Weekly Online Safety Recap (9-14 Nov): Five Ways to Check and a Four-Question Quiz

Hello! Shemihaza here, your Sentinel. Let us look back over the week of 9 to 14 November 2026.

Online safety this week: five ways to check

9 Nov: Invited to a "high pay, paid the same day, clean job" | Say no, even if a friend refers you or it is "just once"

This is based on the National Police Agency's warning about so-called "dark part-time jobs" and its case collection. The NPA explains that posts on social media and bulletin boards recruit people to commit crimes, hint at remarkably high pay and do not say what the work is. The case collection shows that in 2025, about 60% of the minors who became money collectors in special fraud had been introduced through an acquaintance.
That "about 60%" is a figure for minors who became money collectors in special fraud, not the share of all people who respond to dark jobs.
So when you are offered a job described as "high pay", "paid the same day" or "clean" and you are not told what it is, do not apply or reply; say no even if a friend refers you or it is "just once". If you have already applied, even if you are being threatened, call the police consultation line #9110 or a police station. The NPA says the police will protect the person who consults them and their family.

10 Nov: A "bargain site" found by search | Re-enter through the official site or app

This is based on statistics for the first half of 2026 that JC3 (Japan Cybercrime Control Center) published on 29 July 2026. 9,224 malicious shopping sites were reported. The most common way people found the site was "internet search results", and the most common payment method was "bank transfer" (credit card and QR-code payment drew about as many answers).
These figures are the number of reports, not the amount lost or the number of victims.
So do not buy from a bargain site you found by search. Re-enter through the official site or app, and check the company name, address and contact details. If it takes bank transfer only, stop for a moment (our recommendation).

12 Nov: You called a firm from an ad saying "toilet repair from 3,300 yen" | Get a written estimate first, and do not pay on the spot

This is based on issue 557 of the "Mimamori Shinsen Joho" that Japan's National Consumer Affairs Center issued on 12 November 2026. A person in their 70s found a site saying "toilet trouble from 3,300 yen" and asked for a repair. During the work the price rose, and in the end they were told 400,000 yen. When they said they could not pay, it was reduced to 200,000 yen, and after the work they were billed 200,000 yen and told to withdraw cash at a convenience-store ATM, which they did.
This is a single consultation case that the Center presented.
So the "from X yen" in an ad is not an upper limit. Ask for a written estimate before the work, stop if the price rises during it, and do not pay a bill you do not accept on the spot. The Center advises you to show that you are willing to pay an amount you agree to later, while clearly refusing to pay on the spot.

13 Nov: An email says "pay in bitcoin" or it gets spread | Do not pay or reply; delete it

This is based on IPA's (Information-technology Promotion Agency, Japan) consultation report for July to September 2026, published on 23 October 2026. There were 19 consultations about threatening emails saying "we filmed you watching adult sites; pay in bitcoin or we will spread it". IPA writes, "we have not confirmed any consultation in which someone paid money in cryptocurrency."
IPA's page says in its text that consultations about this trick rose about 36.7% from the previous quarter, but the trend figures on the same page (30 in April to June, 19 in July to September) show a decrease. Because they conflict, this recap does not state a rise or fall.
So do not pay or reply; delete it. If the email shows a password, check whether you still use it, and if you do, change the password at that service.

14 Nov: Someone from social media or a dating app says "let us invest" or "send travel money" | If you have never met, do not send money; ask the police

This is based on the National Police Agency's statistics for the end of September 2026 (January to September, provisional), published on 11 November 2026. SNS-type romance fraud was 4,005 cases and 36.65 billion yen, about the same level as a year earlier (10 fewer cases, 0.89 billion yen less). The NPA explains it as fraud in which you meet someone through social media or a dating app, are made to feel romantic feelings or closeness without ever meeting in person, and are tricked out of money.
The figures are provisional, and "about 9.15 million yen per case" is our own division (the NPA does not state an average).
So if someone you have never met says "let us invest for our future" or "send me travel money", consult the police before you pay. Seeing a face on a video call does not prove who it is.

