"WARP SECURITY" Articles (48)

What Comes After Zero-Click Attacks: A Computer Built Inside an Image

A zero-click attack takes over a phone when a message simply arrives, with no link tapped and no file opened. FORCEDENTRY, its best-known example, built a tiny computer inside an image decoder. This column explains how it worked in plain language, what changes when AI starts finding places nobody thought were computers, and what individuals, companies, and developers can do today.

2026-11-08Ryuta Hamamoto

AI Security

Lessons From the GMO Breach: What Government, Companies and Individuals Should Do Now

This article lays out what happened in the October 2026 unauthorized access to GMO's Onamae.com Desktop Cloud, using GMO's official announcements and press reports, and then explains what we can learn from it in three roles: government, companies and individuals. It is written in plain language for beginners and ends with actions you can take today.

2026-11-06Ryuta Hamamoto

AI Security

Japan's Government Guide to Web and App Breaches, Explained for Executives

On 5 November 2026, Japan's National Cybersecurity Office published a 13-page document on protecting websites and mobile apps from unauthorized access. This beginner-friendly guide reads it page by page in plain language, organized around its three pillars of operations, design and development, and supply chain, and sets out what executives should decide and what to ask staff and contractors.

2026-11-06Ryuta Hamamoto

AI Security

Companies Quietly Leave a Country That Won't Hit Back: Japan's Active Cyber Defense Explained

What can the Japanese state do, and not do, under the active cyber defense framework that began in October 2026? Using the Asahi, Askul and GMO incidents, this beginner-friendly explainer shows how the burden falls on the company that was attacked, and how that could shape where companies choose to keep their data. It also weighs the strongest counterarguments and what government and companies can do.

2026-11-05Ryuta Hamamoto

AI Security

What Anthropic's S-1 Admits About AI Risk, Read Against the Original Filing

Anthropic filed its Form S-1 with the SEC on October 26, 2026. This article reads the risk factors against the original filing: shutdown resistance, test awareness, the incident in which models left an evaluation environment and reached real systems, the limits of insurance, and the governance structure. It separates what happened from what could happen, and ends with what companies should check.

2026-10-28濱本隆太

AI Security

PHP's Critical Flaws Drew a Prime Minister's Call. What Happened, and How to Prepare

On 21 October 2026, Japan's National Cybersecurity Office and Prime Minister Sanae Takaichi were reported to have urged action on two critical PHP vulnerabilities (CVSS 9.2). This article separates what the PHP project itself confirmed from what the press reported about the government's role. Node.js shipped ten fixes the same day, and I describe what we checked on our side. Then I set out what a company can build in peacetime, because this will happen again.

2026-10-22Ryuta Hamamoto

AI Security

Cyberattacks on the Power Grid: Japan's New Rule for Solar and Battery Equipment, and How to Prepare

On 16 October 2026, Nikkei reported that the targets of cyberattacks on Japan's power grid exceed 100 million points. The government plans to require JC-STAR Level 1 certified products for solar and battery grid connections from April 2027. This article separates the disclosed facts from what could not be confirmed, and sets out what owners, operators and procurement staff can prepare now, based on public documents.

2026-10-21Ryuta Hamamoto

AI Security

AI Pentest Tools and Open-Weight Models Used in Attacks: The Disclosed Facts and How to Prepare

In October 2026, CrowdStrike reported attacks that combined ARTEX, an open-source AI penetration-testing tool developed in China, with models such as DeepSeek v4.1-flash. Together with NIST's and Anthropic's assessments of GLM-5.3, this article separates the disclosed facts from what is still unknown, and sets out six things companies should prepare.

2026-10-20Ryuta Hamamoto

AI Security

Lessons From a Community SaaS Breach: Protecting Invite Links and Admin Privileges

In October 2026, a Japanese community-platform SaaS had the member data of about 307,000 people leaked. The disclosed methods were improper acquisition of invite links to private communities and impersonation of administrators. This article separates the disclosed facts from what remains unconfirmed, then sets out what both SaaS operators and the companies that use them should review, based on OWASP and RFC 8725.

2026-10-20Ryuta Hamamoto

AI Security

Securing Internal Systems: Settings for Workspace, Apple, Claude Code and Browser AI Agents

Settings that protect internal systems, grouped into four areas: Google Workspace, Apple Business, Claude Code and browser-based AI agents. Based on each vendor's official documentation and OWASP, it covers administrator accounts, 2-step verification, third-party apps, device encryption, AI agent permissions and prompt injection, in priority order.

2026-10-20Ryuta Hamamoto

AI Security

Lessons From the 22.5 Million-Record Sourcenext Breach: Protecting Member Data APIs

On 15 October 2026, Japanese software company Sourcenext disclosed that unauthorized use of its member information API may have exposed up to 22,519,960 records. This article separates the disclosed facts from what is still unknown, then lists six items for operators who run APIs that return member data and how to act if a breach happens, based on OWASP and Japan's Personal Information Protection Commission.

2026-10-20Ryuta Hamamoto

AI Security

DKIM Replay Attacks: Six Email DNS Settings Domain Owners Should Review Now

Phishing emails carrying an official-account mark made headlines in Japan. Even when SPF, DKIM and DMARC all pass, spoofing is not over. This article separates what NTT Docomo and Rakuten Card have disclosed from what engineers have analyzed, explains how a DKIM replay attack works, and lists six DNS and mail-delivery settings for domain owners, based on the RFCs and M3AAWG guidance.

2026-10-19Ryuta Hamamoto