Tag

Barracuda

All articles tagged with #barracuda

Barracuda Patches Critical Chain Granting Unauthenticated Root Access on Email Security Gateway

Barracuda released patches for two critical vulnerabilities that can be chained to achieve unauthenticated root access on its Email Security Gateway. The first flaw, CVE-2026-116606, is an authorization bypass allowing attackers to restore crafted configuration backups. The second, CVE-2026-111560, is a command injection vulnerability that executes commands as root. While the command injection affects multiple products, it typically requires administrative access; however, the authorization bypass on the Email Security Gateway circumvents this requirement. Mandiant assigned CVSS scores of 9.3 and 8.6 to the respective flaws. Security firm watchTowr detailed the attack chain, noting that a failed password change returns a low-privilege role, exposing backup-restore functions to unauthenticated users. The restored data includes a timezone value executed as a shell command. Barracuda advises applying the patch, restricting administrative interfaces to trusted networks, and re-enabling automatic patching.

via The Hacker News|

#barracuda #cve-2026-111560 #cve-2026-116606

cybersecurity4 days ago

Barracuda Discloses Critical Flaws Enabling Root Access via Chained Exploitation

Barracuda has disclosed two critical vulnerabilities, CVE-2026-116606 and CVE-2026-111560, that can be chained to bypass authorization and gain root access on its security appliances. The first flaw, a pre-authentication authorization bypass, affects only the Email Security Gateway, while the second, a command injection vulnerability, impacts a wide range of products including load balancers, web application firewalls, and message archivers. Although the command injection flaw has a CVSS score of 8.6 and the authorization bypass scores 9.3, successful exploitation requires an attacker to already have access to the administrative interface of the affected device. Barracura advises organizations to restrict administrative interface access to trusted internal networks and ensure all systems are running the latest firmware, noting that devices multiple versions behind may require multiple updates to reach a secure state.

via The Hacker News|

#authorization-bypass #barracuda #command-injection

odd-news2 years ago•0 min saved

"Joyful Dive Turns Terrifying: Man Blindsided in Water"

A tourist in Puerto Rico experienced a moment of terror when a barracuda shot out at him from behind like a torpedo as he dove into the water off Cayo Icacos Island, turning laughter into screams before the fish only bumped him, leaving witnesses relieved and amused. The incident was captured on TikTok by Maggie Clark, who reassured viewers that no barracudas were harmed in the making of the video.

via Yahoo Sports|

#barracuda #cayo-icacos-island #odd-news

cybersecurity3 years ago•2 min saved

Barracuda Zero-Day Attacks: Chinese Hackers Target US Government and Telecom

Suspected Chinese hackers targeted government and government-linked organizations worldwide in a series of zero-day attacks on Barracuda Email Security Gateway (ESG). A Mandiant report revealed that almost a third of the hacked appliances belonged to government agencies, with a focus on entities across the Americas. The attacks, motivated by espionage, involved the exfiltration of data from high-profile users in government and high-tech sectors. Barracuda issued patches for the vulnerability on May 20 but later discovered that the zero-day bug had been exploited for at least seven months. The FBI warned that the patches were ineffective, and compromised devices are still being targeted. Customers are advised to replace hacked appliances and investigate their networks for potential breaches.

via BleepingComputer|

#barracuda #chinese-hackers #cybersecurity

cybersecurity3 years ago•1 min saved

"CISA Discovers Submarine Malware on Compromised Barracuda ESG Appliances"

The Cybersecurity and Infrastructure Security Agency (CISA) has discovered a new malware strain called Submarine on compromised Barracuda ESG (Email Security Gateway) appliances used by federal agencies. The malware, deployed by a suspected pro-China hacker group, was used for detection evasion, persistence, and data harvesting. This comes after a previous attack where a zero-day bug was exploited to backdoor the appliances. Barracuda has offered replacement devices to affected customers and advised thorough review of networks for potential compromise. CISA warns that the Submarine malware poses a severe threat for lateral movement and urges reporting of suspicious activities.

via BleepingComputer|

#barracuda #cisa #cybersecurity

gaming3 years ago•6 min saved

The Power and Perils of Generative AI in Gaming, Cybersecurity, and Protein Design

AI has the potential to revolutionize game development by drastically reducing the time and effort required to create game content. Unity's acquisition of Ziva and its Face Trainer tool has already demonstrated the time-saving potential of AI in character rigging. The hope is that AI will make games ten times faster, easier, and cheaper to develop, leading to broader and deeper game worlds. Unity's neural network inference library, Barracuda, allows for the acceleration of content development without requiring specific hardware. While there are still challenges to overcome, the potential for an "explosion of creativity" in game development is exciting.

via Digital Trends|

#ai #barracuda #game-development