Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Showing posts with label Cyber Security. Show all posts

Barracuda Patches Two Security Flaws That Could Let Attackers Take Over Email Security Gateways


Experts have shown how two vulnerabilities in Barracuda's Email Security Gateway can be chained to execute arbitrary commands with root privileges without requiring an attacker to log in.

The vulnerabilities, tracked as CVE-2026-116606 and CVE-2026-111560, affect Barracuda's email-filtering appliance and could allow remote attackers to bypass security restrictions and gain complete control of vulnerable systems.

According to cybersecurity firm watchTowr, which published its technical analysis, the attack chain combines an authorization bypass flaw with a command injection vulnerability. Barracuda released security patches for the issues earlier this week.

The first vulnerability, CVE-2026-116606, is an authorization bypass flaw that allows unauthenticated attackers to access a configuration restoration function and modify the appliance's global settings. The second, CVE-2026-111560, is a command injection vulnerability that enables commands to execute with root privileges.

Mandiant assigned CVSS severity scores of 9.3 and 8.6 to the two vulnerabilities, respectively.

How the attack chain works

In its technical investigation, watchTowr discovered that the authorization bypass stems from the appliance's password-change process. When a password change request fails, the system incorrectly returns a low-privilege user role instead of terminating the request completely.

The researchers also found that Barracuda's backup verification mechanism relies on a secret embedded within the appliance's code. Since this secret is not securely protected, attackers can generate a valid checksum for a specially crafted configuration backup and restore it on the targeted device.

The uploaded configuration can contain a manipulated timezone value. When the appliance processes this setting, it passes the value to a shell command that executes with root privileges.

watchTowr demonstrated the attack by successfully writing a file to the appliance with root-level permissions.

Affected products

CVE-2026-116606 affects Barracuda Email Security Gateway, while CVE-2026-111560 impacts five additional products, including Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).

However, the complete unauthenticated attack chain applies specifically to Email Security Gateway. Exploitation of the command injection vulnerability on the other affected products requires administrator access.

What next?

Barracuda has released security updates addressing both vulnerabilities and recommends that customers install the appropriate patches or upgrade to the latest fixed firmware versions.

As of the disclosure, neither vulnerability had been listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no publicly reported incidents linked the flaws to active exploitation.

Data Sovereignty Is Essential for India's Digital Infrastructure, Says RBI Governor


Sanjay Malhotra, Governor of the Reserve Bank of India (RBI), emphasized the significance of maintaining sovereign data centers in order to safeguard critical financial information and strengthen the country's digital infrastructure. As information technology has become an integral part of the banking industry, security infrastructure, operational resilience, and cybersecurity have become increasingly important in maintaining financial stability, especially in light of the growing threat landscape being shaped by artificial intelligence (AI). 


Prime Minister Narendra Modi inaugurated the RBI's new data center complex and Cybersecurity Training Institute in Bhubaneswar on October 25, and made these remarks following the inauguration. With a capital investment of Rs 169 crore, the facility is expected to enhance the reliability of critical financial services and to reduce the likelihood that essential banking operations will be disrupted.

A spokesperson for Doordarshan reported that Malhotra explained that the central bank's technology infrastructure facilitates the use of applications by the general public, financial institutions, and government departments. He pointed out that information technology cannot be considered merely a supporting function, as several essential financial operations are directly dependent upon the availability and security of these technologies. 

NEFT and RTGS are major payment infrastructures that will be supported by the new data center. Furthermore, the RBI's integrated ombudsman system and applications used by financial institutions regulated by the central bank will be supported by the new data center. In addition to government banking operations, it will also accommodate financial institutions regulated by the RBI. 

A key component of Malhotra's statement was the RBI's role in the Unified Payments Interface (UPI) ecosystem in India. Although UPI is operated by the National Payments Corporation of India (NPCI), final settlement of transactions takes place through the RBI's data centres and applications. To ensure the availability of the central bank's infrastructure within the wider digital payments ecosystem, it is important. 

