2026年6月1日の
セキュリティ情報

Subject: [Security Advisory] Privilege Escalation Vulnerability in Linux CIFS Client (CIFSwitch)

Dear IT/Security Team,

We are sharing information regarding a logic vulnerability discovered in the Linux kernel's CIFS client, known as 'CIFSwitch'.

■ Overview
A flaw in the interaction between the Linux CIFS kernel client and the cifs-utils helper tool allows an unprivileged user to forge a cifs.spnego key request. This can be leveraged to manipulate the root-privileged cifs.upcall process and potentially achieve root access.

■ Affected Scope
- Linux Mint
- CentOS Stream 9
- Rocky Linux 9
- AlmaLinux 9
- Kali Linux
- SLES 15

■ Mitigation Steps
1. Identify if any systems in the environment are running the affected distributions.
2. Apply the latest security patches for the Linux kernel and cifs-utils package.

■ Reference
- Please refer to the official security advisories from your respective Linux distribution vendors.

Priority: High
Deadline: Immediate

Subject: [Intel] Evolution of Kazuar Backdoor by Secret Blizzard (Russian APT)

Dear Security Team,

We are sharing intelligence regarding the evolution of the Kazuar backdoor used by the Russian state-sponsored actor Secret Blizzard.

■ Overview
Secret Blizzard has transitioned Kazuar from a monolithic framework to a modular botnet architecture. It employs a three-tier module system (Kernel, Bridge, Worker) and utilizes P2P communication (Named pipes, Mailslot) internally, while communicating with C2 servers via EWS, HTTP, and WSS to minimize the traffic footprint.

■ Scope
- Windows-based environments, particularly within government and strategic sectors.

■ Recommended Actions
1. Enhance monitoring for anomalous outbound traffic via WebSockets (WSS) and Exchange Web Services (EWS).
2. Monitor for suspicious inter-process communication using Named pipes and Mailslots on endpoints.
3. Review EDR detection rules for P2P-like behavior originating from unauthorized binaries.

■ Reference
- Microsoft Threat Intelligence Report

Priority: Medium
Deadline: Ongoing Monitoring

Subject: [Security Advisory] Critical RCE Vulnerability in Flowise MCP (CVE-2026-40933)

Dear IT/Security Team,

We are sharing information regarding a critical vulnerability in Flowise.

■ Overview
A critical remote code execution (RCE) vulnerability (CVE-2026-40933) has been identified in the MCP (Model Context Protocol) stdio server implementation of Flowise. With a CVSS score of 9.9, this flaw allows an attacker to execute arbitrary commands on the host system by importing a maliciously crafted chat flow file.

■ Scope
- Product: Flowise (Self-hosted deployments)
- Affected Component: MCP stdio server
*Note: Flowise Cloud is not affected as stdio MCP is disabled by default.

■ Mitigation Steps
1. It is strongly recommended to completely disable the MCP stdio functionality by setting the environment variable `CUSTOM_MCP_PROTOCOL=sse`.
2. Be aware that existing official patches relying on input validation may be bypassed; therefore, disabling the feature is the most secure option.
3. Strictly prohibit the import of chat flow files from untrusted sources.

■ Reference
- CVE-2026-40933

Priority: High
Deadline: Immediate

Subject: [Security Alert] Malware Distribution via Fake AI Tool Websites

Dear employees,

It has been reported that fake websites impersonating AI development tools (such as Gemini and Claude) are being used to distribute malware that steals sensitive information.

Requested Actions:
1. Always verify that you are downloading software from official sources. Do not trust search results blindly.
2. Never copy and execute commands (e.g., PowerShell) provided by unfamiliar websites.

