What to do todaySun, Nov 15

What all staff should do todayWhat employees can do today on their own computers and phones

1. Computers

   Update

   November's Windows updates include a fix for a vulnerability confirmed to be exploited

   What you should doOpen Windows Update, install the updates, and finish through the restart

   Microsoft's monthly update released on November 11 includes a fix for an Outlook spoofing vulnerability (CVE-2026-124194). Microsoft has said it is being exploited, and IPA (Information-technology Promotion Agency, Japan) is urging "urgent" application. Some updates do not take effect until you restart. If your company distributes updates, follow its instructions.

   • PrimaryIPA, "On vulnerability countermeasures for Microsoft products (November 2026)" (in Japanese)
   • PrimaryNCO (X)
2. Computers

   Update4 notices merged into 1

   Updates with security fixes are out for Chrome, Edge and Firefox

   What you should doClose the browser and reopen it to apply the update

   From November 10 to 11 (U.S. time), updates came out one after another for Chrome (desktop and Android), Edge and Firefox. All of them include security fixes. A browser update takes effect when you close and reopen it.

   • PrimaryNCO (X), Chrome for desktop
   • PrimaryNCO (X), Edge
   • PrimaryNCO (X), Firefox
   • PrimaryGoogle, "Chrome Releases"
3. Phones

   Scam

   Text messages claiming to be from the National Police Agency are spreading a fake app that hijacks phones

   What you should doDo not open links in text messages claiming to be from the National Police Agency, and install apps only from official stores

   A scheme has been found in which a text message urging people to install an app "recommended by the National Police Agency" leads them to a fake site and has them install a fake app that lets attackers control their Android phone remotely. The National Police Agency says it never introduces recommended apps through links in text messages. The same could happen on company phones.

   • PrimaryNational Police Agency, "Apps recommended by the National Police Agency" (in Japanese)
   • PrimaryTokyo Metropolitan Police Department Cyber (X)
   • PrimaryNTT Townpage notice (in Japanese)
   • Summarypiyolog (summary, in Japanese)
4. Phones

   Scam

   A scheme using social media ads to get people to install a fake TikTok app and steal phone payments is spreading

   What you should doOn Android, do not allow "unknown sources" for app installs. If an app asks for permission to share or control your screen, do not install it and delete it

   Fake apps such as "TikTok 18+" are installed via social media ads and messages, then control the phone remotely, steal payment barcodes and use them in stores. Consultations nationwide totaled about 1,600 as of the end of September. TikTok Japan says such apps have no connection to the company.

   • PrimaryTikTok Japan notice (in Japanese)
   • PrimaryOsaka Prefectural Police, "Cybersecurity Newsletter" (in Japanese)
   • Summarypiyolog (summary, in Japanese)
5. Accounts

   Breach

   Unauthorized access to the MUJI app and online store. Members' email addresses and other data may have leaked

   What you should doIf you use the same password for another service as for the MUJI online store, change the password on that service

   According to Ryohin Keikaku, the email addresses, dates of birth and genders of MUJI app members (up to about 27.26 million records) may have leaked, and the online store suffered unauthorized logins using passwords leaked elsewhere. The online store is offline, and when it reopens, the plan is to ask all members to reset their passwords. Also be wary of suspicious emails and calls claiming to be from Ryohin Keikaku or credit card companies.

   • PrimaryRyohin Keikaku (first report, in Japanese)
   • PrimaryRyohin Keikaku (fourth report, in Japanese)
   • Summarypiyolog (summary, in Japanese)

What executives should do todayDecisions about transactions, customers and business partners

1. Partner services

   Breach

   Unauthorized access to the online-shop platform "Matomaru EC Tencho." Order data of 373 companies may have leaked

   What you should doAsk IT staff whether your own online shop uses it. If it does, change the login password and warn customers about fake emails

   According to the provider, there was unauthorized access on November 1 and 6, and order data for 21,873 orders from 373 companies may have leaked. Fake refund emails that use real order data are reaching the people who placed the orders. The provider is asking shops that use it to change their passwords.

