Brevo supply-chain attack injected ClickFix scripts on customer sites

🕵️ RESEARCH & DEEP DIVES

• Dark Reading to host Cybersecurity Outlook 2027 virtual event on Dec 3, 2026
  Dark Reading has announced its Cybersecurity Outlook 2027 virtual event for December 3, 2026.

  • Aimed at security teams defending multi-cloud and hybrid environments.
  • Event will examine upcoming threats from cybercriminals and nation-states.
  • Sessions will cover AI-driven technologies and tools for mitigating those threats.
  • Speakers include industry analysts, experts, and threat researchers, delivered in a virtual format.
  Sources 📎 Coverage: darkreading.com · 👁 via Dark Reading

• MidnightBSD mport audit bug (CVE-2026-54577) can inspect wrong package, fixed in 2.7.8
  A parsing flaw in MidnightBSD's mport package manager could cause the audit command to inspect the wrong package, fixed in version 2.7.8.

  • Applies to MidnightBSD users running the mport package manager in versions prior to 2.7.8.
  • The audit command passed unadjusted arguments to audit_package(), so options like -r before a package name could make it audit the option token instead of the requested package.
  • Result is a false-negative or useless audit result that could leave a vulnerable package unidentified; fixed in 2.7.8 by resetting optind and optreset before using adjusted arguments.
  • Tracked as CVE-2026-54577 with a low CVSS 4.0 score of 2.0, requiring local access, low privileges, and an attack time condition.
  Sources 📄 Source: github.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

• Brevo supply-chain attack injected ClickFix scripts on customer sites — BleepingComputer

• Cyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board Vessels — SecurityWeek

• ‘Flock City PD:’ The Fake Flock-Owned ‘Police Department’ That Searched Real Cameras for Real People — 404 Media

• mport package fetch and clean paths are vulnerable to TOCTOU filesystem races... — CVE ThreatInt

• Assertion failure in the DNS stub resolver with a long search domainInitializ... — CVE ThreatInt

• mport verify can compare stale checksum data after hashing failuresmport is t... — CVE ThreatInt

• mport permits repository and package mirror fetches over insecure transportmp... — CVE ThreatInt

• mport sample file handling can write outside the configured rootmport is the ... — CVE ThreatInt

• mport index decompression can leave partial or corrupt index data after zstd ... — CVE ThreatInt

• mport package installation can overwrite existing unmanaged or differently ow... — CVE ThreatInt

• mport package bundle downloads allow unsafe destination filenamesmport is the... — CVE ThreatInt

• mport bootstrap index fetch can continue after hash verification failuremport... — CVE ThreatInt

• SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulner... — CVE ThreatInt

• MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Stat... — CVE ThreatInt

• SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query ... — CVE ThreatInt

• MISP Background Job Argument Injection via Console Path Switches Enables Remo... — CVE ThreatInt

• AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not ver... — CVE ThreatInt

• batman-adv: dat: atomically update mac addressesIn the Linux kernel, the foll... — CVE ThreatInt

• batman-adv: bla: avoid CRC corruption due to parallel claim addIn the Linux k... — CVE ThreatInt

• i3c: master: Fix recursive locking during device registrationIn the Linux ker... — CVE ThreatInt

• dm-pcache: validate seg_id fields from persistent memoryIn the Linux kernel, ... — CVE ThreatInt

• i3c: master: Fix use-after-free of master->thisIn the Linux kernel, the follo... — CVE ThreatInt

• From guidance to action: Security fundamentals that materially reduce risk — Microsoft Security Blog

• Improving email security outcomes with real-world Microsoft Defender insights — Microsoft Security Blog

• pass the bong PS: Google fired this guy for misconduct, so Microsoft hired him. — @GossiTheDog@cyberplace.social

• OpenAI Models Searched for Leaked API Keys and Uploaded Files Without Permission — Cyber Security News

• This is Taco, we both hope you're having a great day. — @zackwhittaker@mastodon.social

• FatPipe MPVPN, WARP, IPVPN RCE via Stack Buffer Overflow (CVE-2026-90823) — thehackerwire.com (discovered)

• Working on a claude Skill — r/netsec