On Thursday, 12 November 2026, millions of people found they could not open their mailboxes, send Teams messages or reach shared files. A large Microsoft 365 outage disrupted Outlook, Exchange Online, Teams, SharePoint Online, Microsoft 365 Copilot and Defender XDR across several regions, and Microsoft later said users anywhere could be affected.

This article explains what happened, whether it was a cyberattack, and the practical steps small and medium businesses can take so that the next cloud outage does not stop work entirely.

Key takeaways

• The outage began on 12 November with Exchange Online mailbox connection problems in the Americas and spread to other Microsoft 365 services.
• Microsoft says a large number of servers became unavailable and failed automated health checks, overloading the servers that remained. It says traffic itself did not increase.
• Microsoft has reported no sign of malicious activity. Treat this as a service failure, not a breach, unless your own logs say otherwise.
• Recovery was gradual and still continuing into early 13 November, with Microsoft warning that some servers could fail again under load.
• Admins can follow incidents EX1550543 and MO1550821 in the Microsoft 365 admin center.

What happened

According to BleepingComputer and SecurityWeek, Microsoft first investigated users in the Americas who could not connect to Exchange Online mailboxes. Separately, a Teams incident that morning delayed or failed messages for users in North and South America; Microsoft says that one was fully resolved. Shortly after, Microsoft opened a wider incident covering Exchange Online, Teams, SharePoint Online, Microsoft 365 Copilot and Defender XDR, warning that customers might be unable to connect.

Outage tracker Downdetector recorded a peak of roughly 130,000 reports for Outlook alone, according to Tom’s Guide. Some Google Workspace users who read their mail through the Outlook desktop and mobile apps also reported trouble.

What Microsoft says caused it

Microsoft’s explanation evolved through the day. It first described elevated load on its infrastructure across multiple regions, then clarified that the load did not come from more traffic but from servers unexpectedly dropping out of service, leaving the rest to carry the weight. Later updates said a core process on the affected servers was becoming overwhelmed and that the servers were failing automated health checks.

To recover, Microsoft paused all deployments, redistributed traffic, restarted affected servers, looked at reverting a small number of recent configuration changes, and validated an alternative health-check method so that servers could return to service. As of the latest updates we reviewed, Microsoft had not published a final root cause.

Was it a cyberattack?

No evidence points to one. Microsoft’s service advisories reported no malicious activity. SecurityWeek noted the outage came two days after November’s Patch Tuesday, which fixed an exploited Outlook spoofing flaw, but Microsoft has not linked that bug to the outage.

Outages are still a favourite moment for scammers. Expect fake “Microsoft 365 account suspended” or “verify your mailbox to restore access” emails and texts. Microsoft will not ask you to sign in through a link in a message to fix an outage.

Who was affected

Any organisation using Microsoft 365 could be hit, including many Nigerian and African SMEs, banks, schools and government offices that rely on Outlook and Teams for daily work. Businesses that run invoicing, approvals or customer service through shared mailboxes felt it most, because email and file access were both disrupted at the same time.

How to keep working during the next outage

No cloud service is immune to outages. The goal is not to avoid them, but to make sure your team knows what to do when they happen.

Before an outage

1. Know where to check status. Bookmark the Microsoft 365 Service health page in the admin center and the official Microsoft 365 Status account, so you can confirm quickly whether the problem is yours or Microsoft’s.
2. Agree a backup channel. Choose an approved alternative for urgent internal messages, such as a company WhatsApp group or phone tree, and write it down.
3. Keep key files available offline. In OneDrive, mark critical folders as Always keep on this device on the laptops that need them.
4. Keep a contact list outside email. Store phone numbers for key customers, suppliers and your IT support somewhere other than Outlook.

During an outage

• Tell staff clearly that it is a service outage, not a security incident, and share the approved workaround.
• Avoid repeatedly resetting passwords or reinstalling Office; it will not fix a server-side problem.
• Warn staff about outage-themed phishing.

After service returns

• Check integrations and automations that use Exchange Online, SharePoint or OneDrive for failed or queued tasks.
• Confirm important emails sent during the outage actually arrived.
• Review identity and sign-in alerts as normal, and investigate only if something looks unusual.

What you should do

• If anything still looks broken, check incidents EX1550543 and MO1550821 in the Microsoft 365 admin center before troubleshooting your own devices.
• Ignore any email or text asking you to “re-verify” your Microsoft account because of the outage.
• Use this incident to write a one-page outage plan: where to check status, how staff will communicate, and which files must be available offline.

