Security Affairs round 603: ARTEX bank breaches, fridge attacks and $6 billion Binance theft
BREACHBinanceredteam/daily · 1 source
- Severity
- High
- Highest CVSS
- 9.8
- Exploited
- Not known
- Sources
- 1
What happened
Notable items include CVE-2026-58868, a critical Android bug that could allow remote code execution, and two Barracuda Email Security Gateway pre-auth root flaws, CVE-2026-116606 and CVE-2026-111560, for which patches have been released. CISA added SonicWall SonicOS SSLVPN, Apple and WordPress flaws to its KEV catalogue. Defenders should apply the Barracuda patches, prioritise KEV-listed internet-facing products, and check whether Synology NAS devices are running outdated DSM versions that are being targeted by ransomware.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Apply the released patches for the Barracuda Email Security Gateway flaws.
- Check whether any SonicWall, Apple or WordPress products you use are covered by the CISA catalogue entries and patch them.
- Update Synology NAS devices that are running outdated DSM versions.
Written by AI from the sources, checked against them
Vulnerabilities
- CVE-2026-58868CVSS 9.8In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-116606CVSS 9.3An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configur
- CVE-2026-111560CVSS 8.6Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently proces
Full story timeline · 4 updates
Who reported · 1 outlet
Security Affairs