For GMO users
The 6th report at 21 advises checking linked services such as email and Google, as well as browser sync, in addition to disconnecting all sessions. Proceed from another trusted device.
Official guidance and verified scope →AI translation. Check versions, conditions and actions against the Japanese original and primary sources.
SECURITY REVIEW · 2026-10-26 21:35 JST / 12:35 UTC
Start tonight's checks with what you use.
We reviewed account protection, malicious packages, application authentication and permissions, and updates on services in Japan. The 37 topics are organized to help you find necessary measures and primary sources.
As of: 2026-10-26 21:35 JST / 12:35 UTC. Change window: 14:56–21:35 JST.
Actual retrieval from 21:37 JST onward. Same-day follow-ups with only dates are reference items.
Quick overview: check only what you use.
For those managing development and build environments
Check the affected npm and PyPI packages and versions. If malicious versions have run, review environment isolation, revocation of keys they could access, and whether rebuilding is necessary.
Package-specific conditions and actions →For administrators of applications and public-facing services
Review Japanese PHP/Brotli alerts and the conditions affecting Frappe, MISP, SAML, NocoDB, and others. Camel may require configuration even after updating.
Japanese alerts and distributor guidance →For users of delivery and booking services
Blastmail's notice covers 345 contracts, and the resumption time remains undetermined. Even if someone knows your hotel booking details, verify payment links through official support channels.
Japanese service updates →Database and advisory updates in the window · 23 groups
Organized by database inclusion/revision and advisory update times. These are not attack start times or counts of newly occurring harm.
14:58 JST (developer advisory), 21:17 JST (NVD inclusion) · Disclosure and updates checked
Frappe Builder: SSRF in image retrieval and permissions for AI use
The developer published 3 advisories at 14:58 JST. They cover authenticated users controlling image retrieval destinations, reaching internal destinations through redirects and DNS re-resolution, and insufficient authorization for improve_prompt, which uses an AI provider key. They do not describe compromise of every server by any unauthenticated user.
What to checkCheck the requirements for Builder 1.36.1 or later and Frappe v16.36.1 or later. Review image retrieval destinations, publicly stored content, and AI usage logs. If updating is not possible, consider restricting the affected APIs and temporarily removing AI keys.
Image retrieval advisory / AI access-permission advisory / Redirect mitigation advisory
15:17 JST (NVD inclusion) · Caveats on CNA record and prerequisites
4 additional NocoDB issues: authentication processing and the role of rate limits
CVE-2026-116120–116123 are CNA records concerning resource consumption during signup and reset, signup races, differences in sign-in information, and limits on authentication attempts. The official PublicApiLimiterGuard explicitly states a design that relies on a reverse proxy or similar component for rate limiting, and the current signup processing also includes withSignupClaim. An increase in record identifiers alone does not establish that every version remains unfixed.
What to checkCheck rate limits for externally exposed signup, reset, and login endpoints, including proxy-side controls. Compare unusual signup and session revocation logs with the version in use, and treat the earliest shipped fixed version as undetermined.
CVE-2026-116120 / CVE-2026-116121 / CVE-2026-116122 / CVE-2026-116123 / Official guard code / Official registration handling
15:30 JST (GHSA publication) · Publication/update verified.
2 npm packages: mining during installation
GitHub malware advisories describe mining programs and persistence mechanisms run through postinstall in dsh-plugin-blender-3d 0.2.1 and @walknpm/todo-cli 2.0.1. Behavior differs depending on whether root access or passwordless sudo is available. This does not mean that all npm packages or Blender itself have been compromised.
What to checkCheck installation records for the affected versions. If they have run, isolate the environment, investigate persistence, external communications, and access to credentials, and revoke any necessary keys from a safe environment.
GitHub malware advisory / GitHub malware advisory / OpenSSF original record
15:37:47 JST (page update metadata) · Publication/update confirmed
Hotel Tavinos: beware of payment links even from someone who knows your booking
Suspicious messages affected some bookings at the 3 Hamamatsucho, Asakusa, and Kyoto properties that met both conditions: made by 9/21 and with a stay date on or after 9/21. The notice explains that booking information may have been viewed and obtained through TEMAIRAZU. It does not confirm disclosure of all bookings or a new intrusion at this time.
What to checkEven if a message contains accurate booking details, do not enter information or transfer money through its URL; verify through the property's or booking site's official support channel. If you have already entered card information, contact your card issuer.
