Weekly Online Safety Recap (26-31 Oct): Five Places to Stop and a Four-Question Quiz

Hello! Shemihaza here, your Sentinel. Let us look back over the week of 26 to 31 October 2026.

Online safety this week: five places to stop

26 Oct: You installed an app from a "points" or "refund" link | Do not allow "Accessibility"

The topic was "Financial losses from installing fake apps", published by JC3 (Japan Cybercrime Control Center) on 15 October 2026. Emails promising points or refunds, and social media ads for apps with an "18+" tag, lead people to install a fake app that lets the criminal control the phone remotely and steal money.
JC3 does not publish the number of victims or the amount lost.
So do not install apps from links, and stop before allowing high permissions such as "Accessibility". If you already installed one, delete it right away and contact the police.

27 Oct: A warning sound and a phone number appear on your PC | Do not call; hold the ESC key

The topic was IPA's consultation statistics for July to September, published on 23 October 2026. Of 3,369 consultations in total, 1,160 (34.4%) were "fake virus detection warnings", the largest category. That is down from 1,428 in April to June, but about 1.8 times the 647 of the same period a year earlier (our calculation).
These are consultation counts, not the number of victims or the amount lost.
So do not call the number on the screen; hold the ESC key to close it. If the screen is merely showing, your PC is not infected (IPA).

29 Oct: A celebrity-backed investment group invites you | A personal account as the payee means a scam

The topic was the National Consumer Affairs Center of Japan warning of 1 September and the National Police Agency's provisional end-of-August figures of 2 October. The police figures show 7,097 cases of social-media investment fraud and ¥93.74 billion in losses. The Center says genuine stock or forex trading never asks you to send investment money to a personal account.
The figures are provisional and may change.
So stop the moment the payee is a personal account. Even if you are told fees or taxes must be paid first to withdraw, do not pay more.

30 Oct: Seafood arrives cash on delivery after you refused it | Refuse the parcel and do not pay

The topic was the National Consumer Affairs Center of Japan warning of 28 October 2026 about telephone sales of seafood and unsolicited shipments. It says consultations tend to rise toward the end of the year and that contracting people aged 70 and over stand out.
This recap does not re-check the detailed counts used in the 30 October article against the Center's page. See that article for the figures.
So if it arrives cash on delivery after you refused, explain to the courier, refuse the parcel and do not pay. Note the sender's name and address, and call the Consumer Hotline 188 if unsure.

31 Oct: A "missed delivery" SMS arrives | Do not tap the URL; check in the official app or order history

The topic was Yamato Holdings' notice of 14 August 2026 about suspicious calls, and the Council of Anti-Phishing Japan's monthly report for September, published on 19 October. The Council says reports of SMS-based phishing are down, but it still received courier-style messages in September.
The number of courier-style SMS alone cannot be read from the report. The September total of 94,661 reports covers email, SMS and other channels combined.
So do not tap the URL in the SMS; check the parcel in the official app or your order history. If a robocall from a number starting with "+" asks you to press 1, do not press it; hang up.

For engineers: this week's security alerts (with updates as of 1 November)

We covered five CVEs in four articles. All five are in CISA's KEV (Known Exploited Vulnerabilities catalog) (checked against the catalog version of 30 October 2026, 1,766 entries). In CISA's assessment (SSVC), all five show exploitation as "active" and technical impact as "total".
The NVD status was "Analyzed" for Collabora and Fragnesia, "Undergoing Analysis" for the two PHP CVEs, and "Modified" for GitLab (re-checked on 1 November).
This recap does not re-check each product's fixed versions or mitigations. See each article for the steps. The 26 October guide covers how to check your PHP version.

[Urgent] Nextcloud "Collabora Online - Built-in CODE Server" CVE-2026-110447 (CVSS v4.0: 9.2 CRITICAL): added to KEV on 23 October

The NVD assessment has changed since the 26 October article. That article said NVD had not yet added its own score as of the 24 October update (Deferred), but the status is now "Analyzed", and NIST shows CVSS v3.1 9.8 (CRITICAL) (updated 30 October). The v4.0 score of 9.2 shown in the article is the one from the assigning side (MITRE). CISA's assessment lists automatable as yes.
The action is unchanged. Update richdocumentscode to 26.4.303 or later, or remove the app. Disabling it is not enough.

[Urgent] PHP CVE-2026-109618 and CVE-2026-109619 (two CVSS v4.0 9.2 scores): added to KEV on 26 October

The NVD status has changed from "Analyzed" to "Undergoing Analysis" (updated 30 October). The 27 October article said it was "Analyzed" on 26 October. The NVD page does not show why the status went back. NIST's CVSS v3.1 scores are still listed: 9.8 (CRITICAL) for CVE-2026-109618 and 8.1 (HIGH) for CVE-2026-109619. The v4.0 score of 9.2 is from the CNA, the PHP Group. CISA's assessment lists automatable as no for both.
The action is unchanged. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

[Urgent] Linux kernel "Fragnesia" CVE-2026-46300 (CVSS v3.1: 7.8 HIGH): added to KEV on 28 October

The NVD status is "Analyzed" and the assessment has not changed. NIST, Red Hat and CVE.org all list 7.8 (HIGH) under v3.1. CISA's assessment lists automatable as no.
The action is unchanged. Install your distribution's kernel update and reboot. On servers that run PHP, update both PHP and the kernel (from the 29 October article; CISA's KEV description mentions an attack that chains the two).

[Urgent] GitLab CVE-2026-97229 (CVSS v3.1: 10.0 CRITICAL): added to KEV on 29 October

The NVD status is "Modified", last updated on 31 October. NIST has not added its own score yet. The only score listed is GitLab's own (CNA) v3.1 10.0. CISA's assessment lists automatable as yes. The due date for US federal civilian agencies is 1 November.
The action is unchanged. If you run GitLab yourself (self-managed), update to the latest patch release. The 12 October release is not enough (a different CVE of the same kind, CVE-2026-110264, was fixed on 21 October).

Spot-the-scam quiz: four questions

If you read this week's articles, you should be able to spot these. Try the first three with your family and the last one with your colleagues.

This week's articles

Three lines to send to your family

• ▸When you hear "call this number", "pay into a personal account", "pay on delivery", "tap the URL" or "allow high permissions", stop for a moment. This week's five tricks each had one place to stop.
• ▸Do not use the number on the screen, the URL in the SMS or the sender's contact on a parcel; open the official source yourself. A fake PC warning closes when you hold the ESC key.
• ▸If unsure, do not decide alone; ask someone. Police consultation line #9110; for payment or contract trouble, the Consumer Hotline 188 (no area code). (#9110 and 188 are numbers in Japan.)

If something went wrong

If you think "oh no!", stay calm and work through it step by step. There is nothing to be ashamed of.

You paid money or are in trouble over a bill → Consumer Hotline 188 (no area code, Japan)
It may be fraud or a crime, or you do not know where to ask → Police consultation line #9110 (Japan)
Your account was taken over or you opened something suspicious → The "Victim-specific emergency guide" below has step-by-step help by symptom.