Verified status as of November 4, 2026
Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.
- CVE-2026-116606 in Barracuda Networks Products: the source articles reported no exploitation. NVD rates it 9.3 (CRITICAL) on CVSS v4.0.
- CVE-2026-111560 in Barracuda Networks Products: the source articles reported no exploitation. NVD rates it 8.6 (HIGH) on CVSS v4.0.
- CVE-2023-7102 in Barracuda Email Security Gateway: the source articles reported no exploitation. NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a vendor advisory.
- CVE-2023-2868 in Barracuda Networks Email Security Gateway (ESG) Appliance is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2023-05-26; federal remediation due 2023-06-16). NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a vendor advisory.
TL;DR
Barracuda Networks disclosed two critical vulnerabilities that chain to grant root access; cPGuard's update infrastructure was compromised to deploy backdoors; and Google warns LLMjacking attacks are costing enterprises up to $1 million in fraudulent cloud charges.
Executive Summary
- Barracuda disclosed two chained vulnerabilities (CVE-2026-116606, CVE-2026-111560) affecting its security products that allow attackers to bypass authorization and gain root-level access.
- cPGuard web security suite's autoupdate infrastructure was hijacked to distribute a backdoor and data-stealing script to customers.
- Google reports LLMjacking attacks are generating fraudulent cloud charges exceeding $1 million for some organizations, with daily losses reaching $100,000+ per victim.
- mSecure password manager users were warned to reset passwords, 2FA, and passkeys following suspicious activity in customer accounts.
- Chainstack blockchain infrastructure provider disclosed a production systems breach involving customer data and password hashes, attributed to an AI-powered attack campaign.
Top Threats Today
1. Barracuda Critical Vulnerabilities Chain to Root Access
Severity: CRITICAL Affected: Technology
Barracuda has disclosed two vulnerabilities affecting its products that, when chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device [1]. The vulnerabilities include a pre-authentication authorization bypass vulnerability and a command injection flaw ⚠[1]. Barracuda Networks warned customers to patch the flaws, identified as CVE-2026-116606 and CVE-2026-111560 [2].
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Identify all Barracuda products in your environment and cross-reference with vendor advisory for affected versions
- Apply security patches provided by Barracuda immediately
- Monitor for unauthorized access attempts and privilege escalation on affected systems
2. cPGuard Update Infrastructure Compromised to Deploy Backdoor
Severity: HIGH Affected: Technology
Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script [1]. This supply-chain attack affects all customers relying on the autoupdate mechanism.
Sources:[1] BleepingComputer
Recommended Action
- Isolate or disconnect cPGuard-protected systems from the network pending vendor guidance
- Review cPGuard update logs for suspicious installation timestamps and payloads
- Scan affected systems for backdoor artifacts and data exfiltration
- Contact cPGuard support for forensic guidance and patched update server availability
3. LLMjacking Attacks Generating Up to $1 Million in Fraudulent Cloud Charges
Severity: HIGH Affected: Technology
Google reported that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services, a tactic known as LLMjacking [1]. Some organizations have lost more than $100,000 per day, with total losses exceeding $1 million for affected victims [1][2]. The attack leverages compromised API keys or stolen credentials to access cloud-hosted LLM services [1].
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Audit all LLM API keys and service account credentials; rotate keys showing signs of compromise
- Implement API rate limiting and cost threshold alerts on cloud LLM services
- Enable multi-factor authentication and IP whitelisting on all LLM service accounts
- Review cloud billing dashboards for unusual compute resource consumption or API call patterns
4. mSecure Password Manager Warns of Account Compromise
Severity: HIGH Affected: Technology
Customers of the mSecure password manager have been urged to change passwords, reset two-factor authentication, and remove passkeys following suspicious activity detected in customer accounts [1]. The warning was issued via email on November 3.
Sources:[1] The Hacker News
Recommended Action
- All mSecure users should immediately change their master password and reset 2FA/passkeys
- Review account activity logs within mSecure for unauthorized access or exported credentials
- Change all high-risk passwords stored in mSecure (banking, email, admin accounts) on their respective platforms
- Consider migrating to an alternative password manager until full details of the incident are disclosed
5. Chainstack Production Breach Exposes Customer Data and Password Hashes
Severity: HIGH Affected: Finance
Blockchain infrastructure provider Chainstack disclosed that it was targeted in a cyber attack allowing an unauthorized party to gain access to parts of its infrastructure [1]. The incident is assessed to be part of a large-scale, artificial intelligence (AI)-powered attack campaign, with exposed data including customer information and password hashes [1].
Sources:[1] The Hacker News
Recommended Action
- Chainstack customers should reset credentials used to access the platform
- Monitor blockchain wallets and API activity for unauthorized transactions or access
- Review Chainstack's incident disclosure for full scope of exposed data
Today’s Action Checklist
- ☐ URGENT: Apply Barracuda security patches (CVE-2026-116606, CVE-2026-111560) to all affected systems
- ☐ URGENT: Isolate or update cPGuard installations pending vendor-provided clean update server
- ☐ HIGH: Audit and rotate all LLM API keys; implement rate limiting and cost alerts on cloud AI services
- ☐ HIGH: Reset mSecure master password and 2FA; change all sensitive passwords stored in the vault
- ☐ HIGH: Reset Chainstack credentials and monitor for unauthorized blockchain activity