Brevo ClickFix supply-chain attack: what to check if you embed Brevo
On September 14, 2026 attackers used a stolen Cloudflare API key to inject ClickFix scripts into Brevo CDN responses for about 5.5 hours. Checklist for personal and small WordPress sites that embed Brevo forms or widgets.