2026年6月13日の
セキュリティ情報

Subject: [Urgent] Splunk Enterprise CVE-2026-20253 Remediation

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in Splunk Enterprise.

■ Overview
An authentication bypass vulnerability in the PostgreSQL Sidecar Service allows unauthenticated attackers to achieve Remote Code Execution (RCE). With a CVSS score of 9.8, the exploit chain involves directory traversal and arbitrary file writes to compromise the system.

■ Scope
- Splunk Enterprise 10 and subsequent versions.
- High risk for AWS cloud deployments where the service is enabled by default.

■ Action Plan
1. Immediately update Splunk Enterprise to the latest patched version.
2. Review logs for unauthorized access to internal API endpoints (e.g., /v1/postgres/recovery/backup).
3. Restrict exposure of unnecessary internal services.

■ Reference
- Splunk Official Security Advisory

Priority: High
Deadline: Immediate

Subject: [Intel] Long-term Espionage Campaign by Velvet Ant (Operation Highland)

Dear Team,

We are sharing intelligence regarding 'Operation Highland,' a long-term espionage campaign conducted by the Chinese threat actor Velvet Ant.

■ Overview
Velvet Ant has demonstrated the ability to hijack authentication stacks to maintain persistence for up to 10 years, even within air-gapped networks. The attackers typically breach internet-facing systems before pivoting to isolated environments to monitor administrative activity.

■ Affected Scope
- F5 BIG-IP devices
- Cisco NX-OS (Nexus switches)
- Organizations utilizing centralized authentication stacks

■ Recommended Actions
1. Audit authentication servers and flows for unauthorized configuration changes or rogue administrative accounts.
2. Ensure all F5 BIG-IP and Cisco Nexus switches are updated to the latest patched versions to mitigate known exploits used by this actor.
3. Review logs for any anomalous traffic or lateral movement targeting isolated/air-gapped network segments.

■ Reference
- Sygnia Research

Priority: High
Deadline: Immediate review

Subject: [Security Alert] Data Theft via Oracle ERP Zero-Day Vulnerability

Dear IT/Security Team,

We are sharing information regarding a campaign by the threat actor "ShinyHunters" targeting Oracle ERP software.

■ Overview
ShinyHunters has been exploiting a zero-day vulnerability in Oracle's ERP software to steal large volumes of data, primarily targeting higher education institutions in the US. The attackers leverage this flaw to gain unauthorized access and exfiltrate sensitive information.

■ Scope
- Environments running Oracle ERP software

■ Action Plan
1. Review and apply the latest security patches from Oracle's official advisory.
2. Audit ERP system access logs for unauthorized access from suspicious IPs or anomalous data exfiltration patterns.
3. Enforce Multi-Factor Authentication (MFA) and rotate credentials for privileged accounts.

■ Reference
- Oracle Security Alerts / Vendor Advisory

Priority: High
Deadline: Immediate

Subject: [Security Alert] Arch Linux AUR Package Compromise (Atomic Arch)

Dear IT/Security Team,

We are sharing information regarding a large-scale supply chain attack affecting the Arch User Repository (AUR).

■ Overview
An operation named "Atomic Arch" has compromised over 400 AUR packages. Attackers targeted orphaned projects and modified build scripts to deploy a Rust-based information stealer and an eBPF rootkit. The malware targets developer credentials, including browser cookies, SSH keys, and cloud tokens.

■ Scope
- Arch Linux AUR packages
- Systems that installed or updated AUR packages on or after June 11.

■ Action Plan
1. Cross-reference installed AUR packages with the known affected list.
2. Inspect /etc/systemd/system/ and ~/.config/systemd/user/ for unauthorized service units.
3. Check for suspicious eBPF maps used for process hiding if root access is suspected.
4. Rotate all potentially compromised secrets (SSH keys, API tokens for GitHub, npm, Vault, etc.).

■ Reference
- Reports by Sonatype and researcher Whanos

Priority: High
Deadline: Immediate

Subject: [Security Alert] Beware of AI-Powered Phishing Attacks

Dear employees,
We are seeing an increase in highly sophisticated phishing attacks that use AI to mimic trusted sources and trick users into revealing sensitive information.

What we need from you:
1. Do not click links or provide credentials in emails that seem suspicious or request sensitive information, even if they look authentic.
2. Report any suspicious emails to the IT security team immediately.

Deadline: Ongoing vigilance required