Japan Security Bulletin

Gathers alerts and vulnerabilities from Japan's public agencies (JPCERT/CC, IPA, JVN) and breaches announced by Japanese organizations, puts what relates to your site first, and notifies you only about urgent items

A screen so you don't miss what is happening in Japan

"Sorabun > Security / Speed > Japan Security Bulletin" gathers security information from Japan every three hours and puts what relates to your site first (Pro).

News about unauthorized access and data breaches appears almost every day, but finding the items that matter to your own site is hard. If you miss them, your site can be hit by the same technique, or you can be slow to notice an accident at a service you use. This screen brings two kinds of information into one place.

How the list is arranged

Switch with the tabs at the top of the screen. The count appears next to each tab.

Each entry shows a severity label, the date, the agency, and the headline (a link to the agency's page). When an item relates to your site, it also shows why it relates (for example, "The name of your installed plugin 'X' appears") and links to the screen where you can check next.

"Relates to this site" is decided inside your site

An item is treated as relevant when any of these is true.

• The name of an installed plugin or theme appears in the headline
• It is about your server (Apache, nginx, LiteSpeed), database (MySQL, MariaDB), PHP, OpenSSL, cURL and so on
• A watch word you set appears in the headline
• It is about WordPress as a whole

So that the accidents of other companies are not announced to every site, an incident is treated as relevant only when it matches a watch word or the name of an installed plugin or theme. The server or database type does not make an incident relevant.

Only urgent items are announced

If everything were announced, nobody would read it. By default Sorabun notifies you only about these.

• Widely issued alerts about attacks and damage in Japan (urgent ones)
• Items that relate to your site and are important or higher (including incidents that match a watch word)

Notifications go to the destinations set in Settings > Notifications (email, Slack, Chatwork). If none is set, Sorabun emails the site administrator.

Items also appear in these places. They appear even if you set notifications to "Do not notify".

• WordPress dashboard: the five most recent important items
• Notice at the top of the admin screen: when something urgent has arrived (only on the dashboard and Sorabun screens, and it disappears once you open the screen)
• Security / Speed screen: a one line summary

Settings

Set these three things in "Settings" at the bottom of the screen.

"Fetch now" fetches immediately. When a fetch fails, Sorabun shows the reason and keeps showing the last list it received.

What is shown and what is not

• Only the headline, date and a link to the agency's page are shown (only JVN also has a one line summary written by the agency). The body of the article is never imported
• The name of the source agency and a link to its terms of use are always shown on the screen
• The severity labels (urgent, important, normal) and the tags are a guide that Sorabun assigns from the words in the headline. They are not the severity the agency assigned. Always check the contents and the countermeasures on the linked page
• Incidents are only those that an organization announced itself. Sorabun summarizes only the facts in one line and links to that organization's official announcement. Headlines from news reports are not copied

Also on the official site

The same content is published on the official site at WordPress vulnerability alerts. People without a license can also see the headlines and links.

When it does not work