Sources

• BleepingComputer: Massive Microsoft 365 outage disrupts Outlook, Teams, Copilot worldwide
• SecurityWeek: Microsoft 365 Outage Disrupts Outlook, Exchange Online and Teams
• Tom’s Guide: Outlook, Microsoft 365, Teams down live updates
• Cypro: Microsoft 365 Outage: What Happened on 12 November

Featured image: Photo: “UF Norman Office Laptop Desk Workstation” by cdsessums, CC BY 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications

Microsoft released its November 2026 security updates on Tuesday, 10 November, and once again the numbers are enormous. Depending on how you count, the release fixes roughly 1,100 vulnerabilities across Windows, Office, SQL Server, SharePoint and Exchange. Only one of them is confirmed as already being used in attacks, and it sits in a place almost every office relies on: classic Outlook.

This article is for business owners, IT administrators and everyday Windows and Microsoft 365 users who want to know what to install first and why one important fix will not arrive through Windows Update alone.

What Microsoft fixed this month

Security trackers report slightly different totals (1,092, 1,093 and 1,094 are all being quoted, and BleepingComputer counted more when it included other fixes), because counting methods differ. Using the widely cited figure of 1,093 new vulnerabilities:

• 63 are rated Critical, 1,029 Important and one Moderate.
• 535 are elevation of privilege flaws, which let an attacker who already has a foothold gain more control.
• 296 allow remote code execution, meaning an attacker could run their own code on a target system.
• By product, Windows accounts for 733 fixes, Office 174, SQL Server 52, SharePoint Server 27 and Exchange Server 9, according to IT-Connect.

This is the second-largest Patch Tuesday on record, behind October’s 1,407 fixes. Large monthly totals are becoming the norm, which makes prioritising more important than ever.

The exploited Outlook flaw: CVE-2026-124194

The zero-day is tracked as CVE-2026-124194, a spoofing vulnerability in classic Outlook. Microsoft rates it only Moderate, with a CVSS score of 6.5, but it is the one attackers are already using.

How the attack works

1. An attacker sends the victim a specially crafted message file.
2. The victim opens the file.
3. Outlook connects to a network location the attacker controls, without showing the usual warning about external content.
4. That connection can leak the user’s NTLMv2 authentication hash. Attackers can try to crack the hash offline or use it in relay attacks to impersonate the user.

The attack needs the user to open the file and needs network connectivity. Microsoft says the Preview Pane is not an attack vector for this particular flaw. It has confirmed exploitation but has not said who is behind it or how widespread it is. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalogue on 10 November and gave federal agencies until 24 November to fix it.

Who is affected

Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. IT-Connect lists the fixed builds as 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024.

Why Windows Update alone is not enough

The Outlook fix ships through Office’s own update channel. A computer that shows Windows as fully up to date can still be running a vulnerable copy of Outlook. Do not assume Office updated itself in the background; check it.

For the Windows side, the main cumulative updates this month are:

• KB5132061 for Windows 11 24H2, 25H2 and 26H2
• KB5132059 for Windows 11 26H1
• KB5131087 for Windows 11 23H2
• KB5131096 for Windows 10 21H2 and 22H2 (LTSC editions and machines enrolled in Extended Security Updates)

Other critical flaws worth your attention

None of these is marked as exploited yet, but several are serious enough to move to the front of the queue for organisations running Windows servers:

• Three critical Outlook remote code execution flaws (CVE-2026-110043, CVE-2026-110068 and CVE-2026-111309), which IT-Connect says can be triggered just by displaying a malicious email in the reading pane.
• Windows LDAP (CVE-2026-119958), rated 9.8 out of 10, allowing unauthenticated code execution on domain controllers.
• Active Directory Domain Services (CVE-2026-118146 and CVE-2026-118148), which Microsoft rates as “exploitation more likely”.
• Windows Search (CVE-2026-116928), rated 9.8, which can be triggered by an email attachment that Exchange indexes automatically. The fix is in Windows, not Exchange.
• Exchange Server (CVE-2026-118207), fixed for Exchange Subscription Edition in KB5133453.
• Schannel (CVE-2026-119952), a pre-authentication flaw in Windows’ TLS component that depends on specific configurations.
• Eight Hyper-V privilege escalation flaws, including one that could allow a virtual machine escape.

Exchange 2016 and 2019 are not in this month’s list because their extended security update programme ended in October 2026. They are still exposed, so organisations still running them should plan a move to a supported version or to a hosted service.

What this means for Nigerian and African businesses

Many small offices across the region run classic Outlook on shared PCs and keep older Exchange servers going long past their support dates. That combination is exactly what this month’s release targets. An NTLM hash stolen from one staff member can become a way into shared drives and email for the whole office. Patching quickly, and replacing unsupported servers, is far cheaper than recovering from a compromised mailbox used to send fake invoices to your customers.

