“Don’t click” no longer covers it

On 1 October the National Cybersecurity Alliance opened the twenty-third awareness month. The line fits on a poster: Don’t Make It Easy for Them. Lisa Plaggemier, the executive director, said it without theatre. Criminals count on you being busy.

What the poster asks

Four habits. A long password, kept in a manager. A second factor. A look at the message that rushes you. An update. None of that is wasted. Phishing did not retire in September.

What September had already done

Between 28 August and 8 September, Proofpoint described a kit. They called it BlueMoon. It chains two flaws in Chrome’s engine, CVE-2026-85046 and CVE-2026-87491, with a Windows flaw, CVE-2026-85880, that raises privileges. Google closed the browser bugs on 3 and 8 September. The Windows one landed on Patch Tuesday.

Ars Technica carried the sentence a board should underline. Those browser flaws were already fixed in public Chromium code. Not yet in the stable Chrome people actually have open. Proofpoint calls it a patch-gap zero-day: the fix exists, your company does not have it.

This is not zero-click

Do not turn it into a film. At least one reported use was targeted email. The kit does not prove that nobody had to open anything. It proves something else: a page, or a message, against a browser sitting behind a fix that was already published.

If the company’s only line this October is the poster, you are training the click and you are not measuring the lag.

What to ask on Monday

1. What version of Chrome is the executive team on, and who measures it in days?
2. Does this month’s plan say anything about the case where the person is not the door?
3. Who can pull a board laptop off the network before the patch arrives?
4. Is multifactor the answer we also give when the flaw does not ask for a password?