As your dedicated cybersecurity services provider, CyberOne equips you with timely and in-depth information about current cyber attacks. Discover a weekly cybersecurity report of the latest exploits and breaches shaping the ever-evolving cybersecurity landscape.
Weekly Cybersecurity Report | Week 38, 2026
Information security updates and events from the past week
1. Brevo Supply Chain Attack Injects Malicious ClickFix Scripts into 100,000+ Websites
Summary: Between September 14 and September 18, 2026, threat actors compromised marketing automation provider Brevo using an unauthorized API key, deploying a rogue Cloudflare worker that altered JavaScript delivered to client websites. The malicious script targeted more than 100,000 websites embedding Brevo widgets, serving visitors fake “ClickFix” CAPTCHA verification overlays designed to trick users into executing malicious PowerShell commands. For visitors logged into WordPress as administrators, the script attempted to silently install backdoored plugins.
Impact / Significance: Software supply chain compromise of widespread marketing infrastructure. A single compromised cloud service credential enabled attackers to weaponize tens of thousands of legitimate commercial and e-commerce websites, facilitating malware distribution and administrative content management system (CMS) takeovers.
Recommendations:
Website administrators embedding Brevo widgets should inspect WordPress installations for unauthorized plugin files or newly created administrator accounts.
Implement strict Content Security Policies (CSP) and subresource integrity (SRI) where possible to restrict unauthorized script execution from third-party CDN endpoints.
Educate end-users regarding “ClickFix” social engineering tactics that instruct users to paste clipboard text into command shells.
Source: BleepingComputer — Brevo Supply-Chain Attack Injected ClickFix Scripts on Customer Sites | SecurityWeek — Brevo Supply Chain Attack Injects Malware Into 100,000 Websites
2. Gyazo Data Breach Compromises 23 million User Records via Image Server Vulnerability
Summary: On September 18, 2026, Helpfeel, the parent company of screenshot and screen-recording utility Gyazo, disclosed that an attacker exploited an image upload server vulnerability to gain unauthorized database access. The breach exposed records belonging to approximately 23 million users, including email addresses, usernames, salted password hashes, and metadata linked to uploaded captures.
Impact / Significance: Mass exposure of user credentials and media metadata. While password hashes were salted, exfiltrated user lists fuel credential-stuffing campaigns across unrelated corporate services and increase spear-phishing risks. Additionally, sensitive data inadvertently captured in uploaded screenshots may be exposed to inspection.
Recommendations:
For Users: Reset passwords on Gyazo immediately and update credentials on any other platform where the same password was reused.
For Organizations: Enforce multi-factor authentication (MFA) across all enterprise services to neutralize credential-stuffing attacks stemming from external consumer service breaches.
Source: SecurityWeek — 23 Million User Records Compromised in Gyazo Data Breach | Security Affairs — Gyazo Data Breach Exposes 23 Million User Records
3. Critical Orkes Conductor Pre-Auth RCE Vulnerability Actively Exploited (CVE-2026-58138)
Summary: Security researchers and threat intelligence firms detected outbreak-scale exploitation of CVE-2026-58138 (CVSS 9.8), a critical vulnerability affecting Orkes Conductor versions 3.21.21 through 3.30.1. The flaw resides in unsandboxed GraalVM script evaluators handling inline workflow definitions, allowing remote unauthenticated attackers to execute operating system commands on host servers.
Impact / Significance: Core orchestration and workflow engine compromise. Orkes Conductor coordinates microservices, internal business workflows, and autonomous AI agents across enterprise cloud environments. Gaining unauthenticated code execution allows attackers to steal cloud access tokens, intercept data passing between microservices, and pivot laterally across backend infrastructure.
Recommendations:
Upgrade Orkes Conductor deployments immediately to version 3.30.2 or later.
Isolate workflow orchestration engines from public internet exposure by placing API endpoints inside private virtual private clouds (VPCs) or behind authenticated reverse proxies.
Restrict host execution permissions for the application service user and monitor for unexpected child process spawning (e.g., shell commands).
Source: SecurityWeek — Critical Orkes Conductor Vulnerability Exploited in Attacks | Falcon Internet — CVE-2026-58138: Pre-Auth RCE in Orkes Conductor
4. FBI and Global Law Enforcement Seize NightmareStresser DDoS-for-Hire Infrastructure
Summary: On September 17, 2026, the FBI, the U.S. Department of Justice, and international partners operating under Operation PowerOFF announced the seizure of domains and backend servers powering NightmareStresser. The service operated as one of the longest-running “booter” platforms on the cybercrime market, having facilitated hundreds of thousands of distributed denial-of-service (DDoS) attacks against government agencies, educational institutions, enterprise networks, and gaming infrastructure worldwide.
Impact / Significance: Disruption of commercialized cybercrime infrastructure. The seizure eliminates a primary low-barrier attack platform utilized by hacktivists and extorters. Furthermore, server seizures provide law enforcement with subscriber databases, target lists, and payment transaction logs, leading to subsequent investigations of platform customers.
Recommendations:
Organizations must maintain robust cloud DDoS mitigation and automated traffic scrubbing solutions capable of absorbing multi-vector volumetric floods.
Coordinate with upstream internet service providers (ISPs) to implement Border Gateway Protocol (BGP) Flowspec and automated blackholing for high-volume attacks.
Source: The Hacker News — U.S. Seizes NightmareStresser Domains Linked to DDoS Attacks | SecurityWeek — NightmareStresser DDoS Service Disrupted in International Operation
5. AI-Assisted Exploit and SSO Flaw Exposed Path to Internal OpenAI Code
Summary: On September 18, 2026, security researchers at Hacktron revealed findings from a rewarded bug bounty engagement demonstrating how a single sign-on (SSO) authentication flaw, chained with AI-generated exploit logic, opened access to internal OpenAI code repositories. By manipulating state parameters during account linking, the researchers automated reconnaissance and request generation using custom LLM agents to map private internal GitHub and API endpoints.
Impact / Significance: Highlights the dual threat of identity logic flaws and automated, AI-assisted exploit development. Adversaries and researchers alike are increasingly leveraging autonomous language models to rapidly identify subtle business logic bugs and automate complex multi-stage attack chains that traditional static scanners miss.
Recommendations:
Ensure strict state parameter validation and Proof Key for Code Exchange (PKCE) across all OAuth and SSO implementations to prevent unauthorized account linking.
Enforce strict network segmentation and domain isolation on developer environments and internal source code repositories.
Integrate behavioral anomaly detection on API and authentication flows to flag automated, high-velocity logic probing.
Source: SecurityWeek — AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code
The cybersecurity attacks highlighted in this report aren’t just incidents, they’re blueprints of the adversary’s arsenal. To protect your business you need the right partner. CyberOne is here to help! Check out our services.
