Weekly Online Safety Recap (2-7 Nov): Five Ways to Check and a Four-Question Quiz

Hello! Shemihaza here, your Sentinel. Let us look back over the week of 2 to 7 November 2026.

Online safety this week: five ways to check

2 Nov: A law-firm "settlement letter" or "opinion inquiry" arrives | Do not ignore it; ask who used the PC, then call 188

Japan's National Consumer Affairs Center published its "Mimamori Shinsen Joho" issue 555 on 29 October 2026. It describes a person in their 60s who, after using file-sharing software, first received an "opinion inquiry" from the internet provider and then a "settlement letter" in the name of a law firm. The PC was shared by the family. The Center explains that downloading with such software can upload the same file without you noticing.
This stage does not tell you whether the letter is genuine or whether you owe anything.
So do not ignore it: ask your family who used the PC, and ask the Consumer Hotline 188 or a similar service before you promise to pay or make contact. Letters go to the contract holder, so even if you have no memory of it, someone in the family may have used the PC.

3 Nov: An email or text claims to be Amazon | Do not open the link; check in the official app or your own bookmark

The Council of Anti-Phishing Japan published its September report on 19 October 2026. Of the 94,661 phishing reports it received, about 33.2% imitated Amazon, and the trend is rising. Fake emails that contain the recipient's name have also been seen; the Council says any link to specific data breaches is unknown.
These figures are reports received by the Council, not the total number of fake emails sent.
So do not open links in emails or texts: open the official app or your own bookmark and check there. A correct name is no proof that a message is real.

5 Nov: Someone you met on social media or in a game asks for a photo | Do not send one; if your child tells you, listen without blame

Japan's National Police Agency published the final 2025 figures. 1,566 children were victims of offences originating on social media, 80 more (5.4%) than the year before. Junior high school students were 758 (48.4%); elementary school children were 167, up 31 (22.8%).
These figures count child victims in cases that were cleared by police, not all children who were harmed.
So do not take or send photos in underwear or naked. If a child tells you something has happened, listen without blame, keep the screens of the exchange, and ask the police (#9110 or the nearest police station).

6 Nov: The police say "the account you paid was used in fraud" | Do not call back the number they gave

On 5 November 2026 Japan's National Police Agency announced that its "information-sharing cooperation" with 30 financial institutions will run nationwide from 9 November. The aim is to find people who paid into accounts used for fraud, and for the police to contact them. For January to September 2026, special fraud (provisional) was 33,329 cases and ¥261.04 billion.
The material does not say how the police will make contact. The figures are provisional and may change.
So if someone claims to be the police, do not call back the number they gave: check with a police station number you looked up yourself, or the police consultation line #9110. The Agency says the police do not tell you by phone that you are under investigation, and do not ask you to move money.

7 Nov: Given a "police website" URL and number | Do not open it, type nothing, hang up

Japan's National Police Agency publishes a page on the trick of leading people to fake police websites. In the published case, the victim was given a URL and a receipt number on a video call; the URL led to a fake site showing "Metropolitan Police Department", and typing the receipt number showed a document that looked like an arrest warrant.
A news report on 31 October said a fake site imitating the Agency's own website had been confirmed. We could not confirm an announcement from the Agency itself, so this recap does not use the report's counts or amounts. See the 7 November article for details.
So if you are sent a "police website" URL, do not open it, do not type anything, and hang up the call or video call. The Agency says the police do not show a police notebook on a video call to interrogate you, and do not send an image of an arrest warrant over social media.

For engineers: this week's security alerts (with updates as of 8 November)

We covered six CVEs in five articles. All six are in CISA's KEV (Known Exploited Vulnerabilities catalog) (checked against the catalog version of 6 November 2026, 1,769 entries). In CISA's assessment (SSVC), all six show exploitation as "active". Technical impact is "total" for Brotli, Ivanti (CVE-2026-111357) and WordPress, and "partial" for Ivanti (CVE-2026-118527), Apple and Cisco.
The NVD status is "Analyzed" for all six (re-checked on 8 November). But NIST has added its own score for only two: Brotli and Apple.
This recap does not re-check each product's fixed versions or mitigations. See each article for the steps.