16:17 JST (NVD inclusion) · Qualifications on CNA record and exploit conditions
libgsf: boundary checks in OLE2 file parsing
CVE-2026-116124 is a CNA entry concerning the OLE2 parser through version 1.14.60. A 9/26 commit fixing an out-of-bounds write was confirmed in GNOME's official mirror. The original GitLab page returned a challenge screen despite HTTP success, so its body could not be read. This is not a newly issued fix, and the earliest distributed fixed version remains undetermined.
What to checkInventory libgsf bundled with document parsing and conversion processes, and check which distributions include the fix. Restrict the environments and privileges used to process untrusted OLE2 documents.
16:17 JST (NVD inclusion) · Qualifications on CNA record and exploit conditions
agent-teams-ai: boundaries of the local HTTP service
CVE-2026-116228 is a CNA entry concerning insufficient authentication in the Local HTTP Service through version 2.17.10. Official code confirmed default handling of localhost origins, CORS conditions that broaden depending on configuration, and listening on the specified host. Unconditional compromise from an external webpage under every configuration has not been verified.
What to checkCheck the local HTTP service's listening address, CORS_ORIGIN, execution user, and local users' privileges. The earliest fixed version remains undetermined.
16:25 / 18:00 JST (official feeds) · Disclosure and updates checked
JPCERT/CC: PHP update and Japanese Brotli alert
At 16:25 JST, JPCERT/CC added information on PHP demonstrations, environment-dependent conditions, and upload progress mitigation, and published a Brotli alert. JVN also listed Brotli at 18:00. These are updates to guidance for Japan, not separate new PHP/Brotli CVEs.
What to checkFor PHP, continue updating to fixed versions and investigating compromise, and check session.upload_progress.enabled=0 for CVE-2026-115560 and restart all workers. For Brotli, check branch-specific fixes in 1.0.10 / 1.1.1 / 1.2.1 and guidance for products that bundle it.
16:33 JST (GHSA publication) · Publication/update confirmed
@worca/app: malware advisory for affected RC versions
GitHub classifies @worca/app 1.14.0-rc.2 / 1.14.0-rc.4 as malware and advises treating devices on which it was run or installed as compromised. The public record does not specify the number of affected organizations or when the intrusion began.
What to checkIsolate and investigate environments where the affected versions were installed. Rotate keys and secrets from another safe device, and do not consider recovery complete simply because the package has been removed.
17:00 JST (operator's displayed update) · Publication/update confirmed
Blastmail: total rises to 345 contracts; resumption time remains undetermined
An external investigation newly confirmed exposure of information other than subscriber information for 1 additional contract. The operator states that the total is 345 contracts and that individual notifications to all 345 have been completed. This does not mean exposure involving 345 people or all recipients. The management interface, API, and delivery remain suspended; the next report is scheduled for around 10/27 12:00.
What to checkCompare the information affected under each contract with the latest notification, and continue alternative delivery arrangements, inquiry handling, and vigilance against fraudulent emails. Do not treat completion of notifications as the end of the investigation or authorization to resume.
17:17 JST (NVD inclusion) · Caveats on CNA records and prerequisites.
Game and desktop utilities: handling external input
FFXIV Teamcraft CVE-2026-116229 concerns clipboard IPC in the renderer; Plague Inc Evolved CVE-2026-116230 concerns deserialization of Workshop scenarios. Teamcraft 11.4.32 was published on 10/13 and is not a new fix issued tonight. Avoid generalizing these issues to every part of the games or to ordinary browsing alone.
What to checkCompare fix guidance for Teamcraft 11.4.32, Plague Inc Evolved 1.24.0.4, and other applicable versions with your environment, and restrict untrusted scenarios and renderer input.
Official Teamcraft release / Plague Inc official update / CVE-2026-116230
17:17–19:16 JST (NVD inclusion) · Caveats on CNA record and prerequisites
Oray X5 Pro: newline and file handling through configuration values
CVE-2026-116231–116237 are CNA entries concerning configuration processing for Ser2net, SNMP, Dnsmasq, IPsec, L2TP, PPPoE, and other components in Pugongying X5 Pro 7.6.1. Newline injection and uploads should not collectively be generalized as unauthenticated external intrusion; access to administrative operations and privilege requirements need further confirmation.
What to checkCheck the model, firmware, management interface exposure, and configuration change history. The earliest fixed version remains undetermined, so review vendor guidance and restrictions on unnecessary administrative access.