Four independent data centres are located within the Bhubaneswar complex, which has been accredited as Tier IV by the Uptime Institute, the highest level of its data centre classification. This facility will be operated independently of third party cloud service providers, allowing RBI to maintain greater control over its critical infrastructure and sensitive financial information. Additionally, the project's geographical location will contribute to its resilience. 

A geographically separated and seismically isolated location in Bhubaneswar reduces the possibility that a localised disruption will affect all facilities simultaneously. The RBI previously operated three data centers in Maharashtra. Additionally, this development reflects the increasing importance of data sovereignty in the Indian financial infrastructure, where uninterrupted access to critical systems and the control of sensitive information remain essential security priorities. 

As part of the RBI's infrastructure security efforts, cybersecurity expertise is also being developed throughout the financial sector. In the Bhubaneswar project, there will be a Cybersecurity Training Institute, which will occupie approximately two-thirds of the campus, and the remaining portion will accommodate the data centre. It is intended that the institute will provide training to personnel of the RBI, bank employees, and professionals from other financial institutions. 

A number of emerging technologies, such as artificial intelligence (AI), big data analytics, quantum technology, and blockchain, will be studied as part of its programming. There will also be research activities conducted in order to investigate ways to improve the security and efficiency of financial systems. With AI posing new challenges to financial institutions, specialized training is becoming increasingly important.

The technology can provide opportunities for improving banking operations and security monitoring; however, if it is misused, it can result in cyberattacks, automated fraud, and attempts to exploit weaknesses in digital systems, increasing in sophistication. Financial sector readiness therefore relies heavily on cybersecurity professionals staying up to date on these developments. 

Governor of the Reserve Bank, Sanjay Malhotra, stressed the need to maintain personnel informed of technological developments and the growing importance of cybersecurity in the context of artificial intelligence. By attending the institute, financial sector professionals will be better equipped to comprehend emerging risks and respond to changes in cybersecurity. In addition to investing in digital infrastructure, the initiative emphasizes the importance of building human expertise. 

For data centers and advanced technology systems to be secure, trained professionals must manage operations, identify security weaknesses, and ensure service reliability are required. It was pointed out during the inauguration that cybersecurity was directly related to India's economic security by Prime Minister Narendra Modi. As financial services become increasingly dependent on digital technologies and digital banking, it becomes increasingly important to protect the financial infrastructure.

As well as highlighting the institute's role in developing cybersecurity and emerging technologies, Finance Minister Nirmala Sitharaman also highlighted the institute's efforts. Due to its emphasis on energy efficiency and water conservation, the RBI has also applied for a Platinum rating with the Indian Green Building Council. 

Bhubaneswar represents a larger effort to strengthen India's control over critical financial technology infrastructure by incorporating locally sourced materials in its construction approach. To protect the country's financial ecosystem, sovereign data management, geographically distributed infrastructure, and specialized cybersecurity training will remain important. As digital payments and artificial intelligence-driven services continue to increase, a comprehensive data management system, geographically distributed infrastructure, and cybersecurity training will be essential. 

An important strategic investment is being made in Indian financial infrastructure with the establishment of the sovereign data centre and cybersecurity training institute. In order to enhance the long-term reliability and resilience of the country's digital financial systems, the RBI intends to strengthen control over critical financial data and develop specialised cybersecurity expertise.

AI-Powered CEO Impersonation Scheme Allegedly Defrauded Companies of $129 Million

 

Three men have been indicted in the United States for an alleged international fraud scheme in which they used artificial intelligence to impersonate corporate executives and legal professionals to trick employees into sending around $129 million to their accounts. 

Jacob Soall, Sharon Hazan and Guy Sheetrit have been charged with pretending to be company CEOs and lawyers to convince employees that large transactions were needed. Between 2024 and 2026, the trio allegedly conspired to use AI to create fake audio and video of real people, according to the U.S. Department of Justice. They used AI to make their impersonations realistic enough to fool corporate workers. 

