Daily security
What to do todaySat, Nov 14
A week of piled-up updates. Employees should finish Windows and browser updates through the restart. Executives should ask IT staff whether any service the company uses has been breached. The global Microsoft 365 outage keeps recovering, and the 30-minute updates ended at 11:30 a.m. JST on November 14 (live page).
What this page aims for
Today, everyone reads the same content. With CITY, we aim to show only what concerns you and your company or shop, have an AI agent explain it, and let you act on it right there. That is the form this page is aiming for.
Today
Every notice laid out the same for everyone
With CITY
- 1
Only what concerns you
Only notices that hit the computers, services and business partners that you and your company or shop use
- 2
An agent tells you
An AI agent tells you, in your own words, which notices apply and what to do
- 3
Act on it right there
Work through update and settings steps with the agent, and confirm they are done
We will tell you when CITY becomes available
For companies and for individuals, we will email you as soon as we decide how to get started
You are subscribed to the newsletter
We received . We will notify this address when new films and articles are published. If the confirmation email does not arrive, please check your spam folder.
Emails are sent in Japanese. You can unsubscribe at any time. (Privacy policy)
You will also get word of new articles and videos.
Last checked11:10 p.m. JST, Nov 14/12 of 35 notices collected have a to-do for today
What all staff should do todayWhat employees can do today on their own computers and phones
- Computers
Update
November's Windows updates include a fix for a vulnerability confirmed to be exploited
What you should doOpen Windows Update, install the updates, and finish through the restart
Microsoft's monthly update released on November 11 includes a fix for an Outlook spoofing vulnerability (CVE-2026-124194). Microsoft has said it is being exploited, and IPA (Information-technology Promotion Agency, Japan) is urging "urgent" application. Some updates do not take effect until you restart. If your company distributes updates, follow its instructions.
- Computers
Update4 notices merged into 1
Updates with security fixes are out for Chrome, Edge and Firefox
What you should doClose the browser and reopen it to apply the update
From November 10 to 11 (U.S. time), updates came out one after another for Chrome (desktop and Android), Edge and Firefox. All of them include security fixes. A browser update takes effect when you close and reopen it.
- PrimaryNCO (X), Chrome for desktop
- PrimaryNCO (X), Edge
- PrimaryNCO (X), Firefox
- PrimaryGoogle, "Chrome Releases"
- Phones
Scam
Text messages claiming to be from the National Police Agency are spreading a fake app that hijacks phones
What you should doDo not open links in text messages claiming to be from the National Police Agency, and install apps only from official stores
A scheme has been found in which a text message urging people to install an app "recommended by the National Police Agency" leads them to a fake site and has them install a fake app that lets attackers control their Android phone remotely. The National Police Agency says it never introduces recommended apps through links in text messages. The same could happen on company phones.
- Phones
Scam
A scheme using social media ads to get people to install a fake TikTok app and steal phone payments is spreading
What you should doOn Android, do not allow "unknown sources" for app installs. If an app asks for permission to share or control your screen, do not install it and delete it
Fake apps such as "TikTok 18+" are installed via social media ads and messages, then control the phone remotely, steal payment barcodes and use them in stores. Consultations nationwide totaled about 1,600 as of the end of September. TikTok Japan says such apps have no connection to the company.
- Accounts
Breach
Unauthorized access to the MUJI app and online store. Members' email addresses and other data may have leaked
What you should doIf you use the same password for another service as for the MUJI online store, change the password on that service
According to Ryohin Keikaku, the email addresses, dates of birth and genders of MUJI app members (up to about 27.26 million records) may have leaked, and the online store suffered unauthorized logins using passwords leaked elsewhere. The online store is offline, and when it reopens, the plan is to ask all members to reset their passwords. Also be wary of suspicious emails and calls claiming to be from Ryohin Keikaku or credit card companies.