[Urgent] Node.js / Brotli CVE-2026-111497 (CVSS v3.1: 9.8 CRITICAL): added to KEV on 27 October

The NVD status is "Analyzed", last updated on 6 November. NIST's CVSS v3.1 is 9.8 (CRITICAL), as in the article. Google's v4.0 score is 9.2 (CRITICAL). CISA's assessment lists automatable as no. The due date for US federal civilian agencies is 10 November.
The action is unchanged. Update to 22.23.4, 24.22.1 or 26.12.1.

[Urgent] Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 (CVSS v3.1: 7.0 HIGH / 4.3 MEDIUM): added to KEV on 30 October

The NVD status is "Analyzed" for both (updated 31 October for CVE-2026-111357 and 3 November for CVE-2026-118527). NIST has not added its own score to either. NVD lists 7.0 for CVE-2026-111357 and 4.3 for CVE-2026-118527 (both CVSS v3.1). CISA's assessment lists automatable as no for both. The due dates are 2 November for CVE-2026-111357 and 13 November for CVE-2026-118527.
The action is unchanged. The 13 October fixes (25.1.1.2 / 22.8R2.5) do not cover these, so update to 25.1.1.3 or 22.8R2.6. Do not stop at the update; also check whether you were compromised.

[Urgent] WordPress Core CVE-2026-119977 (CVSS v3.1: 8.1 HIGH): added to KEV on 3 November

The NVD status changed from "Undergoing Analysis" to "Analyzed" (updated 4 November). NIST has not added its own score yet. The score listed is v3.1 8.1 from the party that assigned the CVE (Wordfence). CISA's assessment lists automatable as no. The due date is 6 November.
The action is unchanged. Update to the fixed release for your branch (7.1.4 / 7.0.8 / 6.9.11 / 6.8.12 and so on). If you turned off auto-updates, or an update failed, check the version yourself.

[Urgent] Apple CVE-2024-27834 (CVSS v3.1: 5.5 MEDIUM): added to KEV on 4 November

The NVD status is "Analyzed", last updated on 5 November. NIST and CISA-ADP both give v3.1 5.5 (MEDIUM), as in the article. CISA's assessment lists automatable as no and technical impact as partial. The due date is 18 November.
The action is unchanged. The flaw was fixed in May 2024, so updated devices are not affected. Update any iPhone older than iOS 17.5 (for models that stop at the 16.7 line, older than 16.7.8).

[Urgent] Cisco ASA / FTD CVE-2026-76418 (CVSS v3.1: 8.6 HIGH): added to KEV on 29 October

The NVD status is "Analyzed", last updated on 30 October. NIST has not added its own score yet. The score listed is Cisco's own v3.1 8.6. CISA's assessment lists automatable as yes and technical impact as partial. The due date is 1 November.
The action is unchanged. Update to the fixed release for your branch (9.20.4.50 on the 9.20 line, for example). There is no official workaround; one mitigation is given.

Spot-the-scam quiz: four questions

If you read this week's articles, you should be able to spot these. Try the first three with your family and the last one with your colleagues.

This week's articles

Three lines to send to your family

• ▸When you hear "call this number", "open this URL", "send a photo" or "contact the sender of this letter", stop for a moment. This week's five tricks each had one place to check.
• ▸Do not use the number or URL they gave you; check through an official contact you looked up yourself. For someone claiming to be the police, use a police station number you looked up, or #9110. For someone claiming to be Amazon, use the official app or your own bookmark.
• ▸If unsure, do not decide alone; ask someone. Police consultation line #9110; for payment or contract trouble, the Consumer Hotline 188 (no area code). (#9110 and 188 are numbers in Japan.)

If something went wrong

If you think "oh no!", stay calm and work through it step by step. There is nothing to be ashamed of.

You paid money or are in trouble over a bill → Consumer Hotline 188 (no area code, Japan)
It may be fraud or a crime, or you do not know where to ask → Police consultation line #9110 (Japan)
Your account was taken over or you opened something suspicious → The "Victim-specific emergency guide" below has step-by-step help by symptom.