disable specific flawed functions during the 0Day vulnerability window before patches are fully deployed.

■ Scope
- All systems running the Linux kernel.
- Specifically relevant to environments exposed to vulnerabilities like Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284, CVE-2026-43500).

■ Recommended Actions
1. Verify current kernel versions and ensure all critical security patches are applied.
2. Since the proposed feature is not yet implemented, prioritize official patch management.
3. Review and implement existing hardening measures, such as disabling unnecessary kernel modules.

■ Reference
- Linux Kernel Mailing List (LKML) and related security advisories.

Priority: Medium
Deadline: Ongoing

Subject: [Info] File Access Blocking Technique via Windows API (GhostLock)

Dear Team,

We are sharing information regarding a new technique to block file access using the Windows API.

■ Overview
A PoC tool named "GhostLock" has been released. It abuses the 'CreateFileW' API by setting the 'dwShareMode' parameter to 0, granting exclusive access to a file and preventing any other users or applications from opening it. This affects both local files and SMB network shares.

■ Scope
- All environments running Windows OS
- Environments utilizing SMB network shares

■ Recommended Actions
1. Enhance monitoring via EDR/SIEM for suspicious processes maintaining exclusive file handles.
2. Review and enforce the principle of least privilege for network share permissions.

■ Reference
- BleepingComputer Article

Priority: Medium
Deadline: Ongoing

Subject: [Info] Data Breach Incident involving Canvas (Instructure)

Dear Team,

This is a technical update regarding the data breach of the Canvas learning platform.

■ Overview
The threat actor group 'ShinyHunters' exfiltrated a massive amount of data from Canvas and demanded a ransom. Instructure has reported reaching an agreement for the return and deletion of the data, receiving 'shred logs' as confirmation. However, the company admitted that absolute verification of data destruction is not possible.

■ Scope
- Educational institutions and users (students/faculty) utilizing the Canvas platform.

■ Recommended Actions
1. Verify if your organization utilizes Canvas and consider advising users to update their passwords.
2. Review MFA (Multi-Factor Authentication) adoption among users to mitigate credential-based risks.
3. Monitor official vendor communications for further updates or specific impact notifications.

■ Reference
- SecurityWeek Article

Priority: Medium
Deadline: Immediate review