Security Affairs newsletter Round 603 roundup: Binance $6B DPRK heist, EU refrigeration attacks, Barracuda pre-auth root RCE
The weekly Security Affairs newsletter (Round 603, by Pierluigi Paganini) aggregates links to third-party reporting rather than presenting original research, so each item carries only headline-level detail. Among the operationally relevant entries are a claimed North Korea-attributed attack on Binance valued at more than $6 billion, a wave of cyberattacks on refrigeration controllers affecting European supermarkets in ten countries and prompting a joint EU statement, and a pre-authentication remote root RCE chain in the Barracuda Email Security Gateway tracked as CVE-2026-116606 and CVE-2026-111560. The roundup also lists intrusions at four Canadian law firms, a trading pause at Polymarket, a reported €100 million loss at Credit Mutuel Arkea, a 23TB data theft claim against the Russian Federal State Statistics Service, a compromised cPGuard autoupdate channel delivering a backdoor, the CWPdoor backdoor in Control Web Panel, the XCPE botnet, APT29 watering holes serving n-day exploits to mobile devices, NetamLoader used against a government-customised Windows 10 build in Asia, and the DarkBlinders espionage campaign. Because the newsletter provides no technical detail, no affected versions and no indicators for any of these items, it is a tasking list for further collection rather than an actionable report. Defenders should pivot to the underlying primary sources — in particular the Barracuda advisory and the EU joint statement on refrigeration systems — before acting.
Entenda a falha
A vulnerabilidade
The story lists a pre-authentication remote root RCE chain in Barracuda Email Security Gateway, tracked as CVE-2026-116606 and CVE-2026-111560. The newsletter only gives the title of a linked item: no CVSS score, affected or fixed versions, component, or per-CVE detail. From the title, an attacker would need no authentication and would get root-level code execution on the appliance. The other products named (Control Web Panel, cPGuard) are backdoor or supply-chain items, not these CVEs.
Como funciona
The articles do not describe how the vulnerable process works. The title only indicates a chain of two flaws that ends in remote code execution as root before any login. Consult the primary Barracuda advisory or the linked write-up for the mechanism.
Como foi descoberta
The newsletter (Security Affairs Round 603, published 2026-11-08) only links to a third-party write-up titled 'Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)'. It does not say who found the flaws, how or when they were reported, or whether they were exploited in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 08/11/2026 11:15.
Detalhes técnicos
The newsletter states only the titles of the linked items. The Barracuda Email Security Gateway entry is described as a pre-auth remote root RCE associated with two identifiers, CVE-2026-116606 and CVE-2026-111560; no CVSS score, affected appliance versions, patch level or exploitation status is given in the article, and no vendor advisory text is reproduced. Likewise the Binance item attributes a $6 billion-plus loss to North Korea without describing the intrusion path, and the refrigeration attacks are described only as affecting supermarket freezer controllers across ten European countries, with collateral reporting of French blood banks hit alongside them.
Remediação
Treat the Barracuda Email Security Gateway items as the priority: a pre-authentication root-level RCE on an internet-facing mail security appliance warrants immediate verification against the vendor's own advisory, confirmation of the firmware level in use, and review of appliance logs for signs of prior compromise given Barracuda ESG's history as a target. For the refrigeration incidents, inventory internet-exposed refrigeration and building-management controllers and remove them from direct internet reach. For the remaining items, consult the originating publications before drawing conclusions.
Linha do tempo
-
Security Affairs newsletter Round 603 roundup: Binance $6B DPRK heist, EU refrigeration attacks, Barracuda pre-auth root RCE
ler a análise desta fonte ocultar
The weekly Security Affairs newsletter (Round 603, by Pierluigi Paganini) aggregates links to third-party reporting rather than presenting original research, so each item carries only headline-level detail. Among the operationally relevant entries are a claimed North Korea-attributed attack on Binance valued at more than $6 billion, a wave of cyberattacks on refrigeration controllers affecting European supermarkets in ten countries and prompting a joint EU statement, and a pre-authentication remote root RCE chain in the Barracuda Email Security Gateway tracked as CVE-2026-116606 and CVE-2026-111560. The roundup also lists intrusions at four Canadian law firms, a trading pause at Polymarket, a reported €100 million loss at Credit Mutuel Arkea, a 23TB data theft claim against the Russian Federal State Statistics Service, a compromised cPGuard autoupdate channel delivering a backdoor, the CWPdoor backdoor in Control Web Panel, the XCPE botnet, APT29 watering holes serving n-day exploits to mobile devices, NetamLoader used against a government-customised Windows 10 build in Asia, and the DarkBlinders espionage campaign. Because the newsletter provides no technical detail, no affected versions and no indicators for any of these items, it is a tasking list for further collection rather than an actionable report. Defenders should pivot to the underlying primary sources — in particular the Barracuda advisory and the EU joint statement on refrigeration systems — before acting.
Technical Details
The newsletter states only the titles of the linked items. The Barracuda Email Security Gateway entry is described as a pre-auth remote root RCE associated with two identifiers, CVE-2026-116606 and CVE-2026-111560; no CVSS score, affected appliance versions, patch level or exploitation status is given in the article, and no vendor advisory text is reproduced. Likewise the Binance item attributes a $6 billion-plus loss to North Korea without describing the intrusion path, and the refrigeration attacks are described only as affecting supermarket freezer controllers across ten European countries, with collateral reporting of French blood banks hit alongside them.
Remediation
Treat the Barracuda Email Security Gateway items as the priority: a pre-authentication root-level RCE on an internet-facing mail security appliance warrants immediate verification against the vendor's own advisory, confirmation of the firmware level in use, and review of appliance logs for signs of prior compromise given Barracuda ESG's history as a target. For the refrigeration incidents, inventory internet-exposed refrigeration and building-management controllers and remove them from direct internet reach. For the remaining items, consult the originating publications before drawing conclusions.