For engineers: this week's security alerts (with updates as of 15 November)

We covered four CVEs (four articles). All four are in CISA's KEV (the catalog of vulnerabilities known to be exploited) (checked against the 13 November 2026 catalog, 1,781 entries). In CISA's assessment (SSVC), exploitation is "active" and automatable is "no" for all four. Technical impact is "total" for OpenSSH and Chromium and "partial" for SonicOS and Outlook.
In NVD, all four are "Analyzed" (re-fetched on 15 November). However, none of the four has a score from NIST itself. The scores NVD shows are from CISA-ADP (SonicOS and Chromium) and from the CVE-listing side (cve@mitre.org for OpenSSH, Microsoft for Outlook).
We have not re-checked each product's fixed versions or mitigations in this recap. Please read each article for what to do.

[Urgent] SonicWall SonicOS CVE-2026-19868 (CVSS v3.1: 7.5 HIGH): added to KEV on 6 November

The NVD status had changed from "Undergoing Analysis" to "Analyzed" (updated 9 November). There is still no score from NIST itself. What is listed is CISA-ADP's v3.1 score of 7.5. In CISA's assessment, automatable is no and technical impact is partial. The remediation due date is 20 November.
The CVE record that SonicWall registered was still at its 7 November update (re-fetched on 15 November). The affected versions are recorded as "7.3.3-7015 and older" and "8.2.2-8015 and older". Because we did not re-fetch the text of SonicWall's advisory this time, we cannot confirm whether the disagreement with the Canadian government advisory (AV26-1133) over 8.2.2-8015 has been resolved. If you run 8.2.2-8015, treat it as affected, as the article says.

[Urgent] OpenSSH CVE-2026-123158 (CVSS v3.1: 8.1 HIGH): added to KEV on 9 November

The NVD status is "Analyzed", last updated 10 November. There is still no score from NIST itself. What is listed is the v3.1 score of 8.1 from the CVE-listing side (cve@mitre.org). In CISA's assessment, automatable is no and technical impact is total. The remediation due date was 12 November and has passed (it is a deadline for US federal civilian agencies).
As the article says, it affects sshd on Linux that uses musl libc and runs without PAM (such as Alpine Linux). The fixed version is OpenSSH 10.6p2. An update alone does not replace a running sshd, so the fix is complete only after a restart.

[Urgent] Google Chrome (Chromium) CVE-2026-125350 (CVSS v3.1: 8.8 HIGH): added to KEV on 10 November

The NVD status is "Analyzed", last updated 11 November. There is still no score from NIST itself. What is listed is CISA-ADP's v3.1 score of 8.8. In CISA's assessment, automatable is no and technical impact is total. The remediation due date is 24 November.
NVD gives the affected Chrome as "before 157.0.8103.50", but Google's 9 November Extended Stable post says 156.0.8078.96 includes the fix. The fixed versions are 157.0.8103.50 or later for regular Stable and 156.0.8078.96 or later for Extended Stable (Windows and Mac). After updating, restart the browser.

[Urgent] Microsoft Outlook CVE-2026-124194 (CVSS v3.1: 6.5 MEDIUM): added to KEV on 10 November

The NVD status is "Analyzed", last updated 11 November. There is still no score from NIST itself. What is listed is Microsoft's v3.1 score of 6.5 (MEDIUM). In CISA's assessment, automatable is no and technical impact is partial. The remediation due date is 24 November.
Even with a medium score, exploitation has been confirmed. As the article says, install the 10 November Office update and restart Outlook.

Spot-the-scam quiz: four questions

If you read this week's articles, you should be able to spot the answers. Try the first three with your family and the last one with a work colleague.

This week's articles

Three lines to send to your family

• ▸When you hear "apply", "we will start before the estimate", "pay in bitcoin" or "let us invest", stop for a moment. Each of this week's five tricks could be avoided by not going along with the other side's hurry or the other side's price.
• ▸Before you pay, check for yourself. Say no to a high-pay job. Re-enter a bargain site through the official site or app. Get a written estimate before a repair. Do not send money to someone you have never met.
• ▸If unsure, do not decide alone; ask someone. Police consultation line #9110; for payment or contract trouble, the Consumer Hotline 188 (no area code). (#9110 and 188 are numbers in Japan.)

If something went wrong

If you think "oh no!", stay calm and work through it step by step. There is nothing to be ashamed of.

You paid money or are in trouble over a bill → Consumer Hotline 188 (no area code, Japan)
It may be fraud or a crime, or you do not know where to ask → Police consultation line #9110 (Japan)
Your account was taken over or you opened something suspicious → The "Victim-specific emergency guide" below has step-by-step help by symptom.