What you should do

1. Update Office on every PC that runs Outlook. In Outlook or Word, go to File > Account > Update Options > Update Now, then restart Office when asked.
2. Run Windows Update separately and restart to install this month’s cumulative update.
3. Administrators: list every device running classic Outlook, push the November Office update through Intune, Configuration Manager or your usual tool, and confirm devices reached the fixed build.
4. Patch servers in order: domain controllers, then Exchange hosts (Windows update plus KB5133453), then Hyper-V hosts.
5. Warn staff not to open unexpected message-file attachments. This is an extra layer, not a replacement for patching.
6. Back up before patching critical servers so you can recover if an update causes problems.

Sources

• Cyber Security News: Microsoft November 2026 Patch Tuesday fixes 1,093 vulnerabilities
• IT-Connect: Patch Tuesday November 2026
• WindowsForum: Exploited Outlook zero-day requires Office update
• BleepingComputer: Microsoft November 2026 Patch Tuesday

Read and share the original on Mosravo Endless Solutions Publications

Google has released an emergency Chrome update to fix a zero-day flaw that attackers are already exploiting. If you or your staff use Chrome on Windows, Mac or Linux, this is an update to install today, not next week. This article explains what was fixed, who is affected, and how to make sure every browser in your home or office is protected.

What happened

On Monday, 9 November 2026, Google pushed Chrome version 157.0.8103.50/.51 to the Stable channel for Windows and Mac, and 157.0.8103.50 for Linux. The update fixes nine security problems. According to security outlets reporting on Google’s advisory, the most serious is CVE-2026-125350, a “use-after-free” bug in the part of Chrome that handles XML data, and Google says it is aware that an exploit for this flaw exists in the wild.

The bug was reported to Google by an anonymous researcher on 6 November, which means Google turned around a fix in about three days. That speed is a strong signal of how seriously the company is treating it.

What a use-after-free bug means

A use-after-free happens when a program keeps using a piece of memory after it has already released it. A skilled attacker can arrange for their own data to land in that freed memory, and then trick the program into running it. In a browser, this kind of flaw is often triggered simply by opening a booby-trapped web page. That is why browser zero-days are so valuable to criminals and spyware operators: the victim does not need to download or install anything.

What Google has not said

Google has not shared who is behind the attacks, who has been targeted, or how the malicious pages are being delivered. This is normal practice. The company usually keeps bug details restricted until most users have updated, so that other attackers cannot copy the technique from the fix.

The other flaws fixed in Chrome 157

The same update closes eight more security holes. Google has not reported that any of these are being exploited, but several are rated high severity, so they add to the case for updating quickly. Reported fixes include:

• A second use-after-free bug in XML handling (CVE-2026-125346).
• A type confusion bug in V8, Chrome’s JavaScript engine (CVE-2026-125344).
• A buffer overflow in Compositing, the code that draws page layers on screen.
• An out-of-bounds write in GPU code.
• An incorrect authorization issue in the FileSystem component.
• Three uninitialized resource bugs in WebGL and GPU code.

Bugs in V8 and graphics code are favourite targets for attackers because they can sometimes be chained together with other flaws to escape Chrome’s security sandbox.

Who is affected

Anyone running Chrome on a desktop or laptop older than the versions above is exposed. That includes home users, schools, cybercafés, banks, fintechs and small businesses across Nigeria and the rest of Africa, where Chrome is the most widely used browser on PCs.

Other browsers built on the Chromium engine, such as Microsoft Edge, Brave and Opera, share much of Chrome’s code. Their makers ship their own fixes on their own timelines, so users of those browsers should watch for updates over the coming days rather than assume they are already protected.

Why the “rolling out” message matters

Google says the update will roll out “over the coming days/weeks”. In practice, that means many computers will not receive it automatically right away. A browser that has been left open for days may also have downloaded the update but not applied it, because Chrome only finishes updating when it restarts. For an exploited bug, you should not wait for the rollout to reach you.

How to update Chrome now

1. Open Chrome and click the three-dot menu in the top-right corner.
2. Go to Help, then About Google Chrome. (You can also type chrome://settings/help in the address bar.)
3. Chrome will check for updates and download the new version.
4. Click Relaunch. Your open tabs will reopen, but save any unfinished work in web forms first.
5. Go back to About Google Chrome and confirm the version starts with 157.0.8103.50 or higher.

If the About page says Chrome is up to date but shows an older version, wait a few minutes and check again, or restart the computer.

Advice for businesses and IT teams

In an office, the real risk is the one machine nobody checks: the reception PC, the accounts laptop that is never restarted, or a shared computer in a training room. A few steps help close those gaps:

• Do a quick walk-round or remote check. Confirm the Chrome version on every computer, not just your own.
• Force a restart. If you manage Chrome centrally through Google Admin console or Windows Group Policy, use your relaunch notification settings to require a browser restart within a short window.
• Check other Chromium browsers. List which browsers are installed on staff PCs and track updates for each one.
• Do not forget kiosks and display screens. Machines used for dashboards, point-of-sale screens or digital signage often run Chrome unattended and are easy to overlook.
• Remind staff about links. Until every device is updated, be extra careful with unexpected links in email, WhatsApp and SMS.

