ClickFix This Week: Siemens Software Center Flaw, ROMULUS and Chrome’s Copied-Command Warning

Siemens confirmed active exploitation of CVE-2026-110936 in Software Center where attackers place malicious DLLs alongside a legitimate signed installer (DLL side‑loading) as part of a ClickFix social‑engineering flow; Forescout identified the ROMULUS delivery backend (two delivery routes including a LegionLoader chain) and Google added a Chrome clipboard‑paste warning. The report provides overlapping IOCs (e.g., 2.27.248.127, 96.62.218.59, wizardexpensive.com), maps the chain to MITRE techniques, and gives concrete mitigations: update to Software Center 4.0.9.8+, block indicators, hunt for behavior and PowerShell pastes, enable logging and constrain script execution, and user training.