#DailyCyberSecurity

キタきつね

@kitafox

53 minutes ago

Cybersecurity: How to Keep NoSQL Databases Safe Daily CyberSecurity

サイバーセキュリティ：NoSQLデータベースを安全に保つ方法

Cybersecurity: How to Keep NoSQL Databases Safe #DailyCyberSecurity (Apr 21)

securityonline.info/cybersecurit...

キタきつね

@kitafox

1 hour ago

The Negotiator Turned Traitor: Insider Betrayal in the BlackCat Ransomware Ring Former ransomware negotiator Angelo Martino pleaded guilty to working with BlackCat to extort his own clients. $10M in luxury assets seized. Facing 20 years.

交渉人が裏切り者に：ブラックキャット・ランサムウェア・リングにおける内部犯行

The Negotiator Turned Traitor: Insider Betrayal in the BlackCat Ransomware Ring #DailyCyberSecurity (Apr 21)

securityonline.info/ransomware-n...

キタきつね

@kitafox

16 hours ago

The Dual CVSS 10.0 RCE Flaws Threatening Spinnaker Pipelines Two critical CVSS 10.0 RCE flaws in Spinnaker's Clouddriver and Echo services allow full JVM and shell access. Patch your multi-cloud pipelines immediately.

CVSS 10.0 RCEの二重脆弱性がスピネーカーパイプラインを脅かす

The Dual CVSS 10.0 RCE Flaws Threatening Spinnaker Pipelines #DailyCyberSecurity (Apr 21)

securityonline.info/spinnaker-cr...

キタきつね

@kitafox

16 hours ago

MOVEit WAF Critical Alert: Multi-Level RCE and WAF Bypass Vulnerabilities Disclosed Progress Software warns of 5 critical MOVEit WAF & ADC flaws. RCE and WAF bypass risks allow total system hijack. Upgrade to v7.2.63.0 now to stay secure.

MOVEit WAFの重大な警告：多層的なリモートコード実行（RCE）およびWAFバイパスの脆弱性が明らかに

MOVEit WAF Critical Alert: Multi-Level RCE and WAF Bypass Vulnerabilities Disclosed #DailyCyberSecurity (Apr 21)

securityonline.info/moveit-waf-p...

キタきつね

@kitafox

23 hours ago

Cyber-Actors are "Laundering Trust" to Hijack the Global Supply Chain Proofpoint monitors a 30-day supply chain attack using "signing-as-a-service" to bypass Windows security. Protect your load boards and fleet payments now.

サイバー攻撃者は「信頼を悪用」してグローバルサプライチェーンを乗っ取ろうとしている

Cyber-Actors are “Laundering Trust” to Hijack the Global Supply Chain #DailyCyberSecurity (Apr 20)

securityonline.info/proofpoint-t...

キタきつね

@kitafox

1 day ago

More Than a Miner: The Evasive MiningDropper Framework Hijacking Android Worldwide Cyble reveals MiningDropper, a modular Android threat delivering RATs and infostealers via multi-stage payloads. Protect your mobile devices now.

単なるマイナーではない：世界中でAndroidを乗っ取る巧妙なMiningDropperフレームワーク

More Than a Miner: The Evasive MiningDropper Framework Hijacking Android Worldwide #DailyCyberSecurity (Apr 20)

securityonline.info/miningdroppe...

キタきつね

@kitafox

1 day ago

Root Access Unlocked: FortiSandbox CVE-2026-39808 Details and PoC Exploit Publicly Disclosed Critical 9.1 CVSS flaw in FortiSandbox: Full PoC & details for CVE-2026-39808 are now public. Unauthenticated root RCE is possible. Upgrade to 4.4.9 immediately.

ルートアクセスが解禁：FortiSandboxの脆弱性CVE-2026-39808の詳細と概念実証（PoC）エクスプロイトを公開

Root Access Unlocked: FortiSandbox CVE-2026-39808 Details and PoC Exploit Publicly Disclosed #DailyCyberSecurity (Apr 20)

securityonline.info/fortisandbox...

キタきつね

@kitafox

1 day ago

Zero-Day Alert: The "Red Sun" Vulnerability Turning Microsoft Defender into a Hacker’s Tool Microsoft Defender faces a critical "Red Sun" vulnerability. Learn how this zero-day exploit bypasses security to grant hackers full administrative control.