18:16 JST (NVD inclusion) · Publication/update verified.
MISP Guard: check sharing policy evaluation
CVE-2026-116372 allows distribution filters to be bypassed through successful responses other than 200; 116469 allows bypasses through letter casing in tags, categories, and sharing group UUIDs. The developer addressed these in commits at 16:53 / 18:25 JST. This does not confirm compromise of all of MISP itself or disclosure of all feed data.
What to checkCheck that the running code includes both fixes, and review permission settings such as TLP and distribution history. The earliest distributed release containing the fixes has not been established in this review.
18:31 JST (GHSA publication) · Disclosure and updates checked
npm publish-poc packages: publishing permissions in the installation environment
The 7 affected versions of publish-poc-test3 reportedly attempt to publish using the environment's npm credentials during postinstall. publish-poc-base 1.0.7 prepares a temporary file containing a README fragment and credentials, but the description states that this version deletes it before publishing or communicating externally. Do not count both as successful external transmission.
What to checkCheck the affected versions, CI installation logs, and npm publishing history. If suspicious publications are found, revoke the relevant tokens and review dependencies and publishing permissions.
18:31 JST (GHSA publication) · Disclosure and updates checked
2 PyPI cases: transmission of basic device information and analysis classifications
zagents-framework 6.25.30.10b5 / 99.25.30.10b5 and changes-lxc-wrapper 0.0.0 / 0.1.0 are recorded as sending basic device information during installation or import. GitHub categorizes them as malware, while the original analysis classifies them as PROBABLY_PENTEST. Do not equate them with large-scale credential theft incidents.
What to checkCheck their intended use and how they were installed, and exclude unnecessary affected packages. If they have run, investigate the destinations and actual impact.
Zagents advisory / changes-lxc-wrapper advisory / OpenSSF original record
19:16 JST (NVD inclusion) · Publication/update confirmed
BRAIN2: service credentials left in installation logs
CVE-2026-112250 concerns plaintext passwords left in setup logs in BRAIN2 3.09 and earlier when SQL Server Integrated Security is combined with a specified Windows service account. The logs are usually in the installing administrator's temporary directory; the description does not say they are unconditionally exposed to standard users.
What to checkUpdate to 3.10 or later, and check secure removal and access permissions for the relevant setup logs. Change credentials for service accounts suspected of exposure.
20:16 JST (NVD inclusion) · Disclosure and updates checked
Mendix SAML: reusing IdP-initiated responses
CVE-2026-89209 is an authentication bypass under conditions involving reuse of a valid SAML response in IdP-initiated SSO. It affects module versions below 3.6.29 for Mendix 9 and below 4.2.4 for 10/11. It does not state that merely creating an arbitrary SAML response is sufficient.
What to checkUpdate the SAML module in use to 3.6.29 or 4.2.4 or later. If an immediate update is not possible, consult the developer's guidance on disabling IdP-initiated SSO.
20:16 JST (NVD inclusion) · Disclosure and updates checked
Additional WordPress issues: check privileges and individual fixed versions
The original sources confirm privilege requirements of Contributor for SQL injection in JetEngine 3.9.0 and earlier, Author for SQL injection in Media Library Assistant 3.42 and earlier, and Contributor for insufficient authorization in AI Engine 3.8.6 and earlier. These and the other XSS and CSRF entries are not all treated as unauthenticated RCE or confirmed exploitation.
What to checkCheck for JetEngine 3.9.0.1, Media Library Assistant 3.43, and AI Engine 3.8.7 or later, and review contributor privileges and installed plugins. For the remaining individual records, use the NVD index to check product-specific fixes.
JetEngine original report / Media Library Assistant original report / AI Engine original report
20:16 JST (NVD inclusion) · Caveats on CNA record and prerequisites
libimobiledevice: protocol responses from connected peers
CVE-2026-116258–116262 are CNA entries concerning memory handling in AFC, Web Inspector, and other components through version 1.4.0. The device info entries also include issues with local conditions. Official code was checked, but details could not be retrieved from the researcher's dynamically rendered site, so the full connection and pairing requirements and earliest fixed version remain undetermined.
What to checkCheck device management tools, bundled versions, and the devices trusted for connection. Do not interpret this as all iPhones being vulnerable to compromise merely by browsing any website; isolate processing of suspicious devices and protocol responses.
