Top 5 Cybersecurity Events of the Week: Barracuda Root Exploits, cPGuard Supply-Chain Attack, APT Flaw, Xen Escape Bugs, and OpenSSH Authentication Bypass
Jet CSIRT has published its weekly selection of the five most notable information-security incidents.
Two Barracuda vulnerabilities grant root access to devices
Researchers disclosed CVE-2026-116606 (CVSS 9.3) — an authorization bypass affecting only the Email Security Gateway — and CVE-2026-111560 (CVSS 8.6) — a command-injection flaw that also impacts Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. Combined exploitation requires only network access to the Admin UI and no credentials on ESG. Barracuda has released firmware updates for all affected products.
Supply-chain attack on cPGuard update infrastructure
On 2 November 2026 an attacker used stolen credentials to compromise the OPSSHIELD CDN and inject a malicious script into cPGuard versions 5.88.12–5.88.19. The script harvested system password hashes, MariaDB/MySQL configuration files, root command history, and SSH keys. The backdoor was discovered within 12 hours and removed in version 5.88.25. At least 32 customer servers were affected.
APT package manager flaw enables root code execution
CVE-2026-109518 in APT for Debian and Ubuntu allows an attacker controlling HTTP traffic to substitute a verified package with malicious code that later runs as root. The attack relies on retry behavior present by default in modern distributions and works against all eight supported Ubuntu releases from 14.04 LTS to 26.10 at the time of patching.
Xen hypervisor bugs permit guest-to-host escape
Two vulnerabilities tracked as CVE-2026-102703 and CVE-2026-102704 (XSA-523) stem from incorrect caching of permission checks during memory-page copying. A malicious guest VM can therefore read and write memory belonging to other VMs, including dom0, on all Xen versions since 4.6. Patches are available for Xen, XCP-ng 8.3, and Qubes OS 4.3.
OpenSSH authentication bypass on Alpine Linux
Because of a musl libc behavior in which crypt() returns “*” for password hashes between 257 and 1024 bytes, OpenSSH on Alpine Linux (and other musl-based systems) accepts any password for accounts that should only allow key-based login. The issue does not affect glibc or PAM configurations. Fixed releases of OpenSSH 10.6p2 and backported Alpine patches starting from version 3.16 are now available.
Related articles
CISA and FBI Warn of Global Cyber Attacks on Industrial Refrigeration and Cold Chain Controllers
CISA, the FBI, and multiple U.S. agencies issued a joint advisory on November 5 detailing malicious cyber activity targeting industrial refrigeration systems and cold chain monitoring equipment worldwide. Attackers are exploiting unpatched or internet-exposed temperature controllers in supermarkets and cold storage facilities through authentication bypass, arbitrary code injection, and weak configurations. Once inside the control panels, threat actors force units into continuous heating and defrost cycles, the opposite of their intended function, while also causing denial of visibility that prevents operators from seeing real equipment status. The advisory highlights risks including reduced system lifespan, fire hazards, stock loss, and potential consumer harm from spoiled products stored outside safe temperature ranges. Sectors most affected include public health, chemical manufacturing, food and agriculture, and refrigerated transportation. Recommended mitigations focus on network segmentation, removal of remote access from the public internet, strong authentication, firmware updates, and regular offline backups.
Critical Flaw in React Server Components Enables Unauthenticated Remote Code Execution
The React team disclosed security advisory GHSA-xqc2-xf4c-x3h3 describing a high-impact vulnerability in React Server Components that can lead to remote code execution. The flaw affects packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack across multiple version ranges from 19.0.0 through 19.3.0. Exploitation requires no authentication, privileges, or user interaction, allowing a remote attacker to execute code on the server by sending a specially crafted request containing multiple typed arrays alongside attacker-controlled data. No CVE identifier was assigned, and the advisory notes that the issue is distinct from the previously reported React2Shell vulnerability tracked as CVE-2025-55182. Affected applications are limited to those running React code on the server with supported frameworks and bundlers; client-only React usage is unaffected. Patches are available in versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1, with immediate updates strongly recommended. The React team also linked similar typed-array handling issues in Next.js Cache Components, suggesting a broader class of errors.
Plex Media Server Vulnerabilities Exploited in Wild via Plex2Shell Chain
Plex has disclosed active exploitation of four vulnerabilities in Plex Media Server versions 1.43.2 and earlier. The flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, allow unauthenticated remote code execution when chained together. Attackers are leveraging server-side request forgery and token-handling weaknesses to write arbitrary files on exposed servers. Proof-of-concept code named Plex2Shell was published on 16 October, after which CISA added the issues to its Known Exploited Vulnerabilities catalog. Compromised systems have been observed deploying cryptocurrency miners and proxy relays. The software is widely used both as a standalone media server and as an add-on for QNAP and other NAS devices, increasing the potential attack surface.
Google Issues Chrome Security Update Fixing Nine Vulnerabilities Including Zero-Day Exploit
Google has released a security update for its Chrome browser that addresses nine vulnerabilities, one of which is a zero-day flaw already being exploited in the wild. The update covers Windows, macOS, and Linux platforms with versions 157.0.8103.51 and 157.0.8103.50. Seven of the issues are rated High severity, while two are rated Medium. The zero-day vulnerability CVE-2026-125350 is a Use After Free flaw in XML processing that was reported on November 6. Additional fixes address similar Use After Free issues, type confusion in the V8 engine, out-of-bounds writes in GPU, and problems in WebGL, FileSystem, and Compositing components.