Blog
News, research and threat trends, explained from published primary sources.
A kernel flaw that can turn an on-server foothold into root. CISA confirms active exploitation, including chaining with PHP2Shell. On Ubuntu, the real fix is a patched kernel and a reboot.
Published6 min read
In the attack on GMO's cloud desktop service, the attackers demanded money and published what they claim is stolen data. At So-net, 2.59 million member records and 54,000 mail passwords leaked. This week, check whether staff use either service for work, and tell them to change passwords and watch for messages that impersonate these companies.
Published6 min read
If your online shop runs on Magento or Adobe Commerce, confirm with whoever maintains it this week that the October fix (2026-oct) is actually in place, and that the separate September fix is still there too.
Published6 min read
The way in was not a software flaw but a legitimate account held by a contractor. This week, take stock of the accounts your contractors and their subcontractors hold on your systems, where they connect from, and what sits in shared storage.
Published8 min read
Version 2.20 and later are in scope when the statistics feature is on, which it is by default. Updating may erase traces of an attack, so save the diagnostic data first, then apply the fixed version or patch, and check for compromise.
Published11 min read
Almost every web server running PHP is in scope. Updating to a fixed release is the only complete fix; configuration changes and WAF rules only buy time. From what to do today to step-by-step patching and compromise checks, it is all here.
Published21 min read
Nikkei, Yamato Transport, Times Mobility and others have been disclosing large personal-data leaks almost daily. According to warnings from JPCERT/CC and NICT, attackers are mainly going after doors that can be reached from the internet.
Published5 min read
Ransomware reports to Japan's police have stayed around 200 a year for four years, and about 60% of victims are small and medium-sized companies. Most attackers got in through VPN devices and remote desktop exposed to the internet. Here is what the public data shows.
Published7 min read