CVE-2026-116258 / CVE-2026-116262 / Official AFC code / Researcher website: body access restricted
21:00 JST (report 6 cutoff time) · Disclosure and updates checked
GMO: check linked services and browser sync as well as all sessions
The guidance advises signing out all devices and all sessions from another safe device, changing passwords for FX, securities, email, Google, and other services, and using MFA. It also adds removal of unfamiliar linked apps, forwarding settings, extensions, and registered devices, and keeping browser sync off until checks are complete. This does not confirm infection of every connected device.
What to checkCheck guidance through official support channels, revoke all sessions, and review newly added authentication methods and integrations. Run a full scan and keep a disconnected backup; for optional PC investigations, check the scope of the prior confirmation document.
21:17 JST (NVD inclusion) · Publication/update verified.
Qt: denial of service caused by a malicious HTTP/2 peer
CVE-2026-96432 concerns QNetworkAccessManager stopping while processing a sequence of responses from a malicious or compromised HTTP/2 server. The official table lists affected versions as 6.8.0–6.8.9 and 6.9.0–6.11.2. It does not confirm code execution through applications using Qt or compromise of all Qt products.
What to checkCheck the applicable release branches, such as Qt 6.8.10 / 6.11.3, and update applications and bundled libraries. Also review control over connection destinations and restart monitoring.
21:17 JST (NVD inclusion) · Qualifications on CNA record and exploit conditions
Image uploads: temporary files and deletion permissions
PictShare CVE-2026-116263 involves a race caused by predictable temporary filenames that allows content to be replaced after inspection. A fix dated 10/18 and the v3.7.2 tag were confirmed, but the GitHub Release API returned 404. EasyImage CVE-2026-116223 concerns deletion permissions, with a related hardening commit confirmed on 10/24. The conditions differ between the two products.
What to checkFor PictShare, check the tag corresponding to 3.7.2 and inclusion of the fix; for EasyImage, check the relevant fix and authentication and storage destination settings. Do not infer an arbitrary version number as a new earliest fixed version.
PictShare fix / PictShare v3.7.2 tag / Related EasyImage fix
21:17 JST (NVD inclusion) · Qualifications on CNA record and exploit conditions
Logsign SIEM / Liman MYS: product-specific administrative paths
The CNA records path traversal in Logsign SIEM from 6.4.120 up to but excluding 6.4.122, and password recovery in Liman MYS from 2.3.4-1124 up to but excluding 2.3.5-1131, as separate issues. The national authority's original notification pages were dynamically rendered and their bodies could not be retrieved, so exploit conditions and actual exploitation were not independently confirmed in this review.
What to checkCompare distributor guidance for Logsign 6.4.122, Liman 2.3.5-1131, and other applicable versions with the release branch in use, and review exposure of administrative paths, recovery procedures, and related logs.
Logsign CNA/NVD / Liman CNA/NVD / Turkish authority: body retrieval restricted
21:30 JST (GHSA publication) · Publication/update verified.
PyPI netweavex: fetching remote code on import
The affected versions are netweavex 1.1.0 / 1.1.1 / 1.1.2. The original analysis describes copying a legitimate package, obfuscation, and fetching and executing code from GitHub on import. It also states that the retrieval destination was a placeholder at the time of analysis, and does not confirm successful theft of any specific information.
What to checkCheck installation records without running the affected versions. If they have run, investigate external communications and execution history, and revoke secrets and rebuild as appropriate to the exposure.
Existing incident response and conditions · 12 groups
Supplementing conditions, fix/deployment methods, and operational impacts in previously published material. These are not recounted as new compromises during this period.
14:32 JST (developer advisory), 17:17 JST (NVD inclusion) · Publication/update verified.
Ash: tenant boundaries in upsert
The developer advisory for CVE-2026-96581 was published at 14:32 JST, before the previous cutoff. It describes conditions under attribute multitenancy in which a create action with upsert that accepts primary keys or similar values can update or retrieve another tenant's records. Not every create action or Ash application has this configuration.
What to checkCheck for Ash 3.37.2 or later, and review cross-tenant upserts and record movement history. Also note the exception that the temporary upsert_condition workaround does not work with Mnesia.
Published 10/22, included in NVD 10/26 · Publication/update verified.
Apache Camel: Docling configuration is still needed after updating
5 advisories published on 10/22 have been supplemented to reflect their inclusion in NVD. Docling input and output paths, expiration of Keycloak introspection results, expression evaluation in AWS2-S3 object names, and information disclosure in CoAP errors involve distinct conditions. The Keycloak issue applies when token introspection is enabled, which is not the default.
