Weekly Online Safety Recap (5-10 Oct): Five Places to Stop and a Four-Question Quiz

Hello! Shemihaza here, your Sentinel. Let us look back over the week of 5 to 10 October 2026.

Online safety this week: five places to stop

5 Oct: a call at work. Tech-support scam cases at firms hit 68, and what stopped one was holding the call and powering off

Built on the quarterly report for April to June from the helpdesk for businesses and organisations that IPA published on 22 July 2026. Tech-support scam cases were 68, about 66% up on the previous quarter’s 41 (my own calculation).
In the case IPA described, a recorded voice posing as the National Tax Agency said to press 1; the employee then gave an email address, an email arrived at once, and they installed the file as told. It stopped because another employee noticed, put the call on hold and powered the machine off.
So if you are told to press 1, hang up without pressing it, and never give the caller an email address. If something feels off, put the call on hold and tell the people around you.

6 Oct: a fake shop behind a social-media ad. Cash on delivery is no guarantee, and the gold coin was 70% copper, 20% iron

Built on the warning the Consumer Affairs Agency issued on 3 September 2026. On the fake sites that impersonate Tanaka Kikinzoku and MIKIMOTO in social-media ads, cash on delivery was the only payment method, and the parcel arrived from outside Japan about ten days after the order. In testing, the coin was mainly 70% copper and 20% iron, and the necklace was an imitation pearl.
The National Consumer Affairs Center of Japan reports that cash-on-delivery cases made up 50.8% of fake-goods online-shopping complaints in fiscal 2020, 63.5% in 2021 and 59.3% in 2022. The weakness of cash on delivery is that you cannot check the contents before paying.
So do not buy from an ad’s "Buy" button; search for the brand yourself and reopen the official site. If cash on delivery is the only option, do not order.

7 Oct: a data-breach notice. Leaked data does not come back, and the danger is the copycat contact afterwards

Built on the announcements by Daiwa Securities (5 October) and Citizen Watch (6 October). Both say that the same contractor’s server, used for handling enquiries, was accessed without authorisation, and that data on about 110,000 people (Daiwa) and about 100,000 people (Citizen) may have leaked. Citizen says it has not confirmed secondary damage, and Daiwa says it has not confirmed unauthorised trades or publication on the internet.
An individual cannot get leaked data back. What you can do is check what leaked and prepare for the contact that comes next.
Do not use the links or numbers in any call, email or SMS that arrives after the notice. To check, call an official contact you looked up yourself.

9 Oct: matchmaking scams. Cases up 73.2%, losses up 83.2%, and the National Police Agency says "a deposit is required" means fraud

Built on the National Police Agency provisional figures to the end of August 2026, published on 2 October. Matchmaking scams were 452 cases (up 73.2% on a year earlier) with losses of 1.47 billion yen (up 83.2%). In the agency’s example conversation, after the registration fee is paid comes "someone has taken a liking to you; pay a deposit so we can hold them for you".
The statistic does not say why they rose. The agency shows only the change in cases and amounts.
So the moment a "deposit" appears after a registration fee, cut contact without weighing what they say. Do not call the contact details you were given; check by calling back a police station you looked up yourself.

10 Oct: paying first for tickets. The payment app warned, the buyer sent the money anyway and lost contact

Built on the notice the National Consumer Affairs Center of Japan published on 6 October 2026. In Case 1 a buyer was offered tickets at face value on SNS, trusted the seller because a driver’s licence image arrived, and sent about 20,000 yen despite the payment app’s warning, then could not reach the seller. The buyer says the seller seemed to be pitching others too, so there seemed to be several victims.
The notice gives no figure for the number of complaints.
So do not send money first; look for tickets on an official sales site or the organiser’s resale. When the payment app warns you, that is the place to stop.

For engineers: this week’s security alerts, with updates as of 11 October

Four this week. Of the four articles, three concern CVEs that are in CISA’s Known Exploited Vulnerabilities catalogue (NetScaler, Zammad and the five old ones); only Atlassian is not (I checked every CVE in the articles against the catalogue version dated 8 October 2026).
Absence from the catalogue is not evidence that nothing is being exploited. When I re-checked on 11 October, Zammad had a fixed release and the other three had moved on NVD.

