The web’s having a rough week. Here’s how to browse safely

What happened?

You recognize the website. You’ve visited it before. You may even have it bookmarked. Then it asks you to do something unusual: install an update, allow notifications, or run a command to prove you’re human. Stop and check first. A website you trust can still display instructions you shouldn’t follow. Our researchers have documented attacks in which criminals hacked legitimate websites and used them to deliver fake verification pages that trick visitors into installing malware. Within the same week, serious problems emerged in several parts of the web’s security infrastructure.

Key details

• Two PHP flaws and a critical Brotli flaw in Node.js were disclosed within the same week.
• Eight compromised security certificates raised concerns about how browsers and apps verify websites.
• ClickFix attacks disguise malicious commands as routine verification or troubleshooting steps.
• Automatic updates for OS, browser, and applications fix security flaws criminals could exploit.
• Phishing and malware protection in browsers and extensions like Browser Guard add a useful safety layer.

Summarised by SecOraLens from Malwarebytes Labs. Always read the original source before acting. How SecOraLens verifies advisories.