2026年9月2日の
セキュリティ情報

Subject: [Info] Traffic Hijacking via Malicious Apache Modules

Dear team,

We are sharing information regarding a campaign by the threat actor 'Gambling Goblin'.

■ Overview
Attackers are installing malicious Apache modules on compromised servers to act as reverse proxies. This allows them to divert traffic to gambling-related phishing pages while the URL remains that of the legitimate domain. They also strip security headers to ensure the injected content runs without interference.

■ Scope
- Web servers running Apache HTTP Server
- Organizations managing high-reputation domains

■ Action Plan
1. Audit installed Apache modules for any unauthorized or suspicious binaries.
2. Review web server access logs and configuration files for unauthorized changes or redirection rules.
3. Perform a privilege audit on the server to identify potential compromise vectors.

■ Reference
- Check Point Research / ANY.RUN reports

Priority: Medium
Deadline: Immediate review

Subject: [Security Advisory] Rockwell Automation Vulnerabilities (CVE-2026-9637 et al.)

Dear Team,

This is a technical notification regarding multiple vulnerabilities discovered in Rockwell Automation industrial automation products.

■ Overview
Several vulnerabilities, primarily causing Denial-of-Service (DoS), have been identified. These flaws could lead to service crashes in critical communication software and controllers, impacting operational availability.

■ Affected Scope
- RSLinx Classic
- ControlLogix and CompactLogix controllers (CVE-2026-9637)
- 1756-ENBT
- FactoryTalk Historian Machine Edition

■ Mitigation Steps
1. Audit the current versions of Rockwell Automation products in the environment.
2. Apply the latest security patches provided by the vendor.
3. If patching is not immediately feasible, implement the recommended workarounds from the official advisory.

■ Reference
- Rockwell Automation Security Advisories
- CISA Advisory

Priority: High
Deadline: Immediate

Subject: [Urgent] SonicWall SMA 1000 Series Vulnerability (CVE-2026-83548/83549) Mitigation

Dear IT/Security Team,

This is an alert regarding critical vulnerabilities in SonicWall SMA 1000 Series products.

■ Overview
Active exploitation of CVE-2026-83548 and CVE-2026-83549 has been detected. CVE-2026-83548 is a Server-Side Request Forgery (SSRF) vulnerability with a CVSS score of 10.0, which could allow unauthenticated remote attackers to execute unauthorized operations.

■ Scope
- Affected Product: SonicWall Secure Mobile Access (SMA) 1000 Series

■ Action Required
1. Verify if the SMA 1000 Series is deployed in your environment.
2. Immediately apply the latest security patches provided by the vendor to update the firmware.

■ Reference
- SonicWall Official Advisory

Priority: High
Deadline: Immediate