A week in security (September 15 – September 21)

A week in security covers September 15–21, 2025, with Malwarebytes Labs highlighting several notable developments. according to OpenAI, ChatGPT Deep Research has fixed a zero-click prompt-injection vulnerability that could exfiltrate PII, reported on September 19, 2025. On September 18, 2025, Microsoft and Cloudflare delivered a major blow to the RaccoonO365 phishing operation, described as a disrupted phishing service after Microsoft 365 credentials.

Also on September 18, Google issued a Chrome update to fix four high-priority flaws, including one zero-day zero-click vulnerability. That same day, OpenAI announced age verification and parental controls coming to ChatGPT to protect teens. The week also included news that 224 malicious apps were removed from the Google Play Store after an ad fraud campaign was discovered, published on September 17, 2025.

The entry list includes several other items such as updates about Chrome, ChatGPT protections, and related cybersecurity threats, with the recap inviting readers to stay safe.