2026年11月7日の
セキュリティ情報

Subject: [Security Alert] Secret Exposure via Claude Code Settings File

Hi team,

We are sharing critical information regarding a secret exposure risk associated with Anthropic's Claude Code.

■ Overview
It has been discovered that when users select "Yes, and don't ask again" for shell commands in Claude Code, the tool saves the exact command—including any embedded passwords or API keys—into the `.claude/settings.local.json` file. Many of these files have been leaked to public GitHub repositories.

■ Scope
- Development environments using Claude Code.
- Projects where `.claude/settings.local.json` was committed to public version control.

■ Action Plan
1. Audit public repositories for the presence of `.claude/settings.local.json`.
2. If secrets are found, immediately rotate all affected API keys, tokens, and passwords. Note that deleting the file is insufficient as secrets remain in Git history.
3. Ensure `.claude/settings.local.json` is added to `.gitignore` across all projects to prevent future leaks.

■ Reference
- Apiiro Security Research

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Printcart Store Plugin (CVE-2026-19803) Remediation

Dear IT/Security Team,

We are sharing information regarding CVE-2026-19803.

■ Overview
A critical arbitrary file upload vulnerability has been identified in the "Printcart Store – Web to Print Product Designer for WooCommerce" WordPress plugin. This flaw allows unauthenticated attackers to upload malicious PHP files, leading to Remote Code Execution (RCE). The CVSS score is 9.8 (CRITICAL).

■ Scope
- Product: Printcart Store – Web to Print Product Designer for WooCommerce
- Affected Versions: All versions up to and including 2.13.2
- Condition: Exploitable when 'nbdesigner_upload_popup_style' is set to 'a' (Advanced Upload Popup).

■ Remediation Steps
1. Audit your WordPress environments to identify if this plugin is installed.
2. Update the plugin to the latest patched version immediately.

■ Reference
- NVD CVE-2026-19803

Priority: High
Deadline: Immediate

Subject: [Security Advisory] IBM Watson Speech Services Cartridge CVE-2026-82418

Dear Team,

We are sharing information regarding a critical vulnerability in IBM Watson Speech Services Cartridge.

■ Overview
A Use After Free vulnerability in OpenSSL (CVE-2026-82418) allows a remote attacker to execute arbitrary code by processing a specially crafted signed message. The CVSSv3.1 base score is 9.8 (Critical).

■ Scope
- Product: IBM Watson Speech Services Cartridge
- Affected Versions: 4.0.0 to 5.4.0

■ Remediation
1. Verify the presence and version of the product in our environment.
2. Apply the fix provided in '5.4.0 Patch 8'.

■ Reference
- IBM Security Advisory

Priority: High
Deadline: Immediate

Subject: [Alert] Malware Infection via Fake Security Tools on GitHub

Dear IT/Security Team,

We are sharing information regarding a campaign distributing malicious projects on GitHub disguised as security tools.

■ Overview
Attackers are hosting fake repositories (e.g., tools for Fscan) that infect systems during the build process. By abusing Visual Studio's PreBuildEvent and embedding malicious code in source files, they deploy backdoors, info-stealers, and cryptocurrency address modifiers.

■ Scope
- Developers and security professionals downloading and building third-party projects from GitHub.
- Windows-based development environments.

■ Recommended Actions
1. Restrict the use of unverified third-party repositories and mandate the use of official/vetted sources.
2. Monitor development environments for suspicious PowerShell execution and anomalous outbound network traffic.
3. Verify that EDR/AV solutions on developer workstations are active and have not been disabled by malicious scripts.

■ Reference
- Dr.Web Technical Analysis Report

Priority: Medium
Deadline: Immediate awareness

Subject: [Urgent] Barracuda Vulnerabilities CVE-2026-116606 / CVE-2026-111560

Dear IT/Security Team,

We are sharing critical information regarding vulnerabilities in Barracuda products.

■ Overview
PoC exploits have been released for CVE-2026-116606 (Authentication Bypass) and CVE-2026-111560. Combined, these allow a remote attacker to bypass authentication and execute arbitrary code on the device. The CVSS 4.0 score for CVE-2026-116606 is 9.3.

■ Scope
- Barracuda Email Security Gateway (ESG) and other affected Barracuda products.

■ Action Plan
1. Identify all Barracuda devices in the environment.
2. Apply the latest security patches provided by the vendor immediately.
3. Restrict access to the administrative interface to authorized IP addresses only.

■ Reference
- Barracuda Official Advisory / CSIRT-ITA Alert

Priority: High
Deadline: Immediate