The trio now face numerous charges including wire fraud, money laundering and aggravated identity theft. If they are found guilty, they could face a maximum sentence of 104 years in prison. They called employees and pretended to be their company’s chief executive, with the alleged fraudsters claiming they needed urgent financial transactions to be completed and that it was confidential. They would then tell employees to contact lawyers on behalf of the company. 

AI was used to create copies of the lawyers’ voices and appearances. Soall was reported to have taken on the role of impersonating lawyers and had scripts ready to mimic how they would speak. Once they had convinced employees to approve the transactions, the money was sent through bank accounts in the United States, Europe, the United Arab Emirates and China. 

The cash was then transferred into cryptocurrency. Several organisations were allegedly scammed including a hospital in Missouri who lost almost $5 million, a bank in Rhode Island who lost $2.6 million and a hospital in California who lost $2.9 million. Other alleged victims included a technology company in the UK who lost $11.5 million, a financial company in Massachusetts who lost $4.6 million and a pet food company in Florida who lost $5.2 million. Hazan is alleged to have managed the money laundering. 

In court documents, Hazan claimed he had laundered $400 million since 1994. He was previously convicted of bank fraud in 2008. All three suspects are currently in custody. Soall and Hazan were arrested in Spain during the summer whilst Sheetrit was detained in the United Kingdom in September. The Justice Department said they are all facing extradition requests. 

The FBI has warned criminals are increasingly using new technology to commit complex financial frauds. James Barnacle, a senior FBI official, said the alleged fraud is an example of how sophisticated technology can be used to commit large-scale crime. The bureau has encouraged businesses who may have been targeted to report any suspected incidents.

Canadian Man Extradited to U.S. Over University Hacking and Cryptocurrency Mining Scheme

A Canadian national has been extradited to the United States to face charges over an alleged hacking operation that targeted universities and used compromised computers to mine cryptocurrency. The scheme, which prosecutors say ran from 2016 to 2019, allegedly involved stealing login credentials, deploying malware and exploiting the computing resources of educational institutions for financial gain. 

Ryan James Roach, 35, of Saskatchewan, and Mathiew James Stubbings, 41, of Ontario, have been indicted by a federal grand jury in the Western District of New York. Both face charges including conspiracy to obtain information from protected computers and cause damage to them, unauthorised acquisition of computer information and intentional computer damage. The charges carry potential penalties of up to 10 years in prison and a $250,000 fine. 

According to the indictment, the alleged operation took place between June 2016 and December 2019. The two defendants are accused of targeting educational institutions in New York, Tennessee, North Carolina and Massachusetts, particularly institutions with access to supercomputers. At least some of the compromised systems were located at a higher education institution in the Western District of New York. Prosecutors allege that Roach and Stubbings used virtual private servers hosted in multiple countries to distribute malware and cryptocurrency-mining software. 

The servers were reportedly registered under false identities and also used to retain credentials stolen from victims. To disguise their activity, the defendants allegedly routed their operations through servers and computers that had already been compromised at other institutions. After gaining unauthorised access, the pair allegedly installed malware, collected login credentials and transferred stolen information to infrastructure under their control. They then made victim machines perform cryptocurrency-mining operations, using their processing capacity to generate revenue for the defendants. 

The indictment further alleges that the attackers researched security weaknesses in university networks and employed specialised tools to survey compromised environments and expand their access. The operation damaged at least 10 protected computers within a one-year period and caused losses of no less than $5,000. Roach was extradited from Canada on October 28 and appeared before U.S. Magistrate Judge Mark W. Pedersen. 

He was arraigned and remained in custody pending a detention hearing scheduled for November 3, 2026. Extradition proceedings for Stubbings are continuing in Canada. The case is being prosecuted by Assistant U.S. Attorney Meghan K. McGuire. The FBI and the Justice Department’s Computer Crime and Intellectual Property Section investigated the alleged scheme. 

