JPCERT/CC · Breaches & incidents
Japan breach wave: JPCERT/CC adds AI-driven pen-test tool attacks
Operators of public apps or APIs、Organizations running Metabase or BI tools、Organizations exposing WSUS servers
Act now
RED FLAG and DOUBLE YELLOW FLAG stories. Act early if they affect you.
Patchstack Blog · WordPress & CMS
WordPress sites can be crashed via Brotli flaw in libcurl; patch the OS
Anyone running a WordPress site、Teams using the official WordPress Docker image、Sites with plugins that fetch URLs
Wordfence Blog · WordPress & CMS
WordPress core flaw allows remote takeover; update now, attacks seen
Anyone running a WordPress site、Agencies maintaining WordPress sites
CISA Known Exploited Vulnerabilities · Network devices
Cisco ASA/FTD firewalls can be crashed remotely; attacks confirmed
Organizations running Cisco ASA or FTD、Agencies managing client firewalls
CISA Known Exploited Vulnerabilities · Business apps & SaaS
GitLab flaw lets outsiders run code on servers; exploited in the wild
Anyone self-hosting GitLab CE or EE、Teams with GitLab reachable from the internet
CISA Known Exploited Vulnerabilities · Servers & cloud
Linux kernel flaw chained with PHP bugs lets attackers take over servers
Anyone running PHP sites on Linux servers、Organizations managing their own web servers、VPS and hosting administrators
CISA Known Exploited Vulnerabilities · Servers & cloud
VMware ESX flaw lets admin actions go unlogged; exploited in the wild
Organizations running VMware ESX themselves、Agencies hosting servers on ESX
CISA Known Exploited Vulnerabilities · WordPress & CMS
Adobe Commerce and Magento flaw is being exploited; update now
Anyone running a Magento store、Agencies managing Adobe Commerce sites
デジタル庁 新着 · Languages & frameworks
Japan's government urges fast fix of PHP vulnerability; sites may be taken offline
Anyone running a PHP-based website、Operators of PHP CMS such as WordPress、Agencies managing PHP sites for clients
総務省 報道資料 · Policy & guidelines
Japan's internal affairs minister urges prompt PHP updates over a serious flaw
Anyone running a PHP-based website、Anyone on an end-of-support PHP version
CISA Known Exploited Vulnerabilities · Business apps & SaaS
Collabora Online built-in CODE server in NextCloud exploited for remote code execution
Anyone running NextCloud with built-in Collabora CODE、Organizations self-hosting NextCloud
CISA Known Exploited Vulnerabilities · Network devices
Arista VeloCloud Orchestrator (on-prem) SQL injection exploited in the wild
Only firms running on-prem VeloCloud Orchestrator、Admins of VeloCloud Orchestrator servers