JP — ITmedia

Furusato Choice Suspends Service Over Suspected Unauthorized Access

SecurityOctober 19, 20261 min read

Furusato Choice, a major Japanese site for hometown tax donations, has paused its service. The operator says it may be the target of unauthorized access.

What happened

On October 19, 2026, Furusato Choice, run by TrustBank, announced that it had temporarily stopped its service. The company said it had found a sign of possible unauthorized access. When people opened the site, they saw a notice instead of the normal page. A special team is now checking the facts and how far the problem reaches. The company said stopping the service was the top priority to prevent more damage and keep people safe. It will share what it learns from the investigation later.

Key facts

Service paused on October 19, 2026
More than 1,700 local governments work with the site (as of October 2024)
More than 980,000 items are listed (as of May 2026)

What is hometown tax donation?

Hometown tax donation is a system in Japan. People can donate money to a town or city they choose, often far from where they live. In return, they get a thank-you gift, called a return gift, such as local food or goods. Furusato Choice is one of the largest websites for this. Users look for return gifts and do the donation steps online there.

Why it matters

Many people use this site to make donations, so a pause can stop their plans. It also shows how risky online services can be. If personal information was leaked, users could be affected. The full impact is not known yet, so people should watch for official updates.

What to watch

The results of the investigation
When the service will restart
Whether any personal information was leaked
Official notices from Furusato Choice

Tioli Releases Emergency Response Guide for 'Node2Shell'

Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.

Security전자신문Oct 26

Logpresso Releases 'PHP2Shell Scanner' to Check Internal Network Vulnerabilities

Logpresso has released a 'PHP2Shell Scanner' app that diagnoses the PHP remote code execution vulnerabilities known as PHP2Shell. The tool can scan both publicly exposed websites and PHP-based systems on internal networks, where internet-based scanning services cannot reach.

SecurityVnExpressOct 26

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.