What you should do

• Update Chrome to 157.0.8103.50 or later on every Windows, Mac and Linux computer today, then relaunch the browser.
• Check the version number afterwards instead of assuming the update was applied.
• Update Edge, Brave, Opera and other Chromium-based browsers as soon as their makers release fixes.
• Turn on automatic updates and restart your browser at least once a week so future emergency fixes apply quickly.
• If a computer behaved oddly after visiting an unfamiliar site in recent days, run a full security scan and change passwords for important accounts from a clean device.

Sources

• Chrome Releases: Stable Channel Update for Desktop (9 Nov 2026)
• SecurityOnline: Chrome Zero-Day CVE-2026-125350 Exploited
• GBHackers: Google Chrome Zero-Day Vulnerability Exploited in the Wild

Featured image: Photo: “PSP Web Browser” by wyzik, CC BY 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications

D-Link has warned owners of its DGS-3130 series managed switches about several security flaws that do not yet have a firmware fix. The company published an interim advisory on 6 November 2026, just four days after receiving the report, and is asking network administrators to apply workarounds now. This article is for IT staff, managed service providers and business owners whose offices, campuses or data rooms run D-Link managed switches.

Key takeaways

• The confirmed affected model is the DGS-3130-30TS, hardware revision B1, on firmware 2.00.B014, 2.00.B034, 2.04.000 and 2.04.001.
• Other DGS-3130 models and other D-Link switches are still being investigated.
• There is no patched firmware and no release date yet.
• D-Link’s top advice is to disable the D-Link Discovery Protocol (DDP), remove default SNMP communities and lock down management access.
• No attacks using these flaws have been reported so far.

What D-Link disclosed

According to D-Link’s advisory (SAP10523), the company received a coordinated disclosure on 2 November 2026 from Giresh Kumar Enugu, a network engineer at Spectrum Community Solutions. D-Link lists the resolution status as “partial” because it is still assessing how far the problems reach.

Problems in the D-Link Discovery Protocol

The first group of issues sits in DDP, a protocol D-Link devices use to find and manage each other on a network. D-Link describes weaknesses in authentication, access control and how the protocol handles information. An attacker who can reach the switch on the network could potentially:

• gain unauthorised administrative access or change admin credentials;
• read device and network configuration details;
• expose SNMP community information, which is often used by monitoring tools;
• reset the device or disrupt service.

Firmware security concerns

The second group concerns the firmware itself: SSH configuration, how operating-system credentials are protected, and how firmware encryption and embedded cryptographic material are handled. D-Link is clear that switching off DDP does not fix these firmware issues. Some findings have CVE identifiers reserved, but the records are not public yet, as BleepingComputer also reported.

Who is affected

The DGS-3130 is a family of managed Gigabit stackable switches, the kind found in server rooms, school networks, hospitals, hotels and growing offices. In many organisations, switches like these are installed once by a contractor and then rarely touched, which makes interim mitigations easy to overlook. If you are not sure what model you have, check the label on the device or the system information page in its management interface, and note the hardware revision as well as the firmware version.

According to D-Link, the attacker needs access to the affected network. That lowers the risk for well-segmented networks, but a single infected PC or a guest device on the same network segment could be enough, and any switch with its management interface exposed to the internet is at higher risk.

D-Link’s interim mitigations, step by step

1. Disable DDP immediately. In the switch command line, run no ddp in global configuration mode and in interface configuration mode, check the result with show ddp, and save the configuration. D-Link warns this may affect device discovery or management workflows.
2. Remove default SNMP communities. Delete “public”, “private” and any other unneeded community strings. Where supported, use SNMPv3 with authentication and privacy, and allow SNMP only from authorised hosts.
3. Restrict management access. Limit SSH, web and SNMP management to designated admin machines, keep management interfaces off the public internet, and enforce this with firewall rules. D-Link advises not to rely only on the switch’s own access lists or on VLAN separation.
4. Back up and monitor. Keep verified offline configuration backups, review admin accounts, and watch logs for unexpected restarts, configuration changes, interface shutdowns or factory resets.
5. Watch for firmware. Check D-Link’s security announcements regularly. Before installing any future update, confirm the exact model and hardware revision, because firmware may not be compatible across revisions.

Context: D-Link’s recent run of advisories

BleepingComputer notes that in September D-Link warned of a separate maximum-severity zero-day in legacy DIR-822A routers, which has a public proof-of-concept exploit. That issue affected older consumer routers, while this one involves business switches, and D-Link says it will update its advisory as it verifies more information. Either way, the pattern is a reminder that network gear deserves the same patch attention as laptops and servers.