ゼロデイ警告：「レッドサン」脆弱性により、Microsoft Defenderがハッカーのツールに変貌

Zero-Day Alert: The “Red Sun” Vulnerability Turning Microsoft Defender into a Hacker’s Tool #DailyCyberSecurity (Apr 20)

securityonline.info/microsoft-de...

キタきつね

@kitafox

1 day ago

North Korea’s UNC1069 Uses Fake Video Calls to Hijack Crypto North Korea's UNC1069 uses fake video calls and "ClickFix" prompts to drain crypto assets and record victims for deepfakes. Audit your meetings now!

北朝鮮のUNC1069は偽のビデオ通話を利用して暗号通貨を乗っ取る

North Korea’s UNC1069 Uses Fake Video Calls to Hijack Crypto #DailyCyberSecurity (Apr 19)

securityonline.info/unc1069-fake...

キタきつね

@kitafox

1 day ago

AI-Generated RAT "PHANTOMPULSE" Targets Crypto Sector via Social Engineering Elastic uncovers PHANTOMPULSE: A novel RAT abusing Obsidian plugins and blockchain C2. Stay safe from this AI-assisted campaign targeting crypto firms.

AIが生成したRAT「PHANTOMPULSE」がソーシャルエンジニアリングを通じて暗号通貨業界を標的に

AI-Generated RAT “PHANTOMPULSE” Targets Crypto Sector via Social Engineering #DailyCyberSecurity (Apr 17)

securityonline.info/obsidian-pha...

キタきつね

@kitafox

4 days ago

GitHub Abruptly Terminates All Copilot Pro Trials Amid Massive Abuse GitHub has suspended all Copilot Pro trials as of April 13, 2026. Learn how bad-faith exploitation forced a service-wide shutdown and what it means for you.

GitHub、大規模な不正利用を受けCopilot Proの全トライアルを突然終了

GitHub Abruptly Terminates All Copilot Pro Trials Amid Massive Abuse #DailyCyberSecurity (Apr 16)

securityonline.info/github-copil...

キタきつね

@kitafox

4 days ago

The New Lockdown: How Microsoft’s April 2026 Update Silos Remote Desktop to Kill Phishing Microsoft hardens RDP in the April 2026 update. Discover how new default isolation policies and security warnings stop malicious servers from stealing your data.

新たなロックダウン：マイクロソフトの2026年4月のアップデートは、リモートデスクトップをサイロ化してフィッシングを撲滅する

The New Lockdown: How Microsoft’s April 2026 Update Silos Remote Desktop to Kill Phishing #DailyCyberSecurity (Apr 16)

securityonline.info/windows-rdp-...

キタきつね

@kitafox

4 days ago

North Korea’s "OtterCookie" Hides Inside Benign npm Wrappers Panther uncovers "OtterCookie," a North Korean npm campaign hiding malware in benign wrappers. It steals crypto wallets and installs SSH backdoors. Audit now!

北朝鮮の「OtterCookie」は、無害なnpmラッパーの中に潜んでいる

North Korea’s “OtterCookie” Hides Inside Benign npm Wrappers #DailyCyberSecurity (Apr 16)

securityonline.info/npm-malware-...

キタきつね

@kitafox

5 days ago

Attackers Weaponize Mailbox Rules to Control Your Inbox Proofpoint warns that 10% of M365 account takeovers use malicious mailbox rules to steal data and hide alerts. Secure your cloud identity—check your rules!

攻撃者はメールボックスのルールを悪用して受信トレイを制御する

Attackers Weaponize Mailbox Rules to Control Your Inbox #DailyCyberSecurity (Apr 15)

securityonline.info/m365-malicio...

キタきつね

@kitafox

5 days ago

The Friend Request from Pyongyang: How APT37 Hijacks Facebook to Deploy RokRAT APT37 pivots to Facebook social engineering, using Wondershare PDFelement "code caves" to deploy RokRAT. Learn how they bypass EDR with memory-only payloads.

平壌からの友達リクエスト：APT37がFacebookを乗っ取ってRokRATを展開する方法

The Friend Request from Pyongyang: How APT37 Hijacks Facebook to Deploy RokRAT #DailyCyberSecurity (Apr 15)

securityonline.info/apt37-facebo...