What to checkUpdate to versions such as 4.18.5 / 4.22.2 / 4.23.0, as applicable. Where external input can specify a Docling output destination, configure outputBaseDirectory even after updating. Check handling of S3 headers and expired tokens.
Docling output path / Docling arguments / Keycloak expiry / S3 expression evaluation / CoAP errors
Advisory dated 9/21, NVD inclusion 10/26 · Publication/update confirmed
SOEM: device responses on the same EtherCAT network
RT-Labs documentation dated 9/21 describes 6 issues affecting SOEM 2.0.0 and earlier. They require a malicious or compromised EtherCAT device to return invalid responses to the master. Insufficient validation of lengths, cumulative quantities, array indices, and similar values may cause memory corruption, information disclosure, or shutdown. General internet reachability alone is not sufficient.
What to checkCheck with the product vendor whether SOEM 2.0.1 or later is integrated. Review device additions to the EtherCAT segment, maintenance connections, and master privileges, and update in accordance with equipment shutdown procedures and a validation plan.
Original report published 10/23; 16:17 JST (NVD inclusion) · Disclosure and updates checked
WooCommerce payment integrations: payment notifications and order status
6 issues published on 10/23 have been supplemented to reflect their inclusion in NVD. They affect individual plugins for CCAvenue, nexi Alpha Bank, Eurobank, iKhokha, OPay, and Mintpay, involving changes to states such as paid or canceled due to notification authenticity issues or a secret that is empty by default. They do not represent compromises of the banks themselves or WooCommerce itself.
What to checkFor iKhokha, check for version 3.0.4 or later. The original sources list no known fixed versions for the other 5, so consider suspending or replacing affected integrations and reconciling payments against payment provider records.
CCAvenue original report / nexi Alpha Bank original report / Eurobank original report / iKhokha original report / OPay original report / Mintpay original report
Developer disclosure 10/23, NVD inclusion 10/26 · Publication/update confirmed
Pleasanter: rechecking the previously reported LDAP authentication issue
Following NVD inclusion of CVE-2026-113438, the developer's explanation from 10/23 was reviewed again. The affected conditions combine LDAP authentication on Linux/Docker or with the Windows Novell provider with AD or an LDAP server permitting anonymous binds. This is not an authentication bypass for all users, including those using local authentication, SAML, or passkeys.
What to checkFor affected configurations, update to 1.5.9.1 or later. Note that 1.5.9.0 does not include the fix and that LDAP users are affected when LDAP+Local is used.
13:00 JST (previous JVN report), 16:17 JST (NVD inclusion) · Publication/update confirmed
V-SFT: NVD inclusion of 7 previously reported issues
CVE-2026-107894–107900 are 7 issues previously listed using JVN information. Their inclusion in NVD this time does not mean 7 new incidents or 7 newly confirmed cases of exploitation. The requirement to open a crafted V7-format file on a design workstation still applies.
What to checkCheck use of 6.2.11.0 and earlier and handling of external design files, and review improvement information and patches for 6.2.12.0.
Observed/first published 10/24, last addition 10/26 11:28:31 JST · Supplement to existing issues and response scope
PHP2Shell: primary research observing execution in a limited honeypot setup
The researcher correlated HTTP requests with 35 Apache-child shell executions across 3 targets using PHP8.4.26, single-worker Apache mod_php, and 128MiB. Execution was under UID33; this does not mean 35 victims or root access. This article has not independently reanalyzed all PCAPs or run the PoC. The withdrawal of the connection to the government agency intrusion reported by Unit42 remains separately in effect.
What to checkIn addition to updating, investigate suspicious child processes, communications, and file creation originating from PHP workers, together with surrounding HTTP records. Do not use 500 errors or large cookies alone to determine successful exploitation or absence of harm.
Researcher's primary report / Publication history / Evidence index and limitations / Current Unit42 correction
SSH forwarding PR merged at 10/26 12:08:59 JST. Change predating the previous report · Supplement to existing issues and response scope.
Tailworm: distinguish source fixes from distributed releases and stop unnecessary forwarding
Official PR21942 changes Unix forwarding to use authenticated local user credentials. Serve PR21931 has also been merged, but the latest stable versions are 1.104.2 and headscale0.29.6, and the earliest fixed version covering all of Tailworm remains undetermined in this review. Connection policy PR21944 is open. A merge into main does not establish that a fix has been distributed.
