Online Safety Recap (Sep 7 - Sep 12): Decide Where You Stop Before You Need To

Hello! This is Shemihaza, your Sentinel. This recap covers 7 to 12 September 2026.
This week brought six online safety articles, each on a different scam. Side by side, they share one idea: rather than trying to tell the real thing from the fake, decide in advance on the one point where you stop, before any money or information moves. However polished the wording and however genuine it looks, a scam fails if you already know where you stop.

Online safety this week: six scams and where to stop

Sep 7: "We'll refund you via a payment app" is a scam, even when 1,000 yen comes back as 1,200

Based on a bulletin published by Japan's National Consumer Affairs Center (NCAC) on 17 August 2026. Social media direct messages claiming to support disaster areas lead people into a LINE group, where they are told that buying through a code payment app gets them back more than they paid. In the reported case, a 1,000 yen payment really did come back as 1,200 yen, and then the refund stopped on the round where the victim paid 100,000 yen.
The deciding point: a deal where the more you buy, the more money you end up with, cannot work. The small amounts that came back were simply the cost of getting a large payment out of you.

Sep 8: Online shops that never deliver: stop if you are told to use "Send"

According to an NCAC advisory published on 17 June 2026, fraudulent shopping sites have been found telling buyers to pay a personal account using a code payment app's "Send" function. The NCAC notes that the Send function is generally for transfers between individuals, and that payments to businesses use the "Pay" function.
The same logic applies to bank transfers where the account is in a personal name. Stopping once at the payment screen defeats almost all of this scam.

Sep 9: The "15,622 points" email that gets you to install a malicious app

We covered an urgent alert issued by the Council of Anti-Phishing Japan on 8 September 2026. The emails push a malicious Android app, and the Council confirmed they were still being sent as of 11:30 that day.
We also checked the published subject lines ourselves: 7 of the 14 contained characters that do not show on screen. So "the Japanese reads oddly, so it's fake" is no longer a reliable test. There is one rule: install apps from the app store, never from a link in an email.

Sep 10: Missed-delivery SMS: what to do if you opened the link

The Council of Anti-Phishing Japan's monthly report (published 17 August 2026, covering July) says phishing via SMS "continues to be reported in low numbers", while confirming it has received reports of messages posing as missed-delivery notices. We did not describe this as a surge, and explained why it is still worth watching.
The strongest defence is checking your parcel through a route you start yourself: the carrier's official app, or its official site typed into your browser, rather than the SMS link. If you only opened the link and entered nothing, in most cases it is not too late.

Sep 11: Your child made in-game purchases without asking: refunds, and five settings to change today

Based on NCAC consultation statistics updated on 31 July 2026. Consultations about online games fell from 8,473 in fiscal 2023 to 6,234 in fiscal 2025, but an NCAC advisory from 13 March 2024 put the average amount in cases where the contracting party was a school-age child at about 330,000 yen.
The key point: even if purchases require approval, handing over a device still signed in to a parent's account lets the child register their own fingerprint. Refunds are not guaranteed either: the NCAC notes that purchases made on a device signed in to the parent's account may be treated as made by the parent. So the point to stop is signing out before you lend the device.

Sep 12: QR codes in emails and on posters: the touch test, and three steps if you already scanned

Based on the NCAC's Mimamori Shinsen Joho No. 550 (3 September 2026) and the Tokyo Metropolitan Police Department's page on using QR codes safely (updated 10 July 2026). A QR code hides its destination until you scan it, which skips the habit of looking at a link before tapping it.
The police list two measures that matter here: for a printed code, touch it with your finger before scanning; if someone sends you a payment QR code, stop the moment you are asked to enter an amount. This connects straight back to the Sep 7 refund scam.

For engineers: this week's security alerts

Five articles. One covers a flaw CISA confirmed as exploited and added to the KEV (Known Exploited Vulnerabilities) catalog.
The common thread this week: do not stop at the published severity label or affected-version range. One flaw rated only "Medium" by its vendor was being exploited, and in another, versions that look outside the advisory's range turned out to be unpatched.

