Good morning. Barracuda patched two bugs that chain from no login to root on its email gateway, and one of them reaches five more of its appliance lines. Chrome 157 brings seven critical fixes, an attacker shipped a backdoor through the cPGuard server tool’s own updates, and CISA now lists the WordPress update bug we flagged Monday as exploited.
Lead Story
Two Barracuda bugs take an Email Security Gateway from no login to root, and one also hits its WAF, load balancer, archiver and web gateway. Check the patch numbers →
Also Worth Your Attention
Chrome 157 fixes 213 security bugs, seven of them critical, and only applies after a restart. Set a relaunch deadline →
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
An attacker pushed a backdoor through cPGuard’s update channel and copied password hashes and SSH keys from hosting servers. Rotate what it took →
CISA added the WordPress update bug we flagged Monday to its exploited list, with a Friday deadline for agencies. Check your last update →
Also on the radar: attackers are exploiting a Node-RED flaw tracked as CVE-2026-58115, filed by Siemens for its SIMATIC IoT2050 devices, against Node-RED installs with no admin login, leaving bots and webshells; VulnCheck advises checking whether any Node-RED editor is reachable from the internet (VulnCheck, Siemens advisory, Node-RED security guide). The maker of the mSecure password manager emailed customers about suspicious activity and urged password, 2FA and passkey resets without saying what happened (The Hacker News).
Resetting server passwords this week? Our password strength checker shows how long a new password would stand up to guessing if its hash ever leaks.
Source: Barracuda advisory; Chrome 157 release; OPSSHIELD advisory; CISA KEV alert
Slack paste: Barracuda: confirm the November 2 patch on ESG, WAF, ADC, BMA, WCC and WSG and keep admin pages off the internet; Chrome to 157.0.8103.38 with a relaunch deadline; cPGuard to 5.88.25, check install_log, rotate passwords and keys on any server that took 5.88.12 to 5.88.19; WordPress on 7.1.4 or branch release, then review logs around the last core update.
Go Deeper
- Cybersecurity tools for patch tracking and appliance checks
- Identity and access management: rotating credentials after a leak
Get this in your inbox every weekday morning: subscribe to the Daily Brief.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