What to checkAfter confirming an alternative management path, review the temporary measure of setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restarting it to stop unnecessary forwarding. Do not treat check mode or this flag alone as completing fixes for every research finding.
Guidance from the vendor lead / Official forwarding PR21942 / Official 1.104.2 flag implementation / Latest official release index
Primary research published at 10/22 22:00 JST. Observations 7/14–9/22 · Supplement to existing issues and response scope.
Microsoft 365: check MFA and registered devices as well as sessions
Huntress reports 497 successful sign-ins across 79 organizations, at least 48 unauthorized Entra device registrations, MFA replacement, and inbox rules. Distinguish reuse of stolen sessions from subsequent persistence. The source does not establish 79 intrusions today or the same cause as ConnectWise.
What to checkAlongside session revocation and password changes, investigate registered devices, MFA methods, inbox rules, new enterprise applications, and consent grants, and remove unauthorized entries. Do not prioritize response solely by the number of failed attempts.
Primary research published 10/26 02:55:33 JST. Observed since 9/15 · Supplement to existing issues and response scope
Gheist: exfiltration of secrets through GitHub logs
Wiz reports more than 850 accounts and over 13,500 suspicious branches involving stolen tokens. Workflows print secrets to logs, which are retrieved through the GitHub API before the runs are deleted. The public runs examined were blocked by approval holds, while execution and subsequent activity were observed in private / Enterprise environments. Branch counts are not counts of affected organizations.
What to checkCheck for ci-sync- branches, sync-check workflows, runs deleted shortly after creation, and cloud-side role assumption. In repositories where execution occurred, revoke and replace tokens and accessible secrets, and investigate self-hosted runners and permissions. Do not approve pending suspicious workflows.
Primary research published 10/21 23:57:50 JST · Supplement to existing issues and response scope
uCreator: research into surveillance capabilities through modified APKs and containers
The research analyzes modified APKs for Telegram, WeChat, and other apps, and hooks inside Onion Box containers. It demonstrates capabilities to obtain 2FA information, sessions, and similar data, but a reliable victim count remains undetermined. It does not prove that the entire chain worked on Android17 or that OS updates alone can prevent every case.
What to checkCheck distribution sources, signatures, and app provenance. If suspicious modified versions are present, investigate sessions and authentication methods from a safe device. Do not confirm infection solely from residual LSPatch files or add the previous year's infection counts to this case.
Researcher Ovi's primary analysis / Previous year's Doctor Web original report and counts are separate
18:10:22 JST (Summary edit in official advisory) · Supplement to existing issues and response scope
Neat: confirm deployment completion separately for devices and the cloud
This update removes the advisory's old statement that firmware was being prepared. NeatOS26.5.4 remains in staged rollout, Pulse deployment varies by organization, and non-Pulse OTA is targeted for 10/28. The cloud-side fix is separate and expected to take about 2 weeks; this wording update does not prove completion of all deployments.
What to checkCheck the Pulse Roadmap and actual device versions, and distinguish any necessary webhook credential rotation from confirmation that the cloud fix is complete. Do not infer that all devices are fixed from dates or advisory edits alone.
Reference: publication time unconfirmed despite same date · 2 groups
This is current content retrieved after the target time. The following information is excluded from confirmed changes before the cutoff.
Edited 21:39:58 / updated 21:40:23 JST (after the 21:35 cutoff) · Publication before the cutoff is unconfirmed.
Reference: the retrieved IceWarp version was revised after the cutoff
The article was created on 10/21, but the official API records a revision after the cutoff. Do not backdate the retrieved list of bundled PHP patches or future-release statements as confirmed content available before 21:35. Do not independently reconcile body text such as 14.3.0.14 and download names such as 14.3.0.15 into an earliest fixed version.
What to checkUsers can consult current official guidance for their release branch and OS, but this article does not include version numbers retrieved later in the confirmed changes. Do not treat partial mitigation for older branches as a complete fix.
Retrieved official article revision / Revision timestamp: official Zendesk API
Dated 10/26. HTTP Last-Modified 16:00:20 JST; recovery and publication times are undetermined · Publication before the cutoff is unconfirmed.
Reference: Kawanishi Town's restoration notice does not establish the exact restoration time
The current page states that inquiries, FAQs, evacuation shelter management, waste sorting searches, and other functions suspended for the PHP response have been restored, and that compromise or disclosure has not been confirmed. The server resource update time is not treated as the actual restoration or initial publication time; this is retained as reference information because the state at the relevant time cannot be fully reconstructed.
