2026年5月16日の
セキュリティ情報

Subject: [Security Alert] TanStack Supply Chain Attack (Mini Shai-Hulud)

Dear IT/Security Team,

We are sharing information regarding a supply chain attack targeting the TanStack ecosystem.

■ Overview
The threat actor TeamPCP has been distributing the 'Mini Shai-Hulud' worm by hijacking GitHub Actions OIDC tokens to compromise legitimate npm packages. This attack has already impacted OpenAI, leading to the compromise of employee devices and the exposure of internal repository credentials. The malware specifically targets CI/CD secrets and establishes persistence in developer tools.

■ Scope
- Projects utilizing TanStack-related npm packages
- Release pipelines utilizing GitHub Actions OIDC tokens

■ Mitigation Steps
1. Audit npm dependencies for any suspicious versions or unexpected updates.
2. Review and restrict permissions for GitHub Actions OIDC tokens following the principle of least privilege.
3. Inspect CI/CD environments and developer workstations for credential leakage and rotate secrets where necessary.

■ Reference
- secaffairs report

Priority: High
Deadline: Immediate

Subject: [Action Required] Please Update Your OS and Software

Hi everyone,

We have observed an increase in cyber attacks targeting outdated software. To keep our data secure, please ensure your devices are up to date.

What we need you to do:
1. Install any pending OS updates for macOS or Windows.
2. Update your web browsers (Chrome, Firefox, etc.) to the latest version.

Deadline: By the end of this week

件名: 【共有】Cisco SD-WAN および TanStack サプライチェーン攻撃への対応について

お疲れさまです。今週の主要な脅威情報に関する共有です。

■ 概要
CISAがCisco SD-WANに関する緊急の対応を求めており、またTanStackを標的としたサプライチェーン攻撃が報告されています。あわせてTHORChainでの大規模な資産流出や、複数の企業へのランサムウェア攻撃が確認されています。

■ 影響範囲
- Cisco SD-WAN 利用環境
- TanStack ライブラリを利用している開発プロジェクト

■ 対応手順
1. Cisco SD-WAN の脆弱性に関する最新のアドバイザリを確認し、パッチを適用してください。
2. 開発チームに対し、TanStack 関連パッケージの整合性確認と最新版への更新を指示してください。
3. 組織内のエンドポイントにおける不審な通信がないか監視を強化してください。

■ 参考情報
- CISA 公式アドバイザリ
- ZATAZ 週報

対応優先度: 高
対応期限: 速やかに

Subject: [Security Alert] Cisco SD-WAN and TanStack Supply Chain Attack

Dear IT/Security Team,

This is a summary of critical threats reported this week.

■ Overview
CISA has issued an urgent warning regarding Cisco SD-WAN vulnerabilities. Additionally, a supply chain attack targeting TanStack has been identified, alongside significant ransomware activity affecting various sectors.

■ Scope
- Environments utilizing Cisco SD-WAN
- Development projects using TanStack libraries

■ Action Plan
1. Review CISA advisories for Cisco SD-WAN and apply necessary patches immediately.
2. Instruct development teams to verify the integrity of TanStack packages and update to the latest secure versions.
3. Enhance monitoring for anomalous network traffic across endpoints.

■ Reference
- CISA Official Advisory
- ZATAZ Weekly Report

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Microsoft Exchange Server CVE-2026-42897

Dear IT Administration Team,

This is a notification regarding a critical vulnerability in Microsoft Exchange Server.

■ Overview
A cross-site scripting (XSS) vulnerability (CVE-2026-42897) has been identified in Microsoft Exchange Server with a CVSS score of 8.1. This flaw allows unauthorized attackers to perform spoofing over a network. CISA has added this to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.

■ Scope
- Microsoft Exchange Server

■ Mitigation Steps
1. Verify the current version of your Exchange Server installations.
2. Apply the latest security updates provided by Microsoft immediately.

■ Reference
- CISA KEV Catalog
- Microsoft Security Advisory

Priority: High
Deadline: Immediate

Subject: [Security Alert] Update Your Devices and Avoid Unauthorized AI Services

Dear Employees,

Recent security vulnerabilities have been identified in Android devices and Microsoft Teams. Additionally, there are increasing risks associated with using unauthorized AI relay services.

Please take the following actions:
1. Update your Android devices, PC OS, and applications to the latest versions.
2. Ensure that 'Wireless Debugging' is disabled in your Android device settings.
3. Do not use any unofficial AI relay or proxy services not approved by the company.

Deadline: By the end of this week

件名: 【共有】Linux/Android/Teams 等の脆弱性およびAIによる0Day攻撃について

お疲れさまです。複数の重要脆弱性および脅威情報に関する共有です。

■ 概要
- Linuxカーネル: Fragnesia (CVE-2026-46300) 高危漏洞。Dirty Fragに類似した影響。
- Android: CVE-2026-0073 ゼロクリック脆弱性。adbdの暗号化ロジック不備によりリモートShell取得が可能。
- MS Teams: CVE-2026-32185 なりすまし攻撃が可能。
- その他: Google GTIGにより、AIを用いて0Dayを武器化した攻撃者が確認された。

■ 影響範囲
- Linuxシステム全体
- Android 14-16 デバイス
- Microsoft Teams 利用環境

■ 対応手順
1. Linuxカーネルの最新パッチ適用および再起動。
2. Android端末のパッチ適用および無線デバッグ機能の強制無効化検討。
3. Microsoft Teamsの最新アップデート適用確認。

■ 参考情報
- FreeBuf Weekly Report / Google GTIG Report

対応優先度: 高
対応期限: 速やかに

Subject: [Technical Alert] Vulnerabilities in Linux, Android, Teams and AI-driven 0Day Threats

Dear Security Team,

This is a summary of critical vulnerabilities and threat intelligence reported this week.

■ Overview
- Linux Kernel: Fragnesia (CVE-2026-46300), a high-severity vulnerability similar to Dirty Frag.
- Android: CVE-2026-0073, a zero-click vulnerability in the adbd daemon allowing remote shell access.
- MS Teams: CVE-2026-32185, allowing spoofing attacks.
- Threat Intel: Google GTIG confirmed the first instance of AI being used to independently discover and weaponize a 0-day vulnerability.

■ Scope
- Linux systems
- Android 14-16 devices
- Microsoft Teams environments

■ Mitigation Steps
1. Apply the latest Linux kernel patches and reboot systems.
2. Deploy Android security updates and disable wireless debugging across the fleet.
3. Ensure Microsoft Teams is updated to the latest version.

■ Reference
- FreeBuf Weekly Report / Google GTIG Report

Priority: High
Deadline: Immediate

Subject: [Security Alert] NGINX Heap Buffer Overflow (CVE-2026-42945) Mitigation

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in NGINX.

■ Overview
A heap buffer overflow vulnerability, identified as CVE-2026-42945 (NGINX Rift), has been disclosed in the ngx_http_rewrite_module. With a CVSS v4 score of 9.2, this flaw allows unauthenticated remote attackers to trigger a Denial of Service (DoS) or potentially achieve Remote Code Execution (RCE).

■ Affected Versions
- NGINX Open Source: 0.6.27 to 1.30.0
- NGINX Plus: R32 to R36

■ Mitigation Steps
1. Verify the current version of NGINX deployed in your environment.
2. Update to the following patched versions immediately:
- Open Source: 1.30.1 / 1.31.0 or later
- Plus: Update to the latest patched release

■ Reference
- Official F5/NGINX Security Advisory

Priority: High
Deadline: Immediate