Why switches are attractive targets

A managed switch sits at the heart of a network. An attacker who controls one could change its configuration or knock part of a network offline. Because switches rarely run security software and are seldom monitored, problems can go unnoticed for a long time.

What you should do

• Inventory your D-Link switches today and note the model, hardware revision and firmware version of each.
• For any DGS-3130 device, disable DDP and save the configuration, testing first if your team relies on D-Link discovery tools.
• Remove “public” and “private” SNMP communities and move to SNMPv3 where possible.
• Make sure no switch management page is reachable from the internet; put management on a separate admin network.
• Take a fresh configuration backup and store it offline.
• If you use an IT contractor or managed service provider, forward them D-Link advisory SAP10523 and ask them to confirm the mitigations in writing.
• Check back for firmware and install it promptly once released.

Sources

• D-Link Security Advisory SAP10523: DGS-3130-30TS (Interim)
• BleepingComputer: D-Link warns of multiple zero-days in DGS-3130 Series switches

Featured image: Photo: “Networking Switch” by @felixtriller, CC BY 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications

Zyxel has released new firmware for ten models of its popular GS1900 smart switches after researchers found that attackers had a way around a fix the company shipped in June. The flaw, CVE-2026-107441, was used to compromise nearly 1,000 switches worldwide. GS1900 switches are common in small offices, schools, hotels and shops, so if your network cabinet has one, it is worth checking today.

What happened

In June 2026, Zyxel patched an earlier pre-authentication buffer overflow in GS1900 switches, tracked as CVE-2026-7273. From around 17 August, threat intelligence firm GreyNoise saw a suspected Chinese-speaking group exploiting GS1900 devices, and reported 996 compromised switches across 48 countries. When GreyNoise disclosed the campaign on 21 September, it was linked to the June flaw, and CISA added CVE-2026-7273 to its list of known exploited vulnerabilities the same day.

Security firm Binarly then recovered the attackers’ exploit, an obfuscated Python script found in an exposed archive. On 28 September it confirmed that the script still worked against all ten firmware releases that contained the June fix. Binarly reported this to Zyxel on 29 September. Zyxel confirmed the new flaw on 11 October, released fixed firmware on 22 October and published its advisory on 3 November.

How the bypass worked

According to BleepingComputer’s reporting, the June patch added checks to stop oversized data overflowing memory. But the attackers could corrupt a parameter counter before it was checked, overwriting memory and running commands without logging in. Zyxel describes the bug as an out-of-bounds write in the switch’s CGI program, which handles the web management page. The new firmware limits the size of HTTP parameters and validates how many there are before copying data into memory.

Once inside, attackers ran commands and downloaded a script that collected configuration files, hashed root credentials and network information. Researchers linked the activity to a wider campaign that had also exploited a flaw in the Gitea code-hosting software.

Which switches are affected

Zyxel’s advisory lists these models. If your firmware version ends in .2)C0 or earlier, you need the update. The fixed version ends in .3)C0, also referred to as V2.90 Patch 3.

• GS1900-8: fixed in 2.90(AAHH.3)C0
• GS1900-8HP: fixed in 2.90(AAHI.3)C0
• GS1900-10HP: fixed in 2.90(AAZI.3)C0
• GS1900-16: fixed in 2.90(AAHJ.3)C0
• GS1900-24: fixed in 2.90(AAHL.3)C0
• GS1900-24E: fixed in 2.90(AAHK.3)C0
• GS1900-24EP: fixed in 2.90(ABTO.3)C0
• GS1900-24HPv2: fixed in 2.90(ABTP.3)C0
• GS1900-48: fixed in 2.90(AAHN.3)C0
• GS1900-48HPv2: fixed in 2.90(ABTQ.3)C0

Zyxel says products not in its table are not affected. The advisory offers no workaround other than installing the patched firmware.

Who can exploit it

The flaw is rated 8.8 out of 10. An attacker needs network access to the switch’s web management interface but does not need a password. That usually means someone already on your local network, or anyone at all if the management page has been exposed to the internet. A compromised laptop, an unsecured guest Wi-Fi network or a shared building network can all provide that foothold.

Why it matters for small businesses

Switches are the quiet boxes that connect every PC, printer, CCTV camera and access point in an office. Because they rarely need attention, many are installed once and never updated. A hijacked switch gives an attacker a hiding place inside the network that antivirus on staff computers will not see, plus configuration details useful for further attacks.

This case also shows that “we patched in June” is not the end of the story. A fix can be incomplete, and vendors sometimes need several rounds to close a hole properly. Across Nigeria and the rest of Africa, many SMEs buy networking gear through resellers and installers who may not be on contract to maintain it, so nobody is watching for advisories like this one.