Deadline: Immediate

件名: 【共有】AI開発ツールを装ったファイルレス・インフォスティーラーへの対応について

お疲れさまです。AI開発ツール（Gemini CLI / Claude Code）を装った偽サイトによる攻撃に関する情報共有です。

■ 概要
SEOポイズニングで誘導された偽サイトからPowerShellコマンドを実行させ、メモリ上で動作するファイルレス・インフォスティーラーを感染させる攻撃です。AMSIおよびETWを無効化し、Cookieや認証情報を窃取します。

■ 影響範囲
- Windows環境でAI開発ツールを導入しようとする開発者

■ 対応手順
1. 以下のドメインをブロックリストに追加検討: geminicli[.]co[.]com, claudecode[.]co[.]com
2. 開発端末においてPowerShellの受限語言モード（Constrained Language Mode）の適用を検討してください。
3. FIDO2準拠のセキュリティキー導入による認証強化を推進してください。

■ 参考情報
- EclecticIQ Report

対応優先度: 高
対応期限: 速やかに

Subject: [Technical Alert] Fileless Infostealer Impersonating AI Dev Tools

Dear Security Team,

We are sharing information regarding a campaign targeting developers via fake Gemini CLI and Claude Code installation sites.

■ Overview
Attackers use SEO poisoning to lure users to fake sites, where they are prompted to run PowerShell commands. This deploys a fileless infostealer that disables AMSI and ETW to steal browser cookies, credentials, and encryption keys.

■ Scope
- Developers using Windows environments attempting to install AI CLI tools.

■ Mitigation Steps
1. Consider blocking the following domains: geminicli[.]co[.]com, claudecode[.]co[.]com
2. Enforce PowerShell Constrained Language Mode (CLM) on developer workstations.
3. Implement FIDO-based security keys to mitigate credential theft risks.

■ Reference
- EclecticIQ Report

Priority: High
Deadline: Immediate

Subject: [Action Required] Please Update Your Microsoft Software

Hi everyone,
Microsoft has released security updates for several of its products (including Office 365 and Windows-related tools) to fix identified vulnerabilities.

What we need you to do:
1. If you see a software update notification on your computer, please install it immediately.
2. If a system restart is required, please restart your device at your earliest convenience.

Deadline: By the end of this week

件名: 【共有】Microsoft 2026年5月度セキュリティ更新プログラム (AV26-456) 対応について

お疲れさまです。Microsoftの月次セキュリティ更新に関する情報共有です。

■ 概要
.NET Framework、.NET 8.0/9.0/10.0、Azure AI Foundry、M365 Copilot等、広範な製品群における脆弱性修正が行われました。

■ 影響範囲
- .NET Framework 3.5, 4.6.2, 4.7, 4.8 等
- .NET 8.0, 9.0, 10.0 (Windows, Linux, macOS)
- Azure AI Foundry, Azure Cloud Shell, Azure DevOps 等
- Microsoft 365 Copilot (Desktop, Android, Business Chat)

■ 対応手順
1. 管理下にあるサーバーおよびクライアントの更新状況を確認する
2. 適用可能な最新のセキュリティパッチを適用し、必要に応じて再起動を実施する
3. Azureサービスのマネージド更新状況を確認する

■ 参考情報
- Microsoft Security Advisory AV26-456

対応優先度: 高
対応期限: 2026年6月15日まで

Subject: [Technical Info] Microsoft May 2026 Security Updates (AV26-456)

Hi team,
This is a notification regarding the Microsoft monthly security rollup.

■ Overview
Security updates have been released to address vulnerabilities across a broad spectrum of products, including .NET Framework, .NET 8.0/9.0/10.0, Azure AI Foundry, and M365 Copilot.

■ Scope
- .NET Framework 3.5, 4.6.2, 4.7, 4.8 etc.
- .NET 8.0, 9.0, 10.0 (Windows, Linux, macOS)
- Azure AI Foundry, Azure Cloud Shell, Azure DevOps, etc.
- Microsoft 365 Copilot (Desktop, Android, Business Chat)

■ Action Plan
1. Audit the update status of managed servers and clients.
2. Apply the latest security patches and perform reboots where necessary.
3. Verify the update status of Azure managed services.

■ Reference
- Microsoft Security Advisory AV26-456

Priority: High
Deadline: June 15, 2026