What executives should do todayDecisions about transactions, customers and business partners
- Partner services
Breach
Unauthorized access to the online-shop platform "Matomaru EC Tencho." Order data of 373 companies may have leaked
What you should doAsk IT staff whether your own online shop uses it. If it does, change the login password and warn customers about fake emails
According to the provider, there was unauthorized access on November 1 and 6, and order data for 21,873 orders from 373 companies may have leaked. Fake refund emails that use real order data are reaching the people who placed the orders. The provider is asking shops that use it to change their passwords.
- Cloud
Breach
A Notion contractor was breached, and Notion AI chat records may have leaked
What you should doIf your company uses Notion, ask IT staff to check whether Notion has sent a notice of impact
According to Notion, the company it entrusts with AI processing (Fireworks AI) was breached in October, and Notion AI chat records kept for its analytics feature may have leaked. The impact is said to be under 1% of workspaces. Notion says no action is needed if you have not been contacted. If you pasted passwords or keys into chats, change them.
- PrimaryNotion notice (in Japanese)
- PrimaryFireworks AI announcement
- Summarypiyolog (summary, in Japanese)
- Partner services
Breach
Unauthorized access to the e-ticket service "teket." Purchasers' names and addresses leaked
What you should doIf you use teket for your events, check the purchaser-list notice from teket and warn purchasers about suspicious contacts
According to teket, members' names and email addresses, and registered members' addresses, phone numbers and dates of birth, among other data, leaked. The service has been offline since the night of November 5. teket says it never asks for passwords or card information. It says it will notify organizers individually about their purchaser lists.
- Primaryteket notice (in Japanese)
- Summarypiyolog (summary, in Japanese)
What IT staff should do todaySteps to apply to company systems
- Email
Vulnerability
Microsoft's November updates. The Outlook spoofing vulnerability is confirmed to be exploited
What you should doApply the November monthly updates to all devices, starting with those that use Outlook
JPCERT/CC (Japan's organization for vulnerability notices and coordination) and IPA (Information-technology Promotion Agency, Japan) cite the Outlook vulnerability (CVE-2026-124194) that Microsoft has said is being exploited, and urge applying the update quickly. Check in the admin console, down to the number of devices, whether it has been applied.
- PrimaryJPCERT/CC alert (in Japanese)
- PrimaryIPA (in Japanese)
- Your own sites and apps
Government & police
Japan's government issued basic countermeasures for websites and apps after a run of data leaks
What you should doReview your own site and apps against the basic countermeasures the government set out (do not use unsupported software, apply vulnerability updates, use multi-factor authentication, check API permissions)
On November 5, Japan's National Cybersecurity Office (NCO) published a set of countermeasures for websites and apps, saying basic measures were lacking in many of the leaks. It cites continued use of unsupported or un-updated software.
- Your own sites and apps
Vulnerability
A vulnerability that lets headers be rewritten in "KUSANAGI" for WordPress
What you should doIf you run WordPress on KUSANAGI, upgrade to the latest version. If you cannot upgrade right away, apply the vendor's workaround
According to JVN, there is a vulnerability in the forwarding rules in KUSANAGI's Nginx configuration (CVE-2026-117477, medium severity). It affects all versions of KUSANAGI 7 and 8 and some versions of 9. It does not apply if you run on Apache. Exploitation has not been confirmed.
- PrimaryJVN (in Japanese)
- PrimaryKUSANAGI release (in Japanese)
- Servers
Update
Apache web server 2.4.71, fixing multiple vulnerabilities, is out for the 2.4 series
What you should doList the servers that run Apache HTTP Server 2.4 and plan to upgrade them to 2.4.71
Version 2.4.71, which fixes multiple vulnerabilities, was released on November 11. JVN does not state the severity or whether they are exploited. Check the details in Apache's list.
- PrimaryApache, "Vulnerabilities in 2.4"
- PrimaryJVN (in Japanese)
Besides the daily notices, our newsletter delivers new articles and videos, and word of when CITY becomes available.
Get Data is CITY notices by email
You are subscribed to the newsletter
We received . We will notify this address when new films and articles are published. If the confirmation email does not arrive, please check your spam folder.
