decrypted · 18 september 2026 · vulnerabilities and patching · supply chain

Brevo's stolen key turned a marketing widget into a malware delivery route

The Brevo story we covered last week has moved, and not in a direction anyone at Brevo would have chosen. The single sign-on flaw that hit its customers was followed on 14 September by a second, larger incident: attackers used a stolen Cloudflare API key to make Brevo's own scripts serve malware from other people's websites. Security firm Sansec put the potential reach at up to 100,000 sites, and any UK organisation that embeds Brevo forms or its chat widget should read on.

What happened

According to BleepingComputer's report on Brevo's own account, the attackers used a long-lived Cloudflare API key with full account permissions, apparently hardcoded in application source code. With it they created a malicious Cloudflare Worker, a small program that rewrites web responses at the network edge. For a few hours on 14 September that Worker altered brevo.com, the sibforms.com form pages and three JavaScript files that customers embed on their own sites.

Visitors were shown a fake "Cloudflare, verify you are human" page that told them to paste a command into their computer. That is ClickFix, and it needs no browser exploit, just a person doing as they are told. Sansec also found that if the visitor was a logged-in WordPress administrator, the script tried to install a backdoor plugin through their live session. BleepingComputer reports that the key may have been exposed as early as late August.

Why the usual checks saw nothing

Think of a courier whose depot is spotless and whose sealed parcels are untouched, but someone has been swapping the contents while the van is on the road. Brevo said the Worker rewrote responses at the edge and stripped security headers such as Content-Security-Policy, so its origin servers and files stayed unmodified and standard integrity checks did not fire. Every check on the depot passed. The damage happened in transit.

The Secure by Design lesson

Three decisions would have blunted this:

No standing master keys. A credential with full account permissions that never expires, sitting in source code, is a design choice, not an accident. Scoped, short-lived tokens and secret scanning are the boring fix.
Watch the control plane, not just the files. A new Worker on a production domain should raise an alarm, because file integrity monitoring cannot see it.
Treat vendor scripts as a supplier, not a widget. A third-party script runs with the same privileges as your own code. If you embed one, you should know who can change it and how you would hear about it.

For UK organisations the practical steps are unglamorous. Check your Brevo embeds. Look at WordPress plugin install dates around 14 September, as Sansec advises, and check that the plugin folder matches what the admin screen shows. If staff may have followed the fake verification prompt, treat those machines as suspect. Opinion, not advice: your website's security is only as good as the weakest supplier allowed to edit it.

Also this week

Azure AI Foundry, CVSS 10.0. Microsoft published CVE-2026-85889 on 17 September: missing authentication on a critical function, exploitable over a network by an unauthorised attacker. Microsoft says it is fully mitigated at service level, that customers need do nothing and that it has no evidence of exploitation, credit going to researcher Rémy Marot. Good news, but note the shape: a maximum-severity design flaw fixed where you could not see it. Ask your cloud providers how you will be told when this happens, because you will not be patching it yourself.

Check Point management servers. Check Point disclosed CVE-2026-91843 on 16 September, a CVSS 9.8 stack overflow triggered by an overlong username in the login process, before authentication, giving root code execution on Security Management, Multi-Domain and Log servers. NHS England Digital issued its own alert on 17 September. As of that date there was no sign of exploitation. Check Point advises applying the LivePatch fix in advisory sk1000155 and limiting the Trusted Clients setting to known hosts, and The Hacker News stresses keeping management interfaces off the internet. Smart-1 Cloud is not affected. The design lesson is old but unlearned: the console that controls your firewalls should not be reachable by strangers.

Sources