podcast - #セキュリティのアレ - ゆるーいセキュリティのポッドキャストですよ。

事件、事故

複数の地方銀行でボイスフィッシングによる不正送金被害が発生

(11/17) 当社を騙る「ボイスフィッシング」による不正送金に関する注意喚起について

(11/18) 法人インターネットバンキング「BIZ-WEB」における他行あての当日振込の停止に関するお知らせ | 第四北越銀行

(11/19) 法人インターネットバンキング（ビジネスIB、ほっと君Web Jr.）における振込の停止について | 重要なお知らせ | 北陸銀行

Cloudflare のサービスで大規模な障害が発生。データベースシステムに対する権限変更に起因するもの

(11/18) Cloudflare outage on November 18, 2025

On 18 November 2025 at 11:20 UTC (all times in this blog are UTC), Cloudflare's network began experiencing significant failures to deliver core network traffic. This showed up to Internet users trying to access our customers' sites as an error page indicating a failure within Cloudflare's network.

(11/18) Cloudflare Status - Cloudflare Global Network experiencing issues

(11/18) ChatGPTやXで数時間の接続障害、ネット支える少数企業への依存鮮明に - Bloomberg

Twitter/X coming back after @Cloudflare's platform-wide outage.

Traffic volume (bits/sec) by source CDN based on @kentikinc aggregate NetFlow: https://t.co/kfidzJD3Xe pic.twitter.com/RxWObzsR62
— Doug Madory (also on Bluesky) (@DougMadory) November 18, 2025

Salesforce が Gainsight アプリケーションによる不審なアクセスを検知

(11/20) Security Advisory: Unusual Activity Related to Gainsight Applications | Trust Status

Salesforce has identified unusual activity involving Gainsight-published applications connected to Salesforce, which are installed and managed directly by customers. Our investigation indicates this activity may have enabled unauthorized access to certain customers’ Salesforce data through the app’s connection.

(11/21) Security Advisory: Unusual Activity related to the Gainsight application

(11/20) Gainsight Status - Investigating - Salesforce Connection Failure

(11/21) Google says hackers stole data from 200 companies following Gainsight breach | TechCrunch

(11/21) ShinyHunters 'does not like Salesforce at all' • The Register

攻撃、脅威

Azure で 15.72 Tbps / 3.64 Bpps の DDoS 攻撃を観測

(11/18) Defending the cloud: Azure neutralized a record-breaking 15 Tbps DDoS attack | Microsoft Community Hub

On October 24, 2025, Azure DDOS Protection automatically detected and mitigated a multi-vector DDoS attack measuring 15.72 Tbps and nearly 3.64 billion packets per second (pps). This was the largest DDoS attack ever observed in the cloud and it targeted a single endpoint in Australia.

SecurityScorecard が多数の侵害した ASUS ルータを利用した攻撃キャンペーンについて報告

(11/19) Operation WrtHug, The Global Espionage Campaign Hiding in Your Home Router - SecurityScorecard

ESET が中国の攻撃者グループ PlushDaemon による攻撃活動について報告

(11/19) PlushDaemon compromises network devices for adversary-in-the-middle attacks

ESET researchers provide insights into how PlushDaemon performs adversary-in-the-middle attacks using a previously undocumented network implant that we have named EdgeStepper, which redirects all DNS queries to an external, malicious hijacking node, effectively rerouting the traffic from legitimate infrastructure used for software updates to attacker-controlled infrastructure.

Google が中国の攻撃者グループ APT24 による攻撃活動について報告

(11/21) APT24's Pivot to Multi-Vector Attacks | Google Cloud Blog

Google Threat Intelligence Group (GTIG) is tracking a long-running and adaptive cyber espionage campaign by APT24, a People's Republic of China (PRC)-nexus threat actor. Spanning three years, APT24 has been deploying BADAUDIO, a highly obfuscated first-stage downloader used to establish persistent access to victim networks.

脆弱性

Google が Chrome のゼロデイ脆弱性を修正

(11/17) Chrome Releases: Stable Channel Update for Desktop

Google is aware that an exploit for CVE-2025-13223 exists in the wild.

FortiWeb に OS コマンドインジェクションの脆弱性。すでに悪用が確認されている

(11/18) Multiple OS command injection in API and CLI | PSIRT | FortiGuard Labs

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.

Fortinet has observed this to be exploited in the wild.

CISA が Known Exploited Vulnerabilities (KEV) カタログに 1+1+1 個の脆弱性を追加

(11/18) CISA Adds One Known Exploited Vulnerability to Catalog | CISA

CVE-2025-58034 Fortinet FortiWeb OS Command Code Injection Vulnerability

(11/19) CISA Adds One Known Exploited Vulnerability to Catalog | CISA

CVE-2025-13223 Google Chromium V8 Type Confusion Vulnerability

(11/21) CISA Adds One Known Exploited Vulnerability to Catalog | CISA

CVE-2025-61757 Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

その他

Windows 11 と Windows Server 2025 で 2026年から Sysmon をネイティブでサポートするとの発表

(11/19) Native Sysmon functionality coming to Windows | Microsoft Community Hub

Next year, Windows updates for Windows 11 and Windows Server 2025 will bring Sysmon functionality natively to Windows. Sysmon functionality allows you to use custom configuration files to filter captured events. These events are written to the Windows event log, enabling a wide range of use cases including by security applications.

喜ぶのが早すぎた…😭
昔、EMETが正式にエクスプロイト保護として統合されたように、Sysmonも同じ感じになるかなと思ってたけど、どうも微妙な雰囲気に。。… https://t.co/kwmq4RgEN2
— 田中ザック (Zach Mathis) (@yamatosecurity) November 20, 2025