What you should do

1. Identify your switches. Check the label on each switch in your network cabinet for the model name. Note any GS1900 models from the list above.
2. Check the firmware version. Sign in to the switch’s web management page and look at the system information or status screen. Compare the version with the fixed release for your model.
3. Download firmware only from Zyxel. Get the update from Zyxel’s official support pages, not from forums or file-sharing sites. Back up the switch configuration before you start.
4. Install during a quiet period. The switch will restart, briefly cutting off everything plugged into it. Do it after hours.
5. Limit access to the management page. Make sure it is never reachable from the internet, and where possible restrict it to a separate management network or a few trusted IP addresses. Keep guest Wi-Fi isolated from it.
6. Change the admin password. Since attackers took hashed credentials from compromised devices, set a new, strong admin password after updating, and review the configuration for changes you did not make.
7. Ask your installer. If a contractor manages your network, ask them to confirm in writing that every GS1900 is on the .3)C0 firmware.

Ten minutes with a laptop and the switch’s web page can close a door that attackers have already shown they know how to open.

Sources

• Zyxel security advisory: out-of-bounds write vulnerability in GS1900 series switches
• BleepingComputer: Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
• CybelAngel: Weekly Cyber Roundup, November 2-8, 2026

Featured image: Photo: “Ethernet Cable” by David Davies, CC BY-SA 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications

SonicWall has released SonicOS updates that fix seven security flaws in its firewalls, and one of them is already on the US Cybersecurity and Infrastructure Security Agency’s (CISA) list of vulnerabilities known to be exploited. The bug can let someone get past SAML sign-in controls, and the multi-factor authentication (MFA) that SAML enforces, on the SSL VPN that staff use to work remotely. If your business, school or bank branch connects remote workers through a SonicWall firewall, this is one to schedule today.

What happened

SonicWall published security advisory SNWLID-2026-0014 on 6 November 2026. It covers seven SonicOS vulnerabilities across Gen7 and Gen8 firewalls. The most urgent is CVE-2026-19868, rated 7.1 (high) on the CVSS scale and reported by Ryan Harris of The Electronic Office.

According to SonicWall, the flaw is an authentication enforcement problem in the SonicOS SSL VPN service. A user who holds valid credentials for a different authentication method can bypass SAML authentication controls, and with them any MFA that SAML was meant to enforce. In practice, that weakens the extra login step many organisations rely on to stop attackers who have stolen a password.

SonicWall says its product security team has investigated a report indicating potential exploitation. CISA went further and added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue on 6 November, giving US federal agencies until 20 November to fix it. Neither SonicWall nor CISA has shared details of the attacks, and it is not clear whether the bug was used before the fix was available.

Who is affected

The issue matters only where SAML-based login is enabled for the SSL VPN, according to the vendor. Affected firmware is:

• Gen7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or older.
• Gen8 TZ, NSa and NSv firewalls running SonicOS 8.2.2-8015 or older.

The fixed releases are SonicOS 7.3.4-7013 for Gen7 and SonicOS 8.2.3-8015 for Gen8. SonicWall lists no workaround, so upgrading is the only fix.

The other six flaws

Even if you do not use SAML, the same advisory is worth acting on. Reports on the advisory list:

• Two flaws rated 8.8 in the SonicOS management interface: a permissive cross-domain policy issue (CVE-2026-107155, which needs user interaction) and a session validation bug (CVE-2026-107154). Under certain conditions a remote attacker could abuse them without logging in.
• A pre-authentication heap buffer overflow in the SSL VPN (CVE-2026-82308, rated 7.5) and two TACACS+ client flaws (CVE-2026-77708 and CVE-2026-77709) that could be used to knock services offline.
• A weak password hashing issue on virtual appliances (CVE-2026-19703) that could expose a limited platform credential to someone who already has high-privileged local access.

None of these six is marked as exploited so far.

Why this matters

Firewalls and VPN gateways sit on the edge of the network and are reachable from the internet by design, which makes them a favourite target. SonicWall devices have been hit repeatedly this year. In July and September, attackers exploited zero-day flaws in SonicWall’s separate SMA 1000 remote access appliances, and SecurityWeek notes that another SonicWall bug, CVE-2026-102255, began to be targeted days after disclosure.

The new flaw is especially awkward because it undermines MFA, which organisations often treat as their safety net when passwords leak. Stolen VPN passwords are widely traded, so an attacker who can sidestep the second factor may walk straight into the internal network. For Nigerian and African firms that moved staff to remote or hybrid work and rely on a single edge firewall, the VPN is often the front door to file servers, accounting systems and email.

