Security Affairs round 603: ARTEX bank breaches, fridge attacks and $6 billion Binance theft
BREACHBinanceredteam/daily · 1 source
- Severity
- High
- Highest CVSS
- 9.8
- Exploited
- Not known
- Sources
- 1
What happened
The newsletter covers the ARTEX bank breaches in South Korea, a series of attacks on refrigeration systems across Europe, and the FBI's attribution of a $6 billion Binance theft to North Korea. It also reports that CISA added SonicWall SonicOS SSLVPN, Apple and WordPress flaws to its Known Exploited Vulnerabilities catalogue, and that two Barracuda ESG flaws could be combined for full root access. Synology warned of ransomware targeting NAS devices running outdated DSM versions.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Apply the released patches for the Barracuda Email Security Gateway flaws.
- Check whether any SonicWall, Apple or WordPress products you use are covered by the CISA catalogue entries and patch them.
- Update Synology NAS devices that are running outdated DSM versions.
Written by AI from the sources, checked against them
Vulnerabilities
- CVE-2026-58868CVSS 9.8In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-116606CVSS 9.3An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configur
- CVE-2026-111560CVSS 8.6Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently proces
Full story timeline · 4 updates
Who reported · 1 outlet
Security Affairs