Five updates to install this week, and one scam to refuse

In brief

In September, attackers used flaws in Google Chrome, Windows and Google's Pixel phones before most people had updated. Fixes are out for all of them. Updating is the one security step that needs no judgement, so here is what to install, how to check it worked, and one trick on legitimate-looking websites to refuse.

1. Chrome, and any browser built on it

Google fixed two Chrome flaws that were already being used in attacks, on 3 and 8 September. Researchers at Proofpoint and Volexity found them being used in targeted espionage, including against government bodies in Asia. You need Chrome version 153.0.8010.36 or later on Windows and Linux, or 153.0.8010.37 on a Mac.

Google warns that updates "could take days or weeks to reach all Chrome users", so do not wait. Open the menu (the three dots), choose Help, then About Google Chrome. Chrome checks for the update. Press Relaunch when it asks, because the fix does not apply until the browser restarts. Browsers built on the same engine, such as Microsoft Edge, Brave and Opera, get their own updates. Check each one's About page too.

2. Windows

Microsoft's September update, released on 8 September, fixed two Windows flaws that attackers were already using. One of them was used alongside the Chrome flaws above. Both let someone who already has a foothold on your PC take full control of it.

Open Settings, then Windows Update, and select Check for updates. Install everything offered and restart. If the PC says it is up to date but has not restarted for a while, restart it anyway; many fixes finish installing then.

3. Google Pixel phones

Google's September update for Pixel phones fixed 110 problems, including a flaw in the phone's mobile-network chip. Google says there are "indications" it "may be under limited, targeted exploitation". Open Settings, then System, then Software updates, and install the update with the security patch level 2026-09-05 or later.

Other Android phones get their fixes from the manufacturer on its own schedule. Check the same menu, and if your phone no longer receives security updates at all, that is worth knowing before you buy your next one.

4. iPhone, iPad and Mac

Apple did not fix a newly exploited flaw in September, but its 14 September releases fixed a long list of other problems. You do not have to move to iOS 27 to get them. Apple also released iOS 26.7 for people who want to stay on the current version. On a Mac, macOS Tahoe 26.7 and Sequoia 15.8 bring security fixes to Macs that are not moving to the new version.

On an iPhone or iPad, go to Settings, then General, then Software Update. On a Mac, open System Settings, then General, then Software Update.

5. If you run a WordPress website

WordPress version 7.1.2, released on 22 September, fixed a critical flaw that attackers began exploiting within hours of its disclosure. Many sites install security releases automatically, but check: log in and look at the Dashboard's Updates page. Plugins and themes need updating separately.

The trick to refuse: "paste this to verify you're human"

Watch out for a page that asks you to press a key combination and paste something to prove you are human, fix an error or join a meeting. Close it. This scam is called ClickFix. The "fix" is a command that installs malware.

It does not only appear on dodgy sites. On 14 September, attackers used a stolen access key to inject a ClickFix prompt into websites run by the email-marketing company Brevo. For about five and a half hours it also appeared in Brevo forms and chat widgets embedded on its customers' own websites. No real website needs you to paste anything into your computer to prove who you are.

If your details were in September's breaches

The ID-checking firm IDScan confirmed a breach on 10 September, and the security journalist Brian Krebs found more than 153 million scanned US and Canadian driving licences for sale. Revolut disclosed that it had sent some customers' identity documents to an attacker posing as a government agency. Expect messages that quote your real name, address or account details. That does not make them genuine. Contact the company through its app or the number on its official website, never through the message.

Sources and scope

This piece is ByteNib editorial guidance for general readers. Chrome versions and Google's quote are from Google's Chrome release notes as reported by BleepingComputer. The attackers' use of the flaws is from BleepingComputer and The Hacker News. The Windows flaws are listed in CISA's Known Exploited Vulnerabilities feed.

The Pixel details are from Google's Pixel security bulletin, and Apple's releases from Apple's security updates page. The WordPress fix is from the WordPress advisory, with exploitation reported by SecurityWeek. The Brevo incident is from its post-mortem as reported by BleepingComputer. The breaches are from TechCrunch, Krebs on Security and BleepingComputer.

Menu names can differ slightly between device models and software versions.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.