Weekly Online Safety Recap (12-17 Oct): Five Places to Stop and a Four-Question Quiz

Hello! Shemihaza here, your Sentinel. Let us look back over the week of 12 to 17 October 2026.

Online safety this week: five places to stop

12 Oct: "Free trial" from a social-media ad | 1,457 personal-training consultations in FY2025; take it home even if told "today only"

This is based on the warning the National Consumer Affairs Center of Japan published on 7 October 2026. On personal-training contract trouble, there were 1,457 consultations in fiscal 2025. It lists cases where related products and services, such as slimming treatments, were pushed until the bill became large.
This is not about training itself; the problem is how contracts are made (our addition).
So even if told "sign today for a discount", do not decide on the spot. Take it home. Check the total price, the term, automatic renewal and how cancellation is settled first. If unsure, call consumer hotline 188 (Japan).

14 Oct: An unexplained deposit | Even if a caller says "return it", do not refund or forward it

We could not find a public warning that describes this exact tactic in the pages of the National Police Agency, the Financial Services Agency, the National Consumer Affairs Center or major banks. So the article separates what was confirmed from what was not. What was confirmed: from 10 July 2026 the NPA began penalties for "remittance offenses", which make people send other people's money to another account, and Japan Post Bank has warned about calls that demand a transfer on the pretext of freezing your account.
So do not touch an unexplained deposit, and do not refund or forward it on a caller's instructions. Contact your bank yourself, using the number on your passbook or card.

15 Oct: Fake email | Do not press the link in "please confirm your payment method"

This is based on NPA Cyber Bureau Letter Vol.20, "Beware of phishing emails!", issued on 15 October 2026. The NPA writes that fake emails sent to leaked email addresses can lead to further leaks and financial harm, and gives three measures (do not click links casually, do not reuse IDs and passwords, use multi-factor authentication such as passkeys). The same day it announced a takedown of phishing criminal infrastructure with Microsoft and JC3 (a suit filed on 6 October, a court order on 8 October).
Whether this takedown will reduce the fake emails that reach Japan is not stated in the NPA material.
So do not press links in email; open the site yourself from a bookmark or the official app.

16 Oct: A QR code in a letter | A fake envelope in the name of the "Metropolitan Police Lost Property Center"

This is based on a warning the Tokyo Metropolitan Police posted on its official X account on 8 October 2026. It describes letters posing as the Lost Property Center that make you scan a QR code, lead you to a fake site and have you enter personal data such as your My Number. It gives two ways to tell: a genuine letter has a stamp, and the contact line does not list a mobile phone number.
How many letters arrived and whether anyone was harmed is not in the police post.
So do not scan the QR code, do not call the number printed, and ask your nearest police station. If unsure, call #9110 (Japan).

17 Oct: Fake-president fraud | Do not follow "make a LINE group and send back the QR code"

This is based on the NPA report on the cyber threat situation in the first half of 2026, published on 10 September 2026. Fake-president fraud was 127 cases and about 3.88 billion yen in losses from January to June 2026, about 31 million yen per completed case. The emails arrive at company addresses that are public on the internet.
The industries and sizes of the targeted companies, and how the criminals got the president's name, are not in the published material.
So do not reply, do not create the group, and check with the president by phone or another channel.

For engineers: this week's security alerts (with updates as of 19 October)

We covered five. CISA's KEV (its catalog of known exploited vulnerabilities) lists three of them: Windows, Cisco and PAN-OS. Movable Type and Apache are not listed (checked against the catalog version of 16 October 2026 for every CVE in the articles). In CISA's assessment (SSVC) recorded in the NVD, three are "active" for exploitation and Movable Type and Apache are "none" (re-checked on 19 October 2026).
But not being on KEV is not proof that something is not being exploited. Also, we did not re-check each product's fixed versions or mitigations for this recap. For the actions, see each article.