キタきつね

@kitafox

5 days ago

The "Graphalgo" Evolution: How North Korea Built a Fake Florida LLC to Hack Developers North Korea’s "graphalgo" campaign uses fake job interviews and real Florida LLCs to infect developers. Learn how to spot this sophisticated state-sponsored trap.

「Graphalgo」の進化：北朝鮮はいかにして偽のフロリダLLCを設立し、開発者をハッキングしたか

The “Graphalgo” Evolution: How North Korea Built a Fake Florida LLC to Hack Developers #DailyCyberSecurity (Apr 15)

securityonline.info/graphalgo-no...

キタきつね

@kitafox

6 days ago

5 Best Autonomous Penetration Testing Tools in 2026 Active exploit detected: Active SharePoint Spoofing and Legacy Office RCE: CISA Alerts on New KEV Exploits (CVE-2026-32201).

2026年に注目すべき、最も優れた自律型侵入テストツール5選

5 Best Autonomous Penetration Testing Tools in 2026 #DailyCyberSecurity (Apr 14)

securityonline.info/5-best-auton...

キタきつね

@kitafox

6 days ago

The Billion-Dollar Invite: How UNC1069’s Fake Meetings Hijack Crypto Fortunes North Korean group UNC1069 (BlueNoroff) targets Web3 with fake Zoom/Teams links. 164 domains blocked. Secure your crypto assets and browser extensions now!

10億ドルの招待状：UNC1069の偽会議がいかにして仮想通貨の富を奪い取ったか

The Billion-Dollar Invite: How UNC1069’s Fake Meetings Hijack Crypto Fortunes #DailyCyberSecurity (Apr 14)

securityonline.info/unc1069-blue...

キタきつね

@kitafox

6 days ago

Urgent Patch Alert: SharePoint Spoofing Under Active Attack as Microsoft Releases April 2026 Updates Microsoft’s April 2026 Patch Tuesday fixes 163 flaws, including an exploited SharePoint spoofing bug (CVE-2026-32201). Patch by April 28 per CISA mandate.

緊急パッチアラート：Microsoftが2026年4月のアップデートをリリースする中、SharePointのなりすまし攻撃が活発化しています

Urgent Patch Alert: SharePoint Spoofing Under Active Attack as Microsoft Releases April 2026 Updates #DailyCyberSecurity (Apr 15)

securityonline.info/microsoft-pa...

キタきつね

@kitafox

6 days ago

25 Million Users at Risk: Fastify Publicly Discloses PoC Exploit for Single-Space Security Bypass Fastify (25M+ downloads) reveals CVE-2026-33806. A public PoC exploit shows how a single space bypasses schema validation. Upgrade to v5.8.5 now to stay safe.

2500万人のユーザーが危険にさらされる：Fastifyがシングルスペースのセキュリティバイパスに関する概念実証（PoC）エクスプロイトを公開

25 Million Users at Risk: Fastify Publicly Discloses PoC Exploit for Single-Space Security Bypass #DailyCyberSecurity (Apr 15)

securityonline.info/fastify-cve-...

キタきつね

@kitafox

6 days ago

Active SharePoint Spoofing and Legacy Office RCE: CISA Alerts on New KEV Exploits CISA adds Microsoft SharePoint spoofing (CVE-2026-32201) and legacy Office RCE (CVE-2009-0238) to its KEV Catalog. Remediation deadline: April 28, 2026.

SharePointのなりすましとレガシーOfficeのリモートコード実行：CISAが新たなKEVエクスプロイトに関する警告を発令

Active SharePoint Spoofing and Legacy Office RCE: CISA Alerts on New KEV Exploits #DailyCyberSecurity (Apr 15)

securityonline.info/cisa-kev-sha...

キタきつね

@kitafox

6 days ago

Critical 9.1 Flaws Hit Fortinet FortiSandbox Fortinet issues a critical 9.1 CVSS alert for FortiSandbox. Unauthenticated auth bypass and command injection risks. Patch to 5.0.6 or 4.4.9 immediately.

Fortinet FortiSandboxに重大な9.1の脆弱性が発生

Critical 9.1 Flaws Hit Fortinet FortiSandbox #DailyCyberSecurity (Apr 15)

securityonline.info/fortinet-for...

