Tomo

MSIgniteがAI一色。

セキュリティで小規模MSSPが生き残れる未来が想像できなくなったのでキャリアチェンジすべきか真剣に悩み中

a SQL query なのか an SQL queryなのか。みんなはどっち?

Hackers hijack npm packages with 2 billion weekly downloads in supply chain attack In what is being called the largest supply chain attack in history, attackers have injected malware into NPM packages with over 2.6 billion weekly downloads after compromising maintainers' accounts in a phishing attack.

In what is being called the largest supply chain attack in history, attackers have injected malware into NPM packages with over 2.6 billion weekly downloads after compromising maintainers' accounts in a phishing attack.

Hackers steal 3,325 secrets in GhostAction GitHub supply chain attack A new supply chain attack on GitHub, dubbed 'GhostAction,' has compromised 3,325 secrets, including PyPI, npm, DockerHub, GitHub tokens, Cloudflare, and AWS keys.

A new supply chain attack on GitHub, dubbed 'GhostAction,' has compromised 3,325 secrets, including PyPI, npm, DockerHub, GitHub tokens, Cloudflare, and AWS keys.

Fortinet Releases Patch for Critical SQL Injection Flaw in FortiWeb (CVE-2025-25257)

Fortinet Releases Patch for Critical SQL Injection Flaw in FortiWeb (CVE-2025-25257)

Let's Encrypt Started to Issue SSL/TLS Certificate for IP Address

Let’s Encrypt Started to Issue SSL/TLS Certificate for IP Address

Scattered Spider Attacks US Airlines – The MSP Cyber News Snapshot – July 3rd

二要素って言い方はあまりしないかも、多要素（Multi Factor Authentication）の方がおすすめ

パスワードを使わない場合でも・・・

・ TPM搭載デバイスを保有していること
・ デバイスの認証を持っていること

など、複数の要素を認証しているので・・・・

Over 1,000 SOHO Devices Hacked in China-linked LapDogs Cyber Espionage Campaign

Over 1,000 SOHO Devices Hacked in China-linked LapDogs Cyber Espionage Campaign

参加してきました
ウクライナCERT人気だった

Scattered Spider hackers shift focus to aviation, transportation firms Hackers associated with Scattered Spider tactics have expanded their targeting to the aviation and transportation industries after previously attacking insurance and retail sectors

Hackers associated with Scattered Spider tactics have expanded their targeting to the aviation and transportation industries after previously attacking insurance and retail sectors

Scattered Spider Taps CFO Credentials in 'Scorched Earth' Attack In a recent intrusion, the notorious cybercriminal collective accessed CyberArk vaults and obtained more 1,400 secrets, subverted Azure, VMware, and Snowflake environments, and for the first known time, actively fought back against incident response teams.

Scattered Spider Taps CFO Credentials in 'Scorched Earth' Attack

今月のアレにコペンハーゲン行く人いるだろうか

思いっきり色々使える、おうちサーバーになりそう
（TRとかXeonではないので、小規模だけど）

U.S. Govt. Funding for MITRE's CVE Ends April 16, Cybersecurity Community on Alert CVE funding ends April 16, risking delays in vulnerability tracking, advisories, and cyber response tools.

息を呑んで見守っている。

thehackernews.com/2025/04/us-g...

According to Ransomware.live, qilin ransomware group has added SMC Corporation (🇯🇵) to its victims.

🚨Cyberattack Alert ‼️

🇪🇺🇯🇵 - SMC Corporation

Qilin hacking group claims to have breached the European branch of SMC Corporation.

Allegedly, 1.1 TB (552,000 files) of data were exfiltrated.

CVE-2025–24813: Apache Tomcat Path Equivalence Vulnerability $$$$ BOUNTY Disclaimer: This document is for educational purposes only. Exploiting systems without authorization is illegal and punishable by law.

CVE-2025–24813: Apache Tomcat Path Equivalence Vulnerability $$ BOUNTY

某大使館でのイベントに参加
日本のはずなのにそこは完全に欧州だった。

イギリスのロンドンにある
バターシーパワーステーション…廃火力発電所をショッピングモールにしちゃったもの。外の迫力と中がモダンなモールで驚いた。

今回の出張、ほぼ全ての支払いをカードで済ませてポンドに至っては1ポンドも持ってかなかった

1週間かけて、オランダ／イギリス出張。帰りはフランス経由だったので空港散策に入出国だけつけた

Code injection attacks using publicly disclosed ASP. NET machine keys Microsoft Threat Intelligence observed limited activity by an unattributed threat actor using a publicly available, static ASP.NET machine key to inject malicious code and deliver the Godzilla post-ex...

公開された ASP.NET マシン キーを使用したコード インジェクション攻撃
#CybersecurityNews
www.microsoft.com/en-us/securi...

NVIDIA GPU Display Driver Vulnerability Lets Attackers Steal Files Remotely - Update Now NVIDIA has released a critical software security update to address multiple vulnerabilities affecting its GPU Display Driver and Virtual GPU (vGPU) software.

NVIDIA GPU Display Driver Vulnerability Lets Attackers Steal Files Remotely – Update Now

詐欺に注意: YouTube 上の偽の Minecraft、Roblox ハックにマルウェア隠蔽、子供がターゲットに
#CybersecurityNews
www.mcafee.com/blogs/intern...

FBI seizes Cracked.io, Nulled.to hacking forums in Operation Talent The FBI has seized the domains for the infamous Cracked.io and Nulled.to hacking forums, which are known for their focus on cybercrime, password theft, cracking, and credential stuffing attacks.

FBI seizes Cracked.io, Nulled.to hacking forums in Operation Talent

切り出したVLANセグメントにn150くらいでサーバー置こうかなぁ

Record-breaking 5.6 Tbps DDoS Attack From 13,000 Mirai Hacked Devices

Record-breaking 5.6 Tbps DDoS Attack From 13,000 Mirai Hacked Devices

今日はとてもわかりやすい英語で助かる

JSAC、同時通訳聞くのは苦手だからと忌避してるけど、訛り強めの英語はキツイ。昨日はそれで途中で力尽きたよ