Barracuda chained RCE, cPGuard backdoor supply chain, LLMjacking cloud fraud surge

Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.

CVE-2026-116606 in Barracuda Networks Products: the source articles reported no exploitation. NVD rates it 9.3 (CRITICAL) on CVSS v4.0.

CVE-2026-111560 in Barracuda Networks Products: the source articles reported no exploitation. NVD rates it 8.6 (HIGH) on CVSS v4.0.

CVE-2023-7102 in Barracuda Email Security Gateway: the source articles reported no exploitation. NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a vendor advisory.

CVE-2023-2868 in Barracuda Networks Email Security Gateway (ESG) Appliance is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2023-05-26; federal remediation due 2023-06-16). NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a vendor advisory.

Barracuda Networks disclosed two critical vulnerabilities that chain to grant root access; cPGuard's update infrastructure was compromised to deploy backdoors; and Google warns LLMjacking attacks are costing enterprises up to $1 million in fraudulent cloud charges.

Barracuda disclosed two chained vulnerabilities (CVE-2026-116606, CVE-2026-111560) affecting its security products that allow attackers to bypass authorization and gain root-level access.

cPGuard web security suite's autoupdate infrastructure was hijacked to distribute a backdoor and data-stealing script to customers.

Google reports LLMjacking attacks are generating fraudulent cloud charges exceeding $1 million for some organizations, with daily losses reaching $100,000+ per victim.

mSecure password manager users were warned to reset passwords, 2FA, and passkeys following suspicious activity in customer accounts.

Chainstack blockchain infrastructure provider disclosed a production systems breach involving customer data and password hashes, attributed to an AI-powered attack campaign.

1. Barracuda Critical Vulnerabilities Chain to Root Access

Severity: CRITICAL Affected: Technology

Barracuda has disclosed two vulnerabilities affecting its products that, when chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device [1] . The vulnerabilities include a pre-authentication authorization bypass vulnerability and a command injection flaw ⚠ [1] . Barracuda Networks warned customers to patch the flaws, identified as CVE-2026-116606 and CVE-2026-111560 [2] . Sources: [1] The Hacker News [2] BleepingComputer

Identify all Barracuda products in your environment and cross-reference with vendor advisory for affected versions

Apply security patches provided by Barracuda immediately

Monitor for unauthorized access attempts and privilege escalation on affected systems

2. cPGuard Update Infrastructure Compromised to Deploy Backdoor

Severity: HIGH Affected: Technology

Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script [1] . This supply-chain attack affects all customers relying on the autoupdate mechanism. Sources: [1] BleepingComputer

Isolate or disconnect cPGuard-protected systems from the network pending vendor guidance

Review cPGuard update logs for suspicious installation timestamps and payloads

Scan affected systems for backdoor artifacts and data exfiltration

cPGuard support for forensic guidance and patched update server availability

3. LLMjacking Attacks Generating Up to $1 Million in Fraudulent Cloud Charges

Severity: HIGH Affected: Technology

Google reported that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services, a tactic known as LLMjacking [1] . Some organizations have lost more than $100,000 per day, with total losses exceeding $1 million for affected victims [1] [2] . The attack leverages compromised API keys or stolen credentials to access cloud-hosted LLM services [1] . Sources: [1] The Hacker News [2] BleepingComputer

Audit all LLM API keys and service account credentials; rotate keys showing signs of compromise

Implement API rate limiting and cost threshold alerts on cloud LLM services

Enable multi-factor authentication and IP whitelisting on all LLM service accounts

Review cloud billing dashboards for unusual compute resource consumption or API call patterns

4. mSecure Password Manager Warns of Account Compromise

Severity: HIGH Affected: Technology

Customers of the mSecure password manager have been urged to change passwords, reset two-factor authentication, and remove passkeys following suspicious activity detected in customer accounts [1] . The warning was issued via email on November 3. Sources: [1] The Hacker News

All mSecure users should immediately change their master password and reset 2FA/passkeys

Review account activity logs within mSecure for unauthorized access or exported credentials

Change all high-risk passwords stored in mSecure (banking, email, admin accounts) on their respective platforms

Consider migrating to an alternative password manager until full details of the incident are disclosed

5. Chainstack Production Breach Exposes Customer Data and Password Hashes

Severity: HIGH Affected: Finance

Blockchain infrastructure provider Chainstack disclosed that it was targeted in a cyber attack allowing an unauthorized party to gain access to parts of its infrastructure [1] . The incident is assessed to be part of a large-scale, artificial intelligence (AI)-powered attack campaign, with exposed data including customer information and password hashes [1] . Sources: [1] The Hacker News

Chainstack customers should reset credentials used to access the platform

Monitor blockchain wallets and API activity for unauthorized transactions or access

Review Chainstack's incident disclosure for full scope of exposed data

Today’s Action Checklist

☐ URGENT: Apply Barracuda security patches (CVE-2026-116606, CVE-2026-111560) to all affected systems

☐ URGENT: Isolate or update cPGuard installations pending vendor-provided clean update server

☐ HIGH: Audit and rotate all LLM API keys; implement rate limiting and cost alerts on cloud AI services

☐ HIGH: Reset mSecure master password and 2FA; change all sensitive passwords stored in the vault

☐ HIGH: Reset Chainstack credentials and monitor for unauthorized blockchain activity