Reported by 3 outlets
A stolen API key turned Brevo's CDN into a supply-chain weapon - fake CAPTCHAs, silent WordPress backdoors. 9 detections, 24 IOCs. Full anal
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.57 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
update from securityaffairs.com
Brevo Supply-Chain Attack Infected Over 100,000 Websites
securityaffairs.com · 25d ago · September 18th, 2026
Brevo Supply-Chain Attack Infected Over 100,000 Websites. A compromised API key was used to weaponize Brevo's CDN infrastructure, distributing fake CAPTCHA pages that silently injected backdoors into WordPress installations across more than 100,000 sites.
via Mastodon https://securityaffairs.com/199355/hacking/brevo-supply-chain-attack-infected-over-100000-websites.html
-
update from theperimetersite.com
Brevo had a rough week, and if you've been following the news, you probably saw that a supply chain attack managed to slip malicious scripts
theperimetersite.com · 24d ago · September 19th, 2026
Brevo had a rough week, and if you've been following the news, you probably saw that a supply chain attack managed to slip malicious scripts
via Mastodon https://theperimetersite.com/report/277
-
mentioned by securityaffairs.com
Brevo Supply-Chain Attack Infected Over 100,000 Websites https:// pawb.social/post/50291188
securityaffairs.com · 24d ago · September 19th, 2026
-
mentioned by securityaffairs.com
Brevo Supply-Chain Attack Affected Over 100,000 Websites https:// securityaffairs.com/199355/hacking /brevo-supply-chain-attack-infected-ove
securityaffairs.com · 24d ago · September 19th, 2026