Barracuda patched two flaws that can be chained to give attackers root access to Email Security Gateway appliances. Barracuda has patched two vulnerabilities that can be chained to gain root access to its Email Security Gateway (ESG) appliances. CVE-2026-116606 (CVSS score of 9.3) is an authentication bypass that lets unauthenticated attackers modify appliance configurations. CVE-2026-111560 (CVSS score of 8.6) is a command injection flaw affecting six Barracuda products. An attacker with administrator privileges could exploit it to execute operating system commands as root. “Barracuda has identified two vulnerabilities affecting certain Barracuda products: a pre-authentication authorization bypass vulnerability and a command injection vulnerability. The vulnerabilities have been assigned CVE-2026-116606 and CVE-2026-111560, respectively.” states the advisory. “Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device.” Barracuda quickly began fixing the problem and released security patches for affected products. Customers should check the affected products and follow the remediation guidance, make sure their systems use the latest firmware, and install all security patches. It has released patches and urges customers to update their systems, below are the affected products: Email Security Gateway (ESG) — affected by both vulnerabilities; patch with BNSF-40425 for version 9.4.017 or later, or BNSF-40430 for versions below 9.4.017. Load Balancer Application Delivery Controller (ADC) — affected by CVE-2026-111560; patch with BNADC-16586. Message Archiver (BMA) — affected by CVE-2026-111560; patch with BNMA-32468. WAF Control Center (WCC) — affected by CVE-2026-111560; patch with BNWF-60060. Web Application Firewall (WAF) — affected by CVE-2026-111560; patch with BNADC-16586. Web Security Gateway (WSG) — affected by CVE-2026-111560; patch with BNYF-24789. The vendor recommends that customers: Restrict administrative interfaces to trusted internal networks and use network access controls to reduce exposure. Check that devices are running the latest firmware and that all security patches are installed. If a device is several versions behind, install updates step by step; more than one update may be needed. Contact Barracuda Support if help is required. “If a patch has not been automatically applied, customers should manually apply the appropriate patch as soon as possible. If customers have turned off automatic patching, Barracuda recommends setting devices to automatically receive patches.” concludes the advisory. “Guidance on how to manually apply the patch or update firmware can be found on Barracuda Campus.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Barracuda)
DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords. This follows the American web hosting provider and domain registrar's announcement that it suffered a cybersecurity incident requiring users to reset their email and FTP/SFTP passwords. In a data breach notification, DreamHost now says the breach extended from August 2026 to October 23, 2026, the day it was discovered. "We discovered that an unauthorized third party accessed the server that runs our web-based File Manager at files.dreamhost.com," reads the notification. "The unauthorized third party exploited a vulnerability in that software and was able to access the FTP/SFTP usernames and passwords of individuals who logged into this File Manager between approximately August 2026 and October 23, 2026."
Cyberattacks disrupted refrigeration monitoring systems at three French blood banks, amid similar attacks targeting European supermarkets. A cyberattack has hit three regional blood banks in France, disrupting systems used to monitor and control refrigerated storage facilities. The incident took place overnight between Sunday and Monday, at roughly the same time hackers were targeting supermarket refrigeration systems across several European countries. The attack is particularly concerning because it targeted infrastructure that plays a direct role in protecting public health. Blood products must remain within specific temperature ranges to preserve their quality and ensure they’re safe for medical use. A disruption to refrigeration systems can therefore have consequences that go well beyond a conventional IT outage. According to the French Health Ministry, the incident affected several facilities operated by the French Blood Establishment (EFS). “Several regional facilities of the French Blood Establishment (EFS) were affected by a cybersecurity incident that impacted certain cold storage room monitoring and control systems,” the health ministry said in a statement. “The incident had no impact on blood supplies,” Reuters reported, quoting EFS spokesperson Charley Dubois. Staff working around the clock received alerts about the problems and moved blood products to refrigerators that weren’t connected to the affected systems. This response helped prevent the incident from disrupting blood supplies, demonstrating how important operational procedures and contingency plans are when technology fails. “The situation was under control on Wednesday,” the French Health Ministry said, according to Reuters, which also reported that remote access to the affected refrigerators had been disabled. Investigations are now underway to establish how the attackers gained access, which equipment was affected and when the systems can safely return to normal operation. The timing is also significant. The French blood bank incident coincided with attacks against supermarket refrigeration systems in eight European countries, including Sweden and Belgium. Those attacks forced retailers to discard large quantities of food after hackers interfered with cooling and freezer systems. This wasn’t the first time French supermarkets had faced csxk cx incident. In October, police investigated an attack in which hackers allegedly seized control of cooling units at hundreds of supermarkets, causing fires and significant food losses. These incidents share similarities that deserve attention. They point to a security problem beyond traditional corporate IT systems: the growing exposure of operational technology (OT), including industrial control systems, refrigeration equipment, and the remote management platforms kdch operate them. These systems are often connected to corporate networks or accessible through remote management services. If attackers compromise those access points, they may be able to interfere with physical processes rather than simply steal information or encrypt business data. The consequences can be serious. In a supermarket, an attacker who manipulates refrigeration controls can cause food losses and potentially create safety risks. In a blood bank, the same type of interference could threaten the integrity of medical supplies and disrupt services that hospitals depend on. The French incident didn’t affect blood supplies, but the outcome shouldn’t lead organizations to underestimate the risk. Staff intervention and the availability of independent refrigerators helped contain the damage. Not every facility will have the same resources, response procedures or ability to move critical products at short notice. Organizations operating critical infrastructure need to treat the security of connected equipment as a core operational requirement. This means identifying exposed systems, restricting remote access, enforcing strong authentication, segmenting operational networks and monitoring changes to equipment settings. They also need tested manual procedures that allow essential services to continue when digital systems become unavailable or untrustworthy. The European Union has already raised concerns about vulnerabilities in connected infrastructure amid heightened security tensions following Russia’s invasion of Ukraine in 2022. These latest incidents reinforce the need to consider cyberattacks against physical systems as a real operational and public safety risk, not simply an IT problem. “Investigations are under way into how the attack was carried out, what equipment may have been affected and when systems can safely return to service.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, French Blood Banks)
mSeven Software is warning current and former mSecure password manager customers to change passwords, reset two-factor authentication, and remove passkeys following a cyberattack in which a hacker reportedly stole an encrypted customer database.. In a security notification sent to customers on November 3 and shared with BleepingComputer, the company said it recently discovered suspicious activity involving its mSecure password management application. "mSeven Software (“mSeven”) recently learned of suspicious activity associated with the mSecure password management application," reads the mSecure security notification. "In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist. You are receiving this email because you are a current or former mSecure customer."