キタきつね

@kitafox

6 days ago

Adobe Rushes Patches for Critical ColdFusion RCE and Security Bypasses Adobe patches critical RCE and security bypass flaws in ColdFusion 2023 & 2025. Protect your enterprise servers from takeover—update to the latest version now.

Adobe、ColdFusionの重大なリモートコード実行脆弱性とセキュリティバイパスに対するパッチを急遽リリース

Adobe Rushes Patches for Critical ColdFusion RCE and Security Bypasses #DailyCyberSecurity (Apr 15)

securityonline.info/adobe-coldfu...

キタきつね

@kitafox

6 days ago

APT41’s New "Zero-Detection" Backdoor Targets Linux Workloads APT41's new zero-detection ELF backdoor uses SMTP (Port 25) to hijack Linux cloud workloads invisibly. Secure your credentials—audit your SMTP traffic today.

APT41の新たな「検出不可能な」バックドアがLinuxワークロードを標的に

APT41’s New “Zero-Detection” Backdoor Targets Linux Workloads #DailyCyberSecurity (Apr 15)

securityonline.info/apt41-winnti...

キタきつね

@kitafox

6 days ago

Inside the Global "MaaS" Engine of the K99 Scam Compound Infoblox uncovers the K99 compound: a brutal MaaS operation using human trafficking to power biometric hijacking and global Android banking fraud.

K99詐欺複合施設のグローバル「MaaS」エンジン内部

Inside the Global “MaaS” Engine of the K99 Scam Compound #DailyCyberSecurity (Apr 14)

securityonline.info/k99-triumph-...

キタきつね

@kitafox

6 days ago

New Stealth Attack Chain Weaponizes Legitimate Remote Access Software Zscaler reveals a 2026 attack chain using fake Adobe Reader lures to install ScreenConnect via in-memory execution and UAC bypass. Protect your network now!

新たなステルス攻撃チェーンが正規のリモートアクセスソフトウェアを武器化

New Stealth Attack Chain Weaponizes Legitimate Remote Access Software #DailyCyberSecurity (Apr 14)

securityonline.info/fake-adobe-r...

キタきつね

@kitafox

1 week ago

The Encryption Ghost: How the FBI Recovers "Deleted" Signal Messages from iPhone Caches Signal's encryption is solid, but iOS is leaking your data. Learn how the FBI uses notification caches to recover deleted messages and how to stop it.

暗号化の亡霊：FBIはいかにしてiPhoneのキャッシュから「削除済み」のSignalメッセージを復元するのか

The Encryption Ghost: How the FBI Recovers “Deleted” Signal Messages from iPhone Caches #DailyCyberSecurity (Apr 13)

securityonline.info/fbi-signal-d...

キタきつね

@kitafox

1 week ago

How Shadow IT Expands Attack Surface Between Pentests Daily CyberSecurity

シャドウITがペネトレーションテストの合間に攻撃対象領域を拡大する方法

How Shadow IT Expands Attack Surface Between Pentests #DailyCyberSecurity (Apr 13)

securityonline.info/how-shadow-i...

キタきつね

@kitafox

1 week ago

CVE-2026-4631: Critical 9.8 RCE Flaw in Cockpit Allows Unauthenticated Server Takeover Cockpit CVE-2026-4631 allows unauthenticated RCE on Linux servers via SSH injection. Stop the unauthorized takeover—upgrade to Cockpit version 360 now!

CVE-2026-4631: Cockpitにおける重大な9.8 RCE脆弱性により、認証なしでサーバーを乗っ取ることができる

CVE-2026-4631: Critical 9.8 RCE Flaw in Cockpit Allows Unauthenticated Server Takeover #DailyCyberSecurity (Apr 14)

securityonline.info/cockpit-rce-...

キタきつね

@kitafox

1 week ago

Supply Chain Sabotage: The Critical RCE Flaws Lurking in PHP Composer Critical Remote Command Injection flaws in PHP Composer's Perforce integration (CVE-2026-40176 & CVE-2026-40261) could lead to full system compromise. Patch now.

サプライチェーン妨害：PHP Composerに潜む重大なRCE脆弱性

Supply Chain Sabotage: The Critical RCE Flaws Lurking in PHP Composer #DailyCyberSecurity (Apr 14)

securityonline.info/composer-per...