Daily Brief

Wednesday’s brief: Barracuda gateways go from no login to root, then Chrome 157, cPGuard and WordPress

Wednesday’s brief: Barracuda gateways go from no login to root, then Chrome 157, cPGuard and WordPress

Barracuda CVE-2026-116606 chain to root, Chrome 157 critical fixes, the cPGuard update channel hijack and WordPress CVE-2026-119977 on CISA KEV with a November 6 deadline.
CISA now lists the WordPress update bug as exploited. Patch, then check your last update

CISA now lists the WordPress update bug as exploited. Patch, then check your last update

CISA added WordPress Core CVE-2026-119977 to its KEV catalog on November 3 with a November 6 deadline and forensic triage. Confirm 7.1.4 or your branch release and review logs around core updates.
Hosting servers running cPGuard: hijacked updates copied password hashes and SSH keys. Update, then rotate

Hosting servers running cPGuard: hijacked updates copied password hashes and SSH keys. Update, then rotate

OPSSHIELD says cPGuard 5.88.12 to 5.88.19 shipped a backdoor that copied /etc/shadow, MySQL settings and root SSH files on November 2. Update to 5.88.25, check install_log and rotate credentials.
Chrome 157 fixes seven critical bugs. Push it and make browsers restart

Chrome 157 fixes seven critical bugs. Push it and make browsers restart

Chrome 157 (157.0.8103.38/.39) fixes 213 security bugs, including critical CVE-2026-121156, CVE-2026-121035 and CVE-2026-121126. Desktop, Android and Extended Stable versions and rollout checks.
Barracuda email gateways: two bugs go from no login to root. Confirm the November 2 patch landed

Barracuda email gateways: two bugs go from no login to root. Confirm the November 2 patch landed

Barracuda CVE-2026-116606 (9.3) and CVE-2026-111560 (8.6) chain to root on Email Security Gateway; the command injection also hits WAF, ADC, BMA, WCC and WSG. Patch numbers and checks.
Tuesday’s brief: Linux servers need a kernel reboot, then TeamViewer, Android phones and unpatched GitLab

Tuesday’s brief: Linux servers need a kernel reboot, then TeamViewer, Android phones and unpatched GitLab

Linux kernel CVE-2026-98432 fixed kernels and reboots, TeamViewer CVE-2026-111585 viewer flaw, the November Android update and 1,000+ GitLab servers still open to CVE-2026-97229.
Run your own GitLab? More than 1,000 servers still have the bug attackers use. Upgrade, then update Runner

Run your own GitLab? More than 1,000 servers still have the bug attackers use. Upgrade, then update Runner

Shadowserver counts over 1,000 GitLab servers open to exploited CVE-2026-97229 and 11,300 to CVE-2026-110264. Upgrade to 19.5.3 or your branch release and update GitLab Runner to 19.5.1.
Company Android phones: November’s update fixes a flaw that needs no tap. Check every patch level

Company Android phones: November’s update fixes a flaw that needs no tap. Check every patch level

The Android November 2026 bulletin fixes critical Framework flaw CVE-2026-58868 and System bugs CVE-2026-58876 and CVE-2026-58936. Patch levels 2026-11-01 and 2026-11-05 and fleet checks.
Support techs: a TeamViewer bug lets the computer you connect to attack yours. Update to 15.83

Support techs: a TeamViewer bug lets the computer you connect to attack yours. Update to 15.83

TeamViewer CVE-2026-111585 (CVSS 8.8) lets a malicious host attack the connecting viewer. Full Client, Portable and Android app before 15.83 affected, plus CVE-2026-92372 and CVE-2026-92374.
Linux servers: fixed kernels for the remote-root TCP bug are out, and they only count after a reboot

Linux servers: fixed kernels for the remote-root TCP bug are out, and they only count after a reboot

Linux kernel CVE-2026-98432 (CVSS 9.8) allows remote root via IPv4 TCP. Red Hat RHEL 8, Amazon Linux and stable kernels are fixed, Ubuntu is in -proposed. Versions, mitigations and checks.
Monday’s brief: Ivanti’s last VPN fix is due today, then WordPress update attacks, a fake Claude Code extension and Drupal stores

Monday’s brief: Ivanti’s last VPN fix is due today, then WordPress update attacks, a fake Claude Code extension and Drupal stores

Ivanti Connect Secure CVE-2026-111357 on CISA KEV due Nov 2, WordPress CVE-2026-119977 upgrade-window attacks, a backdoored Claude Code extension in Cursor and exploited Drupal Commerce Core.
Drupal stores: attackers are using a Commerce Core flaw that can cost you money. Update and audit your orders

Drupal stores: attackers are using a Commerce Core flaw that can cost you money. Update and audit your orders

Drupal Commerce Core CVE-2026-118539 (SA-CONTRIB-2026-254) is exploited in the wild. Update to 3.3.13 or 8.x-2.41 and audit store orders. Affected versions, checks and sources.
A fake Claude Code update in Cursor tried to plant an SSH key on developer machines. Run the one-line check

A fake Claude Code update in Cursor tried to plant an SSH key on developer machines. Run the one-line check

Malicious Anthropic.claude-code 2.1.312 and 2.1.313 in the Cursor marketplace planted an svc-telemetry SSH key and reverse tunnel on Oct 29. How to check, clean up and rotate credentials.