What to checkCheck the official status of the functions you use. Do not treat a precautionary suspension as confirmed compromise or generalize this town's notice to restoration across all municipalities.
Collection scope, overlap and limitations
99NVD new records
1,434NVD revisions
111GHSA publication window
169Verified saved and referenced responses
All 99 new NVD records overlap the 1434 revised records. GHSA has 111 newly published records (103 unreviewed, 8 malware) and 151 revisions. Distinguish reviewed, unreviewed, and malware, and check publication/revision overlaps in the ledger. KEV is the 2026.10.23 edition with 1,756 entries, identical to the previous original. Inclusion and changes in originals differ from attack start times. Absence from the list is not proof of no exploitation. Of 169 responses, 27 reference earlier originals to avoid duplicate storage.
- This is the current revision retrieved after the target time. Distinguish publication, database inclusion, intrusion, and availability of fixes.
- The delta includes first database inclusion and official alerts within the window; it does not uniformly mean new discoveries or new harm.
- All 99 new NVD entries overlap with the 1434 updated entries. All 111 GHSA publications overlap with the 151 modified entries.
- This time, GHSA publications and modified records were retrieved with reviewed/unreviewed/malware explicitly specified. The scope differs from earlier default queries, so do not compare additional malware counts with an assumed absence in previous windows.
- Distinguish GitHub's malware category from classifications such as PROBABLY_PENTEST in the original analyses.
- CVE-2012-20006 is Rejected and is not recommended as a new valid vulnerability.
- Absence from KEV, no updates, or no feed delivery does not prove the absence of exploitation or harm.
- Code comparison is not experimental testing or confirmation of actual exploitation, nor does it establish the earliest shipped fixed version.
- GNOME GitLab returned a challenge screen despite HTTP success. Distinguish the PictShare Release API's 404 from the existence of a tag.
- Retrieved at 21:37:41–21:43:21 JST. The original HTTP responses contain current revisions from after the cutoff, and unmarked additions cannot be fully reconstructed.
- Time evidence came from GMO's 21:00 display, Blastmail's 17:00 display, JPCERT's official RSS at 16:25, the JVN homepage at 18:00, and page update metadata with times other than midnight (0 hours). Do not treat these as intrusion or attack start times.
- The PHP honeypot, Huntress, Wiz, and Ovi primary research was published before the previous review. Do not recount evening coverage as new harm or discoveries.
- Reading researcher reports is not independent reanalysis of every packet or execution of a PoC. Do not convert observed counts of shells, branches, or sign-ins into numbers of affected people or organizations.
- Tailworm source merges and distributed releases are separate. The earliest fixed version remains undetermined in this review, and check mode or disabling forwarding alone does not complete fixes for every item.
- ConnectWise's next scheduled update at 23:00 JST is after the cutoff. Keep affected connections disabled until specific instructions are provided, and do not treat a restoration target as permission to connect.
- The retrieved IceWarp body was revised at 21:39:58–21:40:23 JST, so it is not included as a confirmed patch list available before the 21:35 cutoff.
- Kawanishi Town's HTTP Last-Modified reflects a resource update, not the actual restoration or initial publication time. It is retained with reservations as reference information.
- Direct Reddit access returned HTTP 200 with an unreadable challenge; JSON returned 403. The vendor's body text was checked separately through browser-rendered text, and the post's exact edit time remains unconfirmed.
- This does not cover every incident worldwide. News and social media are used only as starting points for primary-source research; attacker claims and the previous year's infection counts are not added to confirmed harm.
- The consolidated ledger contains 37 topics: 23 changes, 12 supplements to existing cases, and 2 references. JPCERT/CC's PHP and Brotli information is consolidated into 1 API-side group; the 2 vendor-side groups are not counted again.
- Of 169 saved or referenced responses, 27 refer to earlier originals. 1 browser-rendered text record was saved separately and distinguished from original HTTP responses.
- GHSA malware records were explicitly retrieved this time. Because the previous search scope also differed, do not directly equate an increase in records with an increase in new attacks.
data/2026-10-26-2135/incident-register.json / data/2026-10-26-2135/collection-summary.json / data/2026-10-26-2135-vendors/collection-summary.json / docs/research-collection-2026-10-26-2135.md / docs/research-2026-10-26-2135.md / data/latest.json