NetScaler ADC/Gateway CVE-2026-88779 (CVSS v4.0: 8.7 HIGH): same fixed versions, NVD analysis now complete

Citrix’s bulletin (CTX697174) still gives 14.1-73.41 / 13.1-64.28 and later as the fixed versions. As the 5 October article said, the 27 September update (73.37 / 64.23) is not enough. CISA added it to the catalogue on 4 October.
The update is NVD’s analysis. When I re-checked on 11 October it was complete, and NIST itself scores it CVSS v3.1 7.5 (HIGH). The v4.0 8.7 shown in the article is on NVD as another assessor’s value (Secondary). The versions differ, so the different numbers do not contradict each other.

Zammad CVE-2026-102490 (CVSS v4.0: 8.5 HIGH, DIVD’s score): fixed in 7.2.2 on 8 October

The 6 October article said no fixed release existed. That has changed. Zammad released 7.2.2 on 8 October, and the GitHub security advisory (GHSA-p97w-927q-8vxq) gives CVE-2026-102490’s affected versions as 7.2.1 and earlier and the fixed version as 7.2.2. According to the release page, it is a root escalation that affects only DEB/RPM packages (packager.io), and SaaS customers need do nothing.
If you self-host, update to 7.2.2 or later. Zammad 6.5 and earlier are also affected by CVE-2026-102489 and are out of support, so update those first.
The scores moved too. When I re-checked on 11 October, NIST itself had scored CVE-2026-102490 CVSS v3.1 7.8 (HIGH, local) and CVE-2026-102489 9.8 (CRITICAL) on NVD. The 6 October article’s statement that NVD gave both 9.8 is now out of date for 102490. The 8.5 shown in that article is DIVD’s score, a different version and assessor.

The headline and opening of the 6 October article still say that no fix exists. Read that article together with this update.

Atlassian Data Center products, CVE-2026-21589 (CVSS v4.0: 9.3 CRITICAL, Atlassian’s score): not in KEV, and CISA rates it "poc"

Atlassian’s advisory is still as last modified on 5 October. NVD’s analysis was Awaiting Analysis on 11 October, and the catalogue version dated 8 October does not list it.
The update is CISA’s assessment. NVD carries an SSVC rating (a framework for prioritising vulnerabilities) from CISA: exploitation "poc", automatable "no", technical impact "total". "poc" means a proof of concept is public or similar, and it is not "active", which would mean exploitation is confirmed. The 7 October article said I could find no material on whether attack code exists; this rating goes further than what I could confirm then.
What to do has not changed. Update to a fixed version, and if you cannot, use the official temporary measures such as a WAF rule to block URLs containing "..".

ProFTPD CVE-2015-3306 and four other old flaws (CVSS v3.1: 10.0 CRITICAL, CISA-ADP): the deadline is today, but it applies to US federal agencies

All five were added to the catalogue on 8 October with a due date of 11 October (today). That date is for US federal agencies; Japanese businesses have no legal deadline. But if an old version with confirmed exploitation is still on your servers, it is dangerous regardless of the date.
The update is NVD’s status: CVE-2015-3306 now shows analysis complete when re-checked on 11 October (NIST itself scores it CVSS v2.0 10.0). Together with the CISA v3.1 10.0 shown in the article, the numbers have not changed.
Today, take stock of whether old ProFTPD, Struts, BIND, Strapi or ONLYOFFICE Docs are still running.

This week’s quiz: four questions

If you read this week’s articles you should spot all four. Try the first two with your family and the last two with colleagues.

This week’s articles

Three lines to forward to your family

• ▸If you are told "press 1", "buy from this button", "a deposit is required" or "send the money first", stop right there. This week’s five tactics each had one place to stop.
• ▸After a data-breach notice, the calls, emails and SMS that follow are the most dangerous. Do not use their links or numbers; check with an official contact you looked up yourself (Daiwa Securities and Citizen Watch announced a possible leak from the same contractor).
• ▸If in doubt, ask for advice yourself, not through a number the other side gave you. In Japan: the police advice line #9110, and for payments and contracts consumer hotline 188 (no area code).

Where to get help

If you realise something has gone wrong, working through it calmly and in order is enough. There is nothing to be ashamed of.

Paid money, or stuck with a bill — consumer hotline 188 (no area code; Japan only)
Possible fraud or crime, or unsure whom to ask — police advice line #9110 (Japan only)
Account taken over, or you opened something suspicious — the emergency guides by symptom below have steps for each.