The Justice Department’s Office of International Affairs also assisted in securing Roach’s arrest and extradition. The indictment represents formal criminal allegations, not a finding of guilt. Both defendants are presumed innocent unless and until proven guilty in court.

Hackers Target Alpine Linux GitLab Server in Attempted Critical RCE Attack


Alpine Linux has rebuilt its GitLab server and reset all user passwords after hackers attempted to exploit a critical remote code execution (RCE) vulnerability in its development infrastructure. 

The attacks targeted a maximum-severity vulnerability tracked as CVE-2026-97229, which carries a CVSS score of 10.0. Although Alpine Linux found no evidence that the attackers successfully executed malicious code or modified its software packages, the project said it could not completely rule out a breach.

Alpine Linux is a lightweight, open-source operating system widely used as the foundation for Docker container images. Its GitLab server hosts development repositories, code reviews and continuous integration (CI) jobs, including the build recipes used to produce Alpine software packages. This makes the server an important target for attackers seeking to compromise the software supply chain.

The vulnerability is caused by an integer overflow in Onigmo, the regular expression engine included in Ruby and used by GitLab's CI/CD system. If successful, this could allow the attacker to execute arbitrary code on the vulnerable server.

GitLab disclosed the vulnerability and released security fixes on October 12. However, Alpine Linux initially installed GitLab version 19.3.4 instead of the patched 19.3.5. The project later upgraded to version 19.3.6 on October 22, but the vulnerability remained because the required Ruby security patch was missing from Alpine's custom container image.

Attackers repeatedly crashed GitLab processes

According to Alpine Linux, an attacker created a new account and began submitting specially crafted CI configurations to its GitLab server on October 20-21.

The security team recorded eight worker crashes during the attacks. Four attempts reportedly progressed partway through the exploitation process before failing to complete. 

The attackers also downloaded Alpine Linux's GitLab container image, suggesting they may have been studying the server's configuration and preparing an exploit specifically designed for that environment.

The project later discovered that upgrading GitLab alone was insufficient to address the problem. The security fix required an updated version of Ruby, which was included in GitLab's official packages but was not present in Alpine's custom image.

No evidence of software tampering found

There were doubts about a possible software supply-chain attack. If attackers had successfully compromised the GitLab server, they could potentially have accessed user information, password hashes, two-factor authentication secrets, CI/CD credentials, integration tokens and private project repositories.

GitLab rebuilt from scratch

The project also advised users to change passwords reused on other websites and to pull the updated alpinelinux/gitlab:19.3.6 container image published on October 27. This image includes Ruby 3.3.13, which contains the necessary security fix.

AI Scams: How Criminals Use Deepfakes, Fake Websites and Voice Cloning to Target Consumers

 

As criminals use Artificial Intelligence (AI) to help produce realistic scams such as fake online shopping sites, cloned voices and realistic fake videos, consumer protection authorities in the UK are urging shoppers to take extra care. 

National Trading Standards has published its first list of AI scams to help raise awareness of new methods being used by criminals. Fake online retailers are becoming an increasing problem. These look genuine by appearing to be family run and local in the UK. They may even appear professional with their website design and pictures of UK high streets and union jacks. 

However, when ordering from these businesses you could end up with cheap, mass produced items from countries like China. There are many other ways criminals are targeting consumers. It is easy to create a professional looking website with criminals using AI to clone real businesses. Romance scams are also a common method criminals are using. This allows them to keep track of personal details and have realistic conversations with victims for long periods of time. 

Criminals are using voice cloning and deepfake videos to pose as family members or close friends. They may pose as someone you know and ask for immediate financial help. AI can also be used to create highly personalised phishing emails, texts and social media posts, making it hard to tell if they are a scam. Classic signs of scams may no longer be reliable. 

As AI creates highly professional and realistic content, mistakes with spelling and grammar which used to be common in messages from scammers are no longer useful (Which?). National Trading Standards advises not to send money, gift cards or personal/financial details to people you haven’t met in person. 

