Cloudflare Worker

Brevo breach used stolen Cloudflare API key to push ClickFix malware to sites

Brevo disclosed that hackers obtained a hardcoded, full-permission Cloudflare API key and used it to deploy a rogue Cloudflare Worker that rewrote content at the CDN edge for roughly 5.5 hours on September 14. The tampered scripts, including Brevo's forms widget, Conversations tool and SDK loader embedded on customer sites, were altered to serve ClickFix malware while stripping security headers to evade detection.

bleepingcomputer.com · 2026-09-17

Blogger's server-side rules reclassify most 'browser' traffic as bots—without JavaScript

A blog operator built network and header-based rules on a Cloudflare Worker to sort incoming traffic without relying on JavaScript, and found that 277 of 372 requests bearing browser User-Agent strings were actually not genuine browsers—74.5% of the total. Comparing this edge-based counting with Cloudflare Web Analytics page loads over two days revealed persistent gaps between the two measurement methods, exposing bugs in the HTML-acceptance check and missing provenance markers, both since fixed.

gkoreli.com · 2026-09-07