Issue of Nov 3, 2026

Flaws worth knowing

Barracuda: two chainable flaws reach root on the mail gateway. Published November 2 by the vendor and the Canadian Centre for Cyber Security: an unauthenticated authorization bypass in the Email Security Gateway's configuration-import function (CVE-2026-116606, CVSS v4.0: 9.3), plus a command injection that runs as root through the timezone field (CVE-2026-111560, 8.6), the latter also present on the ADC, WAF, Web Security Gateway, Message Archiver and WAF Control Center. No exploitation reported. Fixes are out: ESG 9.4.0.030, ADC 6.4.0, WAF 11.0.1, WSG 16.1.100.100, Message Archiver 5.5.4.0, WCC 2.2.1. The mail gateway is the front desk's phishing filter, and its management console should never be reachable from the internet. Full advisory published today.

WordPress: the flaw that strikes mid-update gets its CVE and its CERT guidance. The 7.1.4 patch landed October 28; on October 31 Wordfence published CVE-2026-119977 (8.1), a race condition that leaves the unpacked installer under wp-content/upgrade exposed for a few seconds to an unauthenticated attacker. Bhutan's national CERT published operational guidance on November 2: block web access to the staging directory before every upgrade, patch off-hours. Probing continues, no confirmed compromise to date. Batch-managed hotel microsite fleets are the profile most exposed. Full advisory published today.

Trends

Commercial refrigeration has become a target. A second wave in three weeks hit about ten European countries on November 2: display cases and cold rooms pushed to 50 degrees, food discarded by the tonne, and the European Union calling it a deliberate attempt to disrupt the food supply chain. The October incidents in France pointed to refrigeration gear remotely managed over the internet, some of it no longer receiving updates. Hotels run the same stack: kitchen cold rooms, cellars, spa equipment, looked after by vendors with remote access to the controllers. Two habits to adopt: inventory those vendor access paths, and confirm no regulation console sits exposed.

Cisco's last advisory window of the year lands tomorrow. PSIRT will publish fixed software on November 4 for Identity Services Engine, UCS Central and Unified Communications Manager, the network access control and telephony layers many properties depend on. Cisco states there will be no further hardening advisories before January 2027, so teams that defer these upgrades face no intermediate deadline until next year. Schedule the maintenance now, outside arrival hours.

On the wire

Synology: the C3RB3R ransomware alert firms up. After the October 29 vendor notice, Hong Kong's HKCERT raised its own alert on November 2 and BleepingComputer published the fixed-build matrix, from DSM 6.2.4-25556-8 through DSM 7.2.2-72806-1: targeted NAS ran outdated versions, with files encrypted under a .L0CK3D extension. Shadowserver counts more than 380,000 internet-reachable Synology NAS. These boxes often hold backups or back-office services in smaller properties: update immediately and cut direct internet exposure.

Nothing new in the KEV catalog since October 30, the two Ivanti Connect Secure additions that day remaining the only recent movement; the patch pace, for its part, shows no sign of slowing.