[Urgent] Movable Type CVE-2026-96408 (CVSS v4.0: 9.3 CRITICAL, JPCERT/CC rating) — not on KEV; NVD still awaiting analysis

What changed since the 12 October article is the NVD status. Re-checking on 19 October, the NVD still shows "Awaiting Analysis" and NIST has not added its own rating. The v4.0 9.3 shown in the article is the value JPCERT/CC supplied to the NVD. CISA's assessment is exploitation none, automatable yes, technical impact total.
The action is unchanged. Update to 9.3.0 / 9.0.10 / 8.8.6 / 8.0.13, or, if you cannot, block mt-upgrade.cgi, mt-search.cgi and mt-ftsearch.cgi with the official mitigation.

[Urgent] Apache HTTP Server CVE-2026-57941 and 19 more (CVSS v3.1: 9.8, CISA rating; Apache itself says "moderate") — not on KEV

It is not on KEV in the 16 October catalog either. The NVD status is "Analyzed", and CISA gives CVE-2026-57941, 56154 and 59797 a CVSS v3.1 score of 9.8 (CRITICAL). CISA's assessment is exploitation none, automatable yes. Apache itself rates the 20 as 5 "moderate" and 15 "low" (as in the 13 October article).
The action is unchanged. Update 2.4.68 and earlier to 2.4.69; for the Apache that ships with your OS, check your distribution's fix status, not the version number.

[Urgent] Windows CVE-2026-96951 (CVSS v3.1: 8.8 HIGH, Microsoft rating) — exploited; NVD moved from "undergoing analysis" to "analyzed"

The 14 October article said the NVD status was "Undergoing Analysis". Re-checking on 19 October it is "Analyzed", last modified on 16 October. The v3.1 8.8 is still Microsoft's value. It remains on KEV, added on 13 October, and CISA's assessment is exploitation active, automatable no, technical impact total.
The action is unchanged. Apply October's Windows Update, and check by another channel with the sender before opening a file that arrived by email or chat.

[Urgent] Cisco Secure Email Gateway CVE-2026-76519 (CVSS v3.1: 9.8 CRITICAL, Cisco rating) — exploited; NVD analyzed

It remains on KEV, added on 14 October. The NVD became "Analyzed" in its 15 October update. The v3.1 9.8 is Cisco's value, and CISA's assessment is exploitation active, automatable yes, technical impact total.
The action is unchanged. Update Content Scanner Tools to 25.3.0.5525 or later. There is no workaround.

[Urgent] Palo Alto Networks PAN-OS CVE-2026-0322 (CVSS v4.0: 8.6 HIGH, Palo Alto rating) — exploited; NIST gives v3.1 7.2

It remains on KEV, added on 14 October, and the NVD became "Analyzed" on 15 October. The v4.0 8.6 in the article is the value from the CNA, Palo Alto Networks, and NIST itself gives CVSS v3.1 7.2 (HIGH). The numbers differ because the versions differ; that is not a contradiction. CISA's assessment is exploitation active, automatable no, technical impact total.
The action is unchanged. Restrict the management interface to trusted internal IPs and update to the fixed version for your release.

This week's quiz: four questions to test yourself

If you read this week's articles, you can spot these. Try the first two with your family and the last two with colleagues.

This week's articles

Three lines to forward to your family

• ▸If you are told "today only", "send it back", "press this link" or "send back the QR code", stop right there. This week's five tactics each had one place to stop.
• ▸Do not use the QR code in a letter or the link in an email; open the official site yourself to check. The Tokyo Metropolitan Police says a genuine letter always has a stamp and does not list a mobile phone number as the contact.
• ▸If in doubt, ask for advice yourself, not through a number the other side gave you. In Japan: the police advice line #9110, and for payments and contracts consumer hotline 188 (no area code). (#9110 and 188 are Japanese domestic numbers.)

Where to get help

If you realise something has gone wrong, working through it calmly and in order is enough. There is nothing to be ashamed of.

Paid money, or stuck with a bill — consumer hotline 188 (no area code; Japan only)
Possible fraud or crime, or unsure whom to ask — police advice line #9110 (Japan only)
Account taken over, or you opened something suspicious — the emergency guides by symptom below have steps for each.