   • PrimaryMatomaru EC Tencho (first report, in Japanese)
   • PrimaryMatomaru EC Tencho (second report, in Japanese)
   • Summarypiyolog (summary, in Japanese)
2. Cloud

   Breach

   A Notion contractor was breached, and Notion AI chat records may have leaked

   What you should doIf your company uses Notion, ask IT staff to check whether Notion has sent a notice of impact

   According to Notion, the company it entrusts with AI processing (Fireworks AI) was breached in October, and Notion AI chat records kept for its analytics feature may have leaked. The impact is said to be under 1% of workspaces. Notion says no action is needed if you have not been contacted. If you pasted passwords or keys into chats, change them.

   • PrimaryNotion notice (in Japanese)
   • PrimaryFireworks AI announcement
   • Summarypiyolog (summary, in Japanese)
3. Partner services

   Breach

   Unauthorized access to the e-ticket service "teket." Purchasers' names and addresses leaked

   What you should doIf you use teket for your events, check the purchaser-list notice from teket and warn purchasers about suspicious contacts

   According to teket, members' names and email addresses, and registered members' addresses, phone numbers and dates of birth, among other data, leaked. The service has been offline since the night of November 5. teket says it never asks for passwords or card information. It says it will notify organizers individually about their purchaser lists.

   • Primaryteket notice (in Japanese)
   • Summarypiyolog (summary, in Japanese)

What IT staff should do todaySteps to apply to company systems

1. Email

   Vulnerability

   Microsoft's November updates. The Outlook spoofing vulnerability is confirmed to be exploited

   What you should doApply the November monthly updates to all devices, starting with those that use Outlook

   JPCERT/CC (Japan's organization for vulnerability notices and coordination) and IPA (Information-technology Promotion Agency, Japan) cite the Outlook vulnerability (CVE-2026-124194) that Microsoft has said is being exploited, and urge applying the update quickly. Check in the admin console, down to the number of devices, whether it has been applied.

   • PrimaryJPCERT/CC alert (in Japanese)
   • PrimaryIPA (in Japanese)
2. Your own sites and apps

   Government & police

   Japan's government issued basic countermeasures for websites and apps after a run of data leaks

   What you should doReview your own site and apps against the basic countermeasures the government set out (do not use unsupported software, apply vulnerability updates, use multi-factor authentication, check API permissions)

   On November 5, Japan's National Cybersecurity Office (NCO) published a set of countermeasures for websites and apps, saying basic measures were lacking in many of the leaks. It cites continued use of unsupported or un-updated software.

   • PrimaryCabinet Secretariat, "Countermeasures" (PDF, in Japanese)
   • PrimaryJPCERT/CC Weekly Report (in Japanese)
3. Your own sites and apps

   Vulnerability

   A vulnerability that lets headers be rewritten in "KUSANAGI" for WordPress

   What you should doIf you run WordPress on KUSANAGI, upgrade to the latest version. If you cannot upgrade right away, apply the vendor's workaround

   According to JVN, there is a vulnerability in the forwarding rules in KUSANAGI's Nginx configuration (CVE-2026-117477, medium severity). It affects all versions of KUSANAGI 7 and 8 and some versions of 9. It does not apply if you run on Apache. Exploitation has not been confirmed.

   • PrimaryJVN (in Japanese)
   • PrimaryKUSANAGI release (in Japanese)
4. Servers

   Update

   Apache web server 2.4.71, fixing multiple vulnerabilities, is out for the 2.4 series

   What you should doList the servers that run Apache HTTP Server 2.4 and plan to upgrade them to 2.4.71

   Version 2.4.71, which fixes multiple vulnerabilities, was released on November 11. JVN does not state the severity or whether they are exploited. Check the details in Apache's list.

   • PrimaryApache, "Vulnerabilities in 2.4"
   • PrimaryJVN (in Japanese)

Back issuesSelect a date to go to that day's "What to do today." The number is how many items had a to-do