What you should do

1. Find your firewalls and their generation. In the SonicOS web interface, check the model and firmware version on the dashboard or system status page. Confirm whether each unit is Gen7 or Gen8 before choosing the release.
2. Upgrade. Install SonicOS 7.3.4-7013 or later on Gen7 units and 8.2.3-8015 or later on Gen8 units. Back up the configuration first and plan a short maintenance window, because the firewall will restart.
3. Review SSL VPN sign-in methods. Check which authentication methods are enabled alongside SAML. Remove any you do not need, especially local accounts that do not have strong, unique passwords.
4. Check VPN login logs. Look for sign-ins at odd hours, from unexpected countries or by accounts that normally use SAML but logged in another way. Investigate anything you cannot explain.
5. Lock down the management interface. Make sure the firewall’s admin page is not reachable from the internet, and restrict it to trusted internal addresses.
6. Reset credentials if in doubt. If you see signs of misuse, reset VPN passwords and revoke active sessions after patching.
7. Ask your IT provider. If a managed service provider runs your firewall, ask them in writing to confirm the version installed and the date it was updated.

Patch first, then review. With no workaround and a confirmed listing in CISA’s exploited catalogue, every day an affected firewall stays on old firmware is a day of unnecessary risk.

Sources

• SecurityWeek: SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
• Cyber Security News: SonicWall Warns of Potential In-the-Wild Exploitation of SSLVPN Flaw
• Help Net Security: SonicWall SMA zero-days were exploited weeks before disclosure

Featured image: Photo: “computer laptop keyboard HP Pavilion Entertainment PC” by GoodNCrazy, CC BY 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications

Microsoft has fixed a serious flaw in Paint, the drawing app that ships with Windows 11, but there is a catch that many office PCs will miss: the fix does not come through Windows Update. It is delivered only as a Microsoft Store app update, and for a time even the Store was handing out a build that did not contain it. This guide is for small business owners, IT staff and everyday Windows users who want to be sure every copy of Paint on their machines is actually patched.

Key takeaways

• The flaw is tracked as CVE-2026-83844 and rated Important by Microsoft, with a CVSS score of 8.1.
• The safe version is Paint 11.2609.401.0 or later. Older builds should be updated.
• Windows Update does not install this fix. Paint is updated through the Microsoft Store.
• Paint is installed per user, so a shared PC can have several copies at different versions.
• Microsoft says the bug was not known to be exploited when it was disclosed, so this is a patch-promptly issue, not a panic.

What Microsoft fixed

Microsoft published its advisory on 13 October 2026. It describes an out-of-bounds read in Paint, meaning the program can read memory beyond the area it set aside. According to Microsoft’s description, reported by The Hacker News, an attacker could trigger it by sending a specially crafted packet to an affected service over the network, without signing in and without the user doing anything. Microsoft also notes that a successful attack needs a deep understanding of the target system, which is one reason the attack complexity is rated high.

When the advisory was released, the flaw had not been publicly disclosed or seen in attacks. When The Hacker News checked on 6 November, it was not in CISA’s Known Exploited Vulnerabilities catalogue either.

Why the version number caused confusion

Microsoft’s Security Update Guide first listed Paint 11.2605.91.0 as the fixed build. German site Borncity, citing Neowin, reported that at the time the Store was offering only 11.2605.81.0, which did not include the fix. Microsoft has since updated its guidance and now lists 11.2609.401.0 as the fixed version. The public CVE record still mentions the older threshold, but a build at 11.2609.401.0 or higher satisfies both numbers, so that is the one to aim for.

Why Windows Update is not enough

Paint is updated as a Microsoft Store app rather than as part of Windows itself, so its fixes arrive the same way as updates to other Store apps. Businesses that rely only on Windows Update, or that have switched off the Store or its automatic updates, can end up with fully patched Windows and an unpatched Paint.

Brian Vitko, a researcher at device-management software maker RFF, found that in six countries he checked, the newest Store build was still the unfixed 11.2605.81.0. The Hacker News later found 11.2609.401.0 offered in all ten countries it checked, and one of its test machines updated on its own. How quickly every PC receives it remains unclear, which is why checking is worth a few minutes.

How to check your Paint version

On a single PC

1. Open PowerShell and run Get-AppxPackage Microsoft.Paint. The Version line shows the installed build.
2. If it is lower than 11.2609.401.0, open the Microsoft Store, go to your app library and check for updates, or let Store auto-update install it.
3. Run the command again and confirm the new version number.

On shared or office PCs

Because Paint is installed separately for each user account, checking only the signed-in account can miss older copies. Vitko recommends two PowerShell commands, run as administrator:

• Get-AppxPackage -AllUsers (filtered for Microsoft.Paint) lists the Paint version for every user account on the machine.
• Get-AppxProvisionedPackage -Online shows the copy Windows will install for any new user who signs in later.

After updating, run both commands again and confirm every entry shows 11.2609.401.0 or later. Organisations using Microsoft Intune or a similar management tool can trigger a Store app update scan across many PCs at once instead of visiting each desk.

