2026年10月30日の
セキュリティ情報

Subject: [Security Advisory] Linux Kernel CVE-2026-98432 Remote Root RCE

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in the Linux kernel.

■ Overview
CVE-2026-98432 is a Use-After-Free vulnerability caused by a race condition in IPv4 TCP connection handling. It allows a remote attacker to execute arbitrary commands with root privileges on systems with Multipath TCP (MPTCP) enabled. The vulnerability has a CVSS 3.0 score of up to 9.8, and a proof-of-concept bypassing KASLR has been demonstrated by Anthropic.

■ Affected Scope
- Linux Kernel 4.4 and later (where MPTCP listening services are active).
- Various distributions including Ubuntu, Debian, Red Hat, Amazon Linux, Oracle Linux, and SUSE (patch status varies).

■ Remediation Steps
1. Identify servers running Linux with MPTCP enabled.
2. Apply the latest kernel security updates provided by your OS vendor and reboot the systems.
3. Monitor vendor advisories closely, as some distributions (e.g., Ubuntu, Amazon Linux 2) are still in the process of releasing patches.

■ Reference
- Linux Kernel CVE Team / Anthropic Research

Priority: High
Deadline: Immediate

Subject: [Security Alert] Attack Campaign Leveraging AI Framework 'ARTEX'

Dear IT/Security Team,

We are sharing information regarding a campaign by the threat actor Storm-0940.

■ Overview
Storm-0940 is utilizing the open-source AI penetration testing framework 'ARTEX' to conduct large-scale attacks. By leveraging stolen ConnectWise credentials, the actor has been able to gain high-level cloud permissions in as little as three hours.

■ Scope
- Organizations utilizing ConnectWise products
- Cloud environments exposed to automated AI attack tools

■ Recommended Actions
1. Audit and rotate credentials for ConnectWise and other privileged management tools; ensure MFA is strictly enforced.
2. Monitor cloud audit logs for unauthorized privilege escalation or suspicious API calls originating from AI agents.
3. Review the security posture of third-party service providers to mitigate supply chain risks.

■ Reference
- Microsoft Threat Intelligence

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Exploitation of VMware CVE-2026-41709

Dear IT Administration Team,

We are sharing information regarding the active exploitation of CVE-2026-41709 in VMware products.

■ Overview
A vulnerability categorized as "Insufficient logging" (CVSS v3.1: 2.7) has been detected in VMware ESX and related platforms. This flaw allows an attacker with administrative privileges to execute specific operations without generating audit logs, effectively bypassing monitoring controls.

■ Affected Products
- VMware ESX
- VMware Cloud Foundation
- VMware vSphere Foundation
- VMware Telco Cloud Platform

■ Mitigation Steps
1. Verify the current version of your VMware environment.
2. Apply the security patches released in July 2026 to update to the latest version.

■ Reference
- Please refer to the official VMware security advisory.

Priority: Medium
Deadline: Immediate

Subject: [Intel] Massive Asset Theft at Binance and Importance of Privileged Endpoint Security

Dear Team,

We are sharing information regarding the record-breaking cryptocurrency theft at Binance.

■ Overview
Approximately $6.3 billion was stolen, likely by the North Korean APT group 'TraderTraitor'. The attack vector involved the compromise of a DevOps engineer's laptop, which granted the attacker access to a service container to execute unauthorized withdrawal transactions.

■ Scope
- Endpoints used by privileged users (DevOps, SRE, Admins)
- Service containers and APIs with insufficient isolation/access control

■ Recommended Actions
1. Enhance EDR/XDR monitoring and ensure all security patches are applied to privileged administrative endpoints.
2. Review and tighten IAM policies for service containers, adhering to the principle of least privilege.
3. Implement regular rotation of secrets and API keys to mitigate the impact of potential credential leaks.

■ Reference
- SecurityWeek Article

Priority: High
Deadline: Immediate review