14 October 2026

AI news of the week: the Brevo attack, WhatsApp now charges for some messages, and a correction

This week there are two items that may affect your website or your WhatsApp, and a correction to a previous article of mine. Let me start with the correction, because I do not want anyone acting on an incorrect fact.

Correcting two facts from the 24 September article

In the 24 September article I said that the Cyber Resilience Act "entered into force on 11 September". That is not accurate: that day the reporting obligations for manufacturers of products with digital elements started to apply. The early warning must be made within 24 hours and the full notification within 72. According to the European Commission, it is submitted through a single ENISA platform and reaches the CSIRT of the country where the manufacturer has its main establishment. I wrote that it had to be reported to INCIBE, and I have not been able to confirm that. The overall picture still holds: it only affects those who manufacture or sell software or connected products.

On WhatsApp Business, I spoke of a quota of 1,000 free messages a month per number and of a service cut-off on 1 October. I have not been able to confirm the quota, and what the sources say is more specific: the change affects only the API platform, and without a registered payment method Meta may stop delivering service messages. More on that below. I have added a visible update note to the old article and left its original text unchanged.

An attack on Brevo altered forms and chats on thousands of websites

On 14 September, attackers used a stolen Cloudflare key to modify, for about five hours, the scripts that Brevo, an email-marketing tool, offers for embedding forms and chats on websites. According to BleepingComputer, it may have affected around 100,000 websites. Visitors were shown a fake "verification" asking them to run a command on their computer. Brevo says customer accounts and email sending were not affected and that the malicious code has been removed.

How does this affect me?

As a person: no legitimate website asks you to copy and paste a command to "verify you are not a robot". If you did so on 14 September, change your passwords from another device and run an antivirus scan on the computer.

If you run a business or are self-employed: check whether your website loads third-party forms, chats or buttons. If you use WordPress and logged in as administrator on 14 September, check there are no plugins you do not remember installing and change the administrator password. If you use Brevo, change the account password, enable two-step verification and be wary of emails claiming to be from Brevo.

WhatsApp Business now charges for some messages (only if you use the API)

Since 1 October, Meta charges per message for service and utility messages sent within 24 hours after the customer writes to you, according to Sahara Reporters. It affects the WhatsApp Business API platform, not the free app. According to Yournotify, without a registered payment method Meta may stop delivering service messages.

How does this affect me?

If you run a business or are self-employed: if you reply by hand with the WhatsApp Business app, nothing changes. If you have a bot, automatic appointment reminders or a CRM connected to WhatsApp, ask your provider how much you will be charged and check that you have a payment method registered, because without one service messages may stop arriving.

Sources

Brevo supply-chain attack (BleepingComputer); Cyber Resilience Act: incident reporting (European Commission); WhatsApp to start charging businesses for customer messages on 1 October (Sahara Reporters); WhatsApp pricing update, October (Yournotify).