Always confirm businesses are genuine before purchasing. This can include checking the address of a retailer is genuine. You can check if a company is authorised to give you financial advice using the Financial Conduct Authority’s Firm Checker. You can also contact employers directly. 

Do not assume people are genuine just because you recognise their voice. AI can create realistic audio and video. The main piece of advice is to stop and think before sending any money, giving out any information or rushing to help with an urgent request. Criminals often try to put pressure on you to get you to act quickly.

Critical Linux Kernel Vulnerability Could Allow Hackers to Gain Remote Root Access


A critical security vulnerability in the Linux kernel could allow attackers to remotely take control of vulnerable servers and execute commands with root privileges. Security researchers at Anthropic have developed an exploit demonstrating how the flaw can be used to compromise Linux systems running Multipath TCP (MPTCP) listeners.

The vulnerability, tracked as CVE-2026-98432, has received a critical severity rating of 9.8 out of 10 from the Linux kernel CVE team. It affects Linux kernel versions dating back to 4.4 and could put several widely used Linux distributions at risk.

About the problem

The security issue is caused by a use-after-free vulnerability in the Linux kernel’s IPv4 TCP networking code. It occurs because of a race condition during the handling of TCP connection requests.

The vulnerability affects both regular TCP connections and Multipath TCP (MPTCP). MPTCP allows a single network connection to use multiple network paths simultaneously, improving connection reliability and performance.

Researchers at Anthropic demonstrated that the flaw could be exploited remotely without authentication on servers running MPTCP listeners. Their exploit was developed using an unreleased Claude AI model and reportedly took around 53 minutes to achieve remote code execution with root privileges. 

The exploit also managed to bypass Kernel Address Space Layout Randomization (KASLR), a security mechanism designed to make memory-based attacks more difficult.

Another concern involves Go 1.24, which enables MPTCP by default for TCP listeners on Linux when the underlying kernel supports the feature. This means some Go-based applications could expose vulnerable services without administrators being aware of it.

Who is impacted?

The vulnerability affects multiple Linux distributions, including Ubuntu, Red Hat Enterprise Linux (RHEL) and Rocky Linux. While the Linux kernel issue can also be triggered through ordinary TCP connections, publicly demonstrated remote root exploitation has so far focused on systems running MPTCP listeners.

Red Hat has assessed the vulnerability as a complex exploitation risk that could result in a denial-of-service condition, assigning it a lower severity score of 5.9.

How to address

The vulnerability has been fixed in the upstream Linux kernel, with patches also backported to maintained kernel branches. However, security updates were still pending for several distributions as of October 30, 2026.

Rocky Linux support provider CIQ has also recommended temporary firewall protections using nftables to block IPv4 TCP packets containing IP options. But simply disabling MPTCP is not sufficient because the underlying vulnerability can also be triggered through ordinary TCP traffic.

There are currently no confirmed reports of CVE-2026-98432 being exploited in real-world attacks.

Trojanized Claude Code Extension on Cursor Marketplace Exposes Users to SSH Backdoor


The Cursor IDE extension marketplace was flooded with modified versions of Anthropic's official Claude Code extension, exposing developers to a persistent SSH backdoor. This malicious package, version 2.1.313, appeared to be a legitimate update as opposed to a separate malicious application as it was published under the legitimate extension identity, making it appear to be an authentic update. 

A report was issued on October 29, 2026, following the discovery of the compromised extension installing an attacker-controlled SSH key, establishing remote access, and maintaining persistence on affected systems. According to Cursor, the malicious version was accessible for approximately 11 hours from 2:27am to 1:35pm Pacific Time. 

The company estimates that up to 5,000 users could have been affected. 66 lines of JavaScript code were inserted into the main code bundle of the extension by the attackers. The malicious component was designed to execute before the extension's normal functions, allowing it to perform unauthorized activities without requiring any suspicious interaction from users. 

