x.com

Stolen Cloudflare Key Used to Inject ClickFix Scripts on Brevo and Customer Sites

Brevo says attackers used a stolen Cloudflare API key to inject ClickFix lures and distribute a malicious WordPress plugin through affected sites for about five and a half hours. The company says its core app, API, email delivery and customer data were unaffected.

Sep 17, 2026

AI-Assisted Intrusions, Active Exploitation and Security Industry Moves Feature in Weekly Roundup

The roundup covers stolen AI API keys, an AI-agent PaperCut campaign, fake helpdesk and passkey lures, actively exploited Cisco and GitLab flaws, and security industry and regulatory developments.

Sep 16, 2026