Weekly Online Safety Recap (19-24 Oct): Five Places to Stop and a Four-Question Quiz

Hello! Shemihaza here, your Sentinel. Let us look back over the week of 19 to 24 October 2026.

Online safety this week: five places to stop

19 Oct: Scam calls to a parent's phone | the police-recommended app is free and has 2.21 million downloads, yet some calls give no warning

This is based on the National Police Agency's provisional figures on special fraud up to the end of August 2026, published on 2 October 2026. Recognised cases were 29,687 (+14.4% year on year) and losses about 236.07 billion yen (+33.2%). The same document gives 2,214,500 cumulative downloads of the police-recommended app.
How many losses the app actually prevented is not stated in the Agency's material (only download counts).
So install the app on your parent's phone, and hang up when money, cards or PINs come up even if there is no warning. If unsure, call #9110 (Japan).

20 Oct: Amid repeated data leaks | an email with your name on it is not necessarily real

This is based on the page the National Cybersecurity Office published on 14 October 2026 gathering the alerts of nine agencies (each issued between 7 and 13 October). In its September report of 19 October, the Council of Anti-Phishing Japan says it has confirmed phishing emails that carry the recipient's name, while stating that their link to the individual leaks is unknown.
Whether those names came from information stolen in these leaks cannot be told from the published material.
So do not assume "the name is right, so it is real". Do not press the link; check through the official app or a site you open yourself.

21 Oct: An automated voice "from the bank" calls your company | "your PC environment needs updating" is a scam

This is based on the joint investigation with Vietnam that the National Police Agency announced on 13 October 2026 (seven suspects arrested in Vietnam). The Agency also writes that from May 2026 damage from a new method that has victims install remote-control software rose sharply.
Case counts and amounts for July 2026 onward were not in the published material I could find (the half-year report ends in June).
So do not press any number. Hang up, then call the bank's branch or main number yourself.

23 Oct: A week of big updates | do not open an "update now" notice

This is based on the monthly report for September that the Council of Anti-Phishing Japan published on 19 October 2026. It says emails that pose as app updates or application procedures and lead to malicious apps have increased sharply.
I could not find a public-body report of fake notices actually riding on this week's Chrome and other updates. "Big-update periods are easier to piggyback on" is our own view.
So update from Settings or the official store, not from links in emails, SMS or pop-ups. If a certificate error appears, do not proceed; close it.

24 Oct: A "Final Notice" postcard | do not contact it; ignore it

This is based on the warning the National Consumer Affairs Center of Japan published on 20 October 2026 about fake postcards in its name. They say a lawsuit was filed and that wages or property may be seized, to stir up anxiety, but the Center states it never sends such postcards.
How many arrived, and whether anyone was harmed, is not stated on the page.
So do not contact the number on the postcard; ignore it. If worried, call consumer hotline 188 (Japan).

For engineers: this week's security alerts (with updates as of 25 October)

We covered five. CISA's KEV (its catalog of known exploited vulnerabilities) lists three of them: BeyondTrust, Fortinet and SiteGuard. The two PHP CVEs are not listed (checked against the catalog version of 23 October 2026, 1,756 entries, for every CVE in the articles). In CISA's assessment (SSVC) recorded in the NVD, three are "active" for exploitation and the two PHP CVEs are "none" (re-checked on 25 October 2026). All five show "Analyzed" in the NVD.
But not being on KEV is not proof that something is not being exploited. Also, we did not re-check each product's fixed versions or mitigations for this recap. For the actions, see each article.

[Urgent] BeyondTrust Remote Support CVE-2026-102764 (CVSS v4.0: 9.3 CRITICAL) - exploited since late August, added to KEV on 16 October

The NVD status is "Analyzed". In addition to the v4.0 9.3 shown in the article, NIST has assigned CVSS v3.1 9.8 (CRITICAL). CISA's assessment is exploitation active, automatable yes, technical impact total.
The action is unchanged. Apply patch BT26-05-RS, and examine self-operated appliances as if compromised.

[Urgent] Fortinet FortiOS, FortiProxy and others CVE-2025-61624 (CVSS v3.1: 6.5 MEDIUM) - exploitation confirmed, added to KEV on 16 October

The NVD status is "Analyzed". The 6.5 shown in the article is NIST's v3.1 value; Fortinet itself rates it 6.0 (MEDIUM). CISA's assessment is exploitation active, automatable no, technical impact total.
The action is unchanged. Update FortiOS 7.6 to 7.6.5 or later and 7.4 to 7.4.10 or later.

[Urgent] SiteGuard Server Edition CVE-2026-106931 (CVSS v4.0: 8.5 HIGH, rated by JPCERT/CC) - exploitation confirmed, added to KEV on 20 October

The NVD status is "Analyzed", last modified 21 October. Only JPCERT/CC has rated it (8.5 on v4.0, 7.8 on v3.0); NIST has not added a score. CISA's assessment is exploitation active, automatable no, technical impact total.
The action is unchanged. Update to Ver8.00 Update5. Updating may erase traces of an attack, so save the diagnostic information first.

[Urgent] PHP CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0: 9.2 each) - not on KEV, NVD analyzed

They are not on KEV, even in the catalog version of 23 October. CISA's assessment for both is exploitation none, automatable no, technical impact total. In the NVD, NIST has assigned CVSS v3.1 9.8 (CRITICAL) to CVE-2026-109618 and 8.1 (HIGH) to CVE-2026-109619. The v4.0 9.2 is the value from PHP's own security team; the versions differ, so different numbers are not a contradiction.
The action is unchanged. Update to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.

This week's quiz: four questions to test yourself

If you read this week's articles, you can spot these. Try the first three with your family and the last one with colleagues.

This week's articles

Three lines to forward to your family

• ▸If you hear "money", "press a number", "update now" or "contact us or we seize your property", stop right there. This week's five tactics each had one place to stop.
• ▸On a call, an email or a postcard, do not use the number or link the other side gave you; open the official source yourself. For a bank, call its main number yourself.
• ▸If in doubt, do not decide alone; ask for advice yourself. In Japan: the police advice line #9110, and for payments and contracts consumer hotline 188 (no area code). (#9110 and 188 are Japanese domestic numbers.)

Where to get help

If you realise something has gone wrong, working through it calmly and in order is enough. There is nothing to be ashamed of.

Paid money, or stuck with a bill — consumer hotline 188 (no area code; Japan only)
Possible fraud or crime, or unsure whom to ask — police advice line #9110 (Japan only)
Account taken over, or you opened something suspicious — the emergency guides by symptom below have steps for each.