SonicWall has warned of two vulnerabilities impacting end-of-life Global Management System (GMS) systems that it said will not be patched. Details of the security flaws, which affect SonicWall GMS 9.5.2 and earlier versions, are below - CVE-2026-109593 (CVSS score: 9.1) - An unauthenticated file read vulnerability that could allow an attacker with network access to read internal GMS files,
Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications. According to the company, the attacker used an AI offensive security framework to automate reconnaissance and exploitation attempts. Based on evidence from the investigation, no WorkOS app data or production services were accessed or affected. WorkOS is a developer infrastructure company that provides APIs, SDKs, and tools for integrating services such as enterprise authentication, single sign-on (SSO), user management, and identity management into applications. According to its website, at least 3,000 companies use its services, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify. “On October 30, 2026, we identified unauthorized access to an internal WorkOS application used by our sales team,” the company says in an incident alert.
Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day. Companies can record costs as high as $1 million due to fraudulent calls using stolen API keys, researchers at Google's Threat Intelligence Group (GTIG) and Mandiant in analyzed incidents. Based on their observations, there are "two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure." The researchers identified two categories of threat actors: those who scan for publicly exposed LLM endpoints and those who steal valid API keys from unprotected machines. After gaining initial access, the attackers sell it to services known as LLM mixers, which provide their subscribers with unauthorized access to LLMs.
Synology warns of ransomware attacks exploiting a 2024 flaw in outdated NAS devices, urging users to update DSM immediately. A security fix released in 2024 is now at the centre of ransomware attacks against Synology NAS devices. The company has found attackers targeting systems that still run outdated versions of DiskStation Manager (DSM), putting files stored on these network storage devices at risk of encryption and extortion. Synology disclosed the attacks on October 29, 2026. Its investigation found that threat actors are taking advantage of a vulnerability that the vendor had already addressed in December 2024. “These attacks aim to encrypt data and extort ransom.” The warning highlights how devices left without security updates can remain exposed long after vendors have released a fix. The company hasn’t identified the exact vulnerability used in the attacks. Instead, it refers customers to Synology-SA-24:20, a security advisory published on November 5, 2024, which documents three flaws affecting DSM. The advisory was updated as fixes became available across different software branches, with the DSM 6.2 update released on December 5. The three vulnerabilities have different security implications. CVE-2024-10441 is the most severe, with a CVSS score of 9.8. It affects the system plugin daemon and could allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable device. CVE-2024-50629 has a CVSS score of 5.3 and affects the DSM webapi component. It could allow remote attackers to read limited files. The third issue, CVE-2024-10445, is rated 4.3 and concerns improper certificate validation in the update functionality. It could allow an attacker in an adjacent network position to write limited files. Synology hasn’t confirmed which of these vulnerabilities attackers are exploiting. The three flaws should therefore be considered part of the security advisory, not three confirmed entry points in the current ransomware campaign. The vendor has released corrected builds for all the affected DSM branches. Users should check the full version number installed on their NAS and compare it with the minimum fixed releases listed in the advisory: DSM 7.2.2: 7.2.2-72806-1 or later. DSM 7.2.1: 7.2.1-69057-6 or later. DSM 7.2: 7.2-64570-4 or later. DSM 7.1: 7.1.1-42962-7 or later. DSM 6.2: 6.2.4-25556-8 or later. The impact of a ransomware infection on a NAS can extend well beyond the storage device itself. Businesses often use these systems to keep shared documents, operational files and backup copies in one place. If attackers encrypt that data, employees may lose access to essential information, while recovery can become much harder if the NAS also holds the backups needed to restore other systems. Updating DSM is therefore an immediate priority for administrators and home users alike. Synology is also advising customers to enable automatic updates so that future security fixes don’t depend entirely on someone checking for them manually. “Synology also recommends enabling automatic updates to keep DSM up to date at all times.” concludes the advisory. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, NAS)
Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges. The first is a critical flaw (CVE-2026-116606) stemming from an Email Security Gateway (ESG) authentication weakness that attackers can exploit to modify an appliance's global configuration, while the second (CVE-2026-111560) lets threat actors with admin permissions inject OS commands that run as root. However, Barracuda said successful exploitation also requires access to the administrative interfaces of targeted devices and advised customers to use appropriate network access controls and restrict access to trusted internal networks to limit exposure. "Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device," the company explained.
A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host. Researchers at cybersecurity company Bitdefender believe the threat actor may have used AI-generated commands and an automated agentic loop to carry out the operation. The conclusion is based on a sequence of repeated commands that were slightly modified at each attempt and issued at roughly regular intervals of 40 to 100 seconds. "We were not able to access the machine the attacker worked from, so we cannot document anything about the language model itself: which model it was, whether it ran locally or remotely, or even whether a person was copying and pasting instructions and results between the implant and the model," Bitdefender explains.
Confirm this action.
Leaving now will discard your changes.