Despite the extension's continued normal operation, the injected code attempted to modify system files and establish connections with attacker-controlled infrastructure in order to alter the extension's behavior. According to researchers, the compromised package was distributed by Cursor under the legitimate extension identifier of Anthropic, anthropic.claude-code. This incident was particularly concerning because the malicious update appeared as an authentic publisher rather than as a mere imitation. 

It remains unclear how the unauthorized package was introduced. Based on Microsoft Threat Intelligence's confirmation, the malicious versions have not been distributed via Microsoft's official Visual Studio Marketplace or Anthropic's npm package. Furthermore, Anthropic confirmed that the company had not been compromised and did not develop the malicious package. Based on the available evidence, Cursor's extension marketplace was the focus of the incident. 

The injectable loader attempted to modify the victim's authorized_keys file to include an SSH public key labelled "svc-telemetry". This modification was intended to enable the attacker to access the affected user's account via SSH. In addition to enabling local SSH services and establishing reverse SSH tunnels to external servers 134.209.82[.]225, the malware also attempted to maintain access to the external server. This was accomplished by incorporating separate persistence mechanisms for Windows, Linux, and macOS, which allowed the backdoor connection to be restarted depending on the platform's startup configurations. 

Additionally, the malicious payload collected information that could allow attackers to identify valuable developer environments by using system information. There was a collection of information on the device hostname, logged-in username, operating system, CPU architecture, home directory, the current working directory, public IP address, and the global Git email configuration. There were also up to 40 environment variables named KEY, TOKEN, SECRET, PASS, AWS and GCP, which contained up to 400 terms. 

Even though the initial beacon did not transmit the values for these variables, this information can be used to identify what cloud services, development platforms and credential types are on a compromised system. As well as sending data to the attacker-controlled server at 134.209.82[.]225:8099/beacon, the loader attempted to send a request to a local loopback address as well. 

It has been determined that the attacker's infrastructure has been permanently shut down with the assistance of its hosting provider, which prevents further communication through the reported server. However, the shutdown does not remove malicious files or persistence mechanisms that are already installed on affected systems. However, researchers have not identified any additional payloads, despite the possibility of attackers executing commands and transferring files via a successful SSH tunnel.

It was later clarified that two malicious versions of the software were released through Cursor's marketplace for Windows and macOS, respectively, during the exposure period of October 29 between 2:27 a.m. and 1:35 p.m. Pacific Time. According to the company, up to 5,000 users may have been affected. They will be contacted directly by the company. Cursor temporarily shut down its marketplace while investigating the incident following discovery of the affected packages. 

A thorough audit of marketplace access by the company revealed no evidence of tampered with other extensions. After rotating the keys of the marketplace and rebuilding the marketplace, the company was able to restore service. Anthropic also confirmed that its official distribution channels and systems were not compromised. 

The extension 2.1.314 was then released through Open VSX and Microsoft's Visual Studio Marketplace. However, Microsoft's Security teams have warned that simply uninstalling it is not sufficient to stop the threat. Scripts, scheduled tasks, cron entries, LaunchAgent files and unauthorized SSH keys marked svc-telemetry should be checked on affected systems. 

When evidence of malicious activity is present, systems should be isolated and confirmed malicious components removed after relevant evidence has been preserved. Additionally, organizations are being advised to review endpoint, network, and authentication logs in order to identify suspicious connections and activity involving SSH. Credentials and active sessions accessed from affected machines should be rotated or revoked from trusted devices.

Whenever unauthorized access is confirmed or its security cannot be restored, it may be necessary to rebuild the system. This incident adds to the series of attacks targeting trusted developer tools in the software supply chain. This follows the attack on OVHcloud's official command-line interface that resulted in the replacement of legitimate release binary packages with malware containing secret stealing features. The combined effect of these incidents demonstrates the risks associated with tampered software updates distributed through otherwise reputable channels.