flawopen.com/インシデント/Equifax / Apache Struts
ビルの受付に「希望する言語（日本語、英語など）」を伝えるインターホンがあります。ある日、悪意ある人物が言語名の代わりにプログラムの実行コマンドを話すと、インターホンがそれを真に受けて全フロアのセキュリティロックを解除してしまいました。
The technical flaw is unremarkable; the organisational failure is the reason this breach is still taught. Congressional and regulatory findings identified a cluster of causes that compounded one another:
Equifax is the canonical demonstration that vulnerability management is an inventory problem before it is a patching problem. The organisation knew about the CVE, had the patch, and issued the instruction — and still lost 147 million records, because the instruction could not be mapped onto a system nobody had recorded.
The second durable lesson is about monitoring integrity. A security control that has silently stopped working is worse than a missing one, because it produces false assurance. An expired certificate on an inspection appliance is a mundane operational defect that, in this case, cost 76 days of detection time.
The initial exploit was not. CVE-2017-5638 was public, widely weaponised, and being scanned for at internet scale within days of disclosure. What distinguished the incident was the length of undetected access and the breadth of data reachable once inside.
For an internet-facing, unauthenticated RCE in a widely deployed framework, the practical window is days, not weeks — mass scanning typically begins within 24–72 hours of public disclosure. The prerequisite is knowing where the software runs, which is why inventory work pays off more than patch-speed targets alone.