Emails are sent in Japanese. You can unsubscribe at any time. (Privacy policy)
Other noticesNo to-do today, but relevant if you use them. Everything we collected, by type
Update2 items
November's Android update fixes multiple vulnerabilities
Apply it to company Android devices when it arrives (timing differs by model).
Security updates for ChromeOS and macOS (Sequoia 15.8.3 and Tahoe 26.7.3)
Apply them to Chromebooks and Macs when they arrive.
Vulnerability18 items
A vulnerability in SoftBank's "Air Terminal 6" lets commands be run from the admin screen
The fixed software has already been distributed and applies automatically if the device is connected. No action is needed from users.
A vulnerability lets files be read and written in apps that use "ImageMagick," the image-processing tool, with its default settings
If you use it for image conversion on your own site or apps, check with the CERT/CC notice.
Vulnerabilities in the Windows viewer software for the remote-control tools "TightVNC" and "UltraVNC"
If you use them to view computers remotely for support, wait for the vendors' updates and apply them.
A vulnerability in "Brotli," the data-compression library (C version) (CVE-2026-111497)
If you use products that embed it, apply each vendor's update.
A vulnerability in JetBrains' issue tracker "YouTrack" lets malicious commands be embedded in the screen
If you use it, upgrade to the latest version.
A vulnerability in "ComfyUI-Easy-Use," an extension for the image-generation tool "ComfyUI," lets files be read without authentication
If you use it for image generation inside the company, update the extension or remove it.
A vulnerability in "PromZard" lets commands be run remotely
If you use it, check the vendor's notice.
A vulnerability in Mitsubishi Electric numerical control units (machine-tool controllers) could allow them to be stopped
If you use them in a factory, check Mitsubishi Electric's notice.
U.S. CISA notices of vulnerabilities in industrial and medical devices (November 12)
Companies with factory or medical equipment should check whether their products are included.
Multiple vulnerabilities in Citrix (Cloud Software Group) "XenServer"
If you use it, apply the vendor's update.
Multiple vulnerabilities in "Puppet Server" and "OpenVox"
If you use them to manage server configuration, apply the updates.
A vulnerability in the data-integration tool "Airbyte" lets commands be run remotely
If you use it, apply the update.
Vulnerabilities in multiple Zoho "ManageEngine" products
If you use them for IT management, apply the updates.
Vulnerabilities in multiple Zyxel network products
If your company's routers or Wi-Fi equipment are Zyxel, apply the update.
Vulnerabilities in multiple Absolute Security products
If you use them for device management, apply the updates.
Vulnerabilities in multiple Elastic products
If you use them for log search and analysis, apply the updates.
Vulnerabilities in multiple Barracuda Networks products
If you use them to protect email or networks, apply the updates.
Vulnerabilities in multiple tools for PostgreSQL
If you use them to manage databases, apply the updates.
Outage2 items
Convenience-store issuance of certificates with My Number cards stopped in 408 municipalities on November 10 (recovered around 4:20 p.m. the same day)
The cause was a failure of network equipment. The Japan Agency for Local Authority Information Systems (J-LIS) says unauthorized access is unlikely.
The global Microsoft 365 outage keeps recovering, and the 30-minute updates ended at 11:30 a.m. JST on November 14
If emails have not arrived, wait a little rather than rushing to resend.
Government & police1 item
The National Police Agency urged people to stick to basic countermeasures, citing continued leaks of information
Three things: update your devices, strengthen your passwords, and do not open unfamiliar links.
How this page is made
Every morning we collect posts on X from Japan's National Cybersecurity Office (NCO) and the Tokyo Metropolitan Police Department, notices from JPCERT/CC, JVN and IPA (Information-technology Promotion Agency, Japan), and summaries from piyolog, and put at the top the items that have a to-do someone can do today for each role. Duplicate stories are merged into one, and notices with no to-do are listed under "Other notices" by type.
Data is CITY's AI agent collects and selects the items, and our editors open the sources and check them before publishing. Sources are ordered with the party that made the announcement (a vendor, a government, the police, or the company that was hit) first, marked "Primary," and summaries and news reports after.
The icon at the left of each item is the place on the company map that would light up if you had CITY.