email security
3 articles with this tag
CVE-2026-116606 and CVE-2026-111560 — Barracuda Email Security Gateway authentication bypass and OS command injection: explainer and fix (listed in KEV, due 13 November, compromise check required)
On 2 November 2026 Barracuda disclosed an authentication bypass in Email Security Gateway (ESG) (CVE-2026-116606, CVSS 9.3) and an OS command injection affecting ESG, ADC, BMA, WCC, WAF and WSG (CVE-2026-111560, CVSS 8.6). Both need access to the administrative interface, and combined they can lead to root. The advisory says exploitation has affected a small number of organizations (added 9 November). CISA added both to KEV on 10 November with a due date of 13 November, only three days later, and requires a forensic check. This site's view: do not stop at patching. Restrict the admin interface, preserve evidence before updating, and check for signs of compromise.
DreamHost incident (October 2026): FTP and SFTP logins exposed through File Manager, webmail credentials also taken, and what account owners should do
On October 29, 2026, DreamHost said that on October 23 it found unauthorized access to the server running its web-based File Manager (files.dreamhost.com). The attacker exploited a vulnerability in third-party software used by File Manager and obtained the FTP/SFTP usernames and passwords of users who logged into File Manager from about August through October 23. The attacker also reached certain webmail systems and obtained login credentials for a limited number of webmail users; in a small number of cases, mailbox contents may have been viewed, and DreamHost is contacting those customers individually. DreamHost says it found no evidence that control panel logins or billing details were accessed, and that it does not store full card numbers. It puts the impact at well under approximately 10% of email and FTP/SFTP accounts and has not given a count. It filed a notice with the California Attorney General (reported November 2), and the sample letter offers one year of identity theft protection. Since October 23 it has reset some passwords as a precaution, and those mail, FTP and SFTP users stay locked out until the account owner sets new passwords in the panel. This site's take: if you used File Manager since August, change your FTP/SFTP passwords even if you received no reset notice, update saved passwords in tools, and check email forwards and filters and your site files for changes you did not make.
What is phishing? The types of attack, and defenses more reliable than spotting it
Phishing impersonates a trusted party to lure you to a fake login page and steal credentials or data (or run malware). It targets human judgment rather than a software flaw, and is the number-one entry route for ransomware and breaches. Modern adversary-in-the-middle (AiTM) phishing relays even one-time codes to the real site in real time, so SMS/app MFA can be defeated. The reliable defense isn't 'spotting it' but mechanisms: domain-bound phishing-resistant MFA (passkeys/security keys), going to the official site directly instead of clicking links, and email authentication (SPF/DKIM/DMARC).