Chrome CVE-2026-87491 (CVSS v3.1: 8.8 HIGH / Google rating: Medium) - confirmed exploited

An out-of-bounds write in the V8 JavaScript engine. In its official release notes on 8 September 2026, Google stated it is aware that an exploit exists; CISA added it to KEV on 9 September with a due date of 23 September. The 8.8 comes from CISA-ADP; Google's own severity rating is "Medium".
A Medium rating does not make an exploited flaw something to leave for later. Update Chrome to 153.0.8010.36 or later (.37 also applies on Windows and Mac) and make sure you relaunch. CISA notes the flaw may affect other Chromium-based browsers, including Edge and Opera.

Google ADK for Python CVE-2026-79696 (CVSS v4.0: 10.0 CRITICAL)

In the AI agent toolkit `google-adk`, sending a crafted test session replay to `adk web` in an environment with pytest installed allows unauthenticated arbitrary code execution. The fix is 2.7.0.
Watch how you read the affected range. The advisory says 2.0.0 through 2.6.0, but when we checked the source, 2.6.1, 2.6.2 and 2.6.3 were also unpatched. Do not conclude that 2.6.3 is out of scope; upgrade to 2.7.0 or later.

miniOrange 2FA CVE-2026-77770 (CVSS v3.1: 10.0 CRITICAL)

In this WordPress two-factor authentication plugin, anyone, without logging in, can delete a site setting (option) by name. The researchers say this can lock every administrator out or deactivate every plugin. The 10.0 is WPScan's score as the assigning CNA.
It is not in CISA's KEV catalog and no exploitation has been observed. The reason to hurry is that WPScan has announced it will publish proof-of-concept code on 8 October 2026. Update the free version to 6.3.1 and Pro to 19.3.

Frontend Admin by DynamiApps CVE-2026-75816 (CVSS v3.1: 9.8 CRITICAL)

An authentication bypass in versions 3.29.12 and earlier of this WordPress plugin: an unauthenticated attacker can change an administrator's email address and take over the account through a password reset. The 9.8 is Wordfence's score as the assigning CNA.
The fixed version, 3.29.13, was released on 25 August 2026, 12 days before the CVE was published on 6 September. After updating, check whether WordPress core's "Email Changed" notice arrived at an administrator's original address. But no notice is not proof you are safe.

Oracle HTTP Server / WebLogic Proxy Plug-in: component and patch status checklist

Not a CVE alert but a checklist for administrators, meant to be used alongside our 26 August Oracle alert. "WebLogic is patched" does not tell you whether the plug-in in front of it is. It walks through recording which component runs on which host, from the front-end web server to the back end, and keeping patch history per Oracle Home.
One rule carries over to any inventory: when a command fails, record "unconfirmed", not "no patch".

This week's quiz - four questions

If you read this week's articles, you can spot all four. The first two are worth doing with family; the last two with colleagues.

This week's articles

Three lines to forward to your family

• ▸If you are told "we'll refund you via a payment app, enter the amount", stop there. A refund should never need you to enter an amount. Shops take payment through "Pay", not "Send".
• ▸Don't open links or QR codes from delivery texts or emails. Check parcels and points by opening the app yourself, and only install apps from the app store.
• ▸Before lending a child your phone, sign out of your account. In Japan, call the Consumer Hotline 188 if you are in trouble, or the police consultation line #9110 if you suspect a scam.

If something has gone wrong

If you are thinking "I've made a mistake", start with the emergency guide for your situation. Work through it in order. There is nothing to be ashamed of.
If you entered a card number or password, contact the card company and the service first. If you paid through a code payment app, contact that payment service first.
For readers in Japan:
Consumer Hotline: 188 (no area code; connects you to your nearest local consumer affairs centre)
Police consultation line: #9110 (connects you to the consultation desk of your local police)