Is there a workaround?

Microsoft’s advisory lists no workaround. Vitko suggested that where nobody needs Paint, removing it for every user, and removing the provisioned copy, would take the vulnerable app off the machine, though he noted he had not tested this approach. For most offices, simply updating is the cleaner option, since staff often use Paint to crop screenshots and annotate images.

A note for Nigerian and African SMEs

Many small offices run a mix of PCs bought at different times, some signed in with local accounts and some with the Store disabled to save data. That setup is exactly where Store-only fixes get missed. If your office restricts the Store to control bandwidth, schedule a time, perhaps outside business hours, to allow updates, then confirm the versions afterwards.

The bigger lesson: Store apps need patching too

The practical takeaway is that “Windows is up to date” does not mean every app on the PC is. A good monthly routine is to check Windows Update, then open the Microsoft Store library and install pending app updates, then update browsers and any line-of-business software.

What you should do

• Check Paint’s version on your own PC today and update it from the Microsoft Store if it is below 11.2609.401.0.
• On shared PCs, use the two PowerShell commands so no user account is left behind.
• Make sure Microsoft Store automatic app updates are allowed, or schedule a regular manual update window.
• If Paint is not needed on certain machines, such as kiosks or point-of-sale PCs, consider removing it after testing.
• Add “Store app updates” to your monthly patch checklist alongside Windows Update.

Sources

• The Hacker News: Microsoft Paint RCE fix now available, but Windows Update won’t deliver it
• Borncity: Microsoft Paint vulnerability, version 11.2609.401.0 protects

Featured image: Photo: “computer laptop keyboard HP Pavilion Entertainment PC” by GoodNCrazy, CC BY 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications

Hackers are no longer just stealing data. Over the past month they have reached into supermarket fridges, cold rooms and even blood storage, changing temperature settings until stock spoiled. This week the FBI and CISA, together with three other US agencies, issued a joint warning urging operators of industrial refrigeration and cold chain monitoring systems to lock them down. This article explains what happened, why it matters to any business that keeps goods cold, and the practical steps to take now.

What happened

The French supermarket attacks

The wave began in France in mid-October. According to The Register and Infosecurity Magazine, attackers tampered with refrigeration controllers on 11 October 2026, triggering defrost cycles and pushing temperatures up. Retailers including Carrefour, Intermarché, Monoprix and Coopérative U reported affected stores. Intermarché’s parent group said about 150 of its stores were hit and Carrefour confirmed about 80. Le Monde reported one freezer near Bordeaux whose setpoint was changed from minus 22°C to 150°C, with a technician watching several settings change every second, which suggests automated tools.

France’s national cyber agency, CERT-FR, issued an alert on 12 October reporting numerous compromises of Danfoss AK-SM and AK-SC controllers, and also listed Dixell/Copeland xweb devices. Danfoss said the affected stores were running outdated firmware. Researchers at Claroty had disclosed flaws in Danfoss controllers, including a hidden authentication mechanism that could bypass the admin password, and Danfoss patched those in August 2025. Authorities have not confirmed which weakness was used in France.

It kept spreading

BleepingComputer reports that a second wave in November hit more than 115 stores across six European countries, with some systems shutting down and others reaching 50°C. On 3 November, France’s national blood service (EFS) said an incident at a refrigeration equipment provider had altered temperature and defrost settings at three blood storage facilities.

The FBI and CISA warning

The joint advisory from the FBI, CISA, and the US departments of Health and Human Services, Agriculture and Transportation targets electronic temperature controllers and commercial refrigeration management systems used in grocery retail and cold storage. These tools let operators monitor temperatures remotely, manage defrost cycles and control cooling equipment.

According to BleepingComputer’s summary, the agencies say attackers go after controllers that are unpatched or reachable from the internet, using authentication bypass flaws, code injection bugs and weak configurations. Once inside, they can change setpoints, force continuous heating or defrost, and blind operators to the real temperature. The possible results include lost inventory, shorter equipment life, fire hazards and unsafe storage that nobody notices in time.

Why it matters in Nigeria and across Africa

The same kinds of networked controllers sit inside supermarkets, cold rooms, pharmacies, hospital stores, vaccine depots, fish and poultry distributors, and food processors across the continent. Many were installed by a refrigeration contractor who enabled remote access so they could monitor or fix things without a site visit, often with the default password left in place. The Register reports that internet scans in October found more than 4,500 Danfoss controller interfaces exposed online. Nothing about that problem is unique to Europe.

In a market where power interruptions already strain cold chains and a single spoiled consignment can wipe out a month’s margin, a remote attacker quietly raising temperatures overnight is a serious business risk, not a curiosity.

How to tell if you are exposed

• Ask your refrigeration contractor which controller brand and model you use, how it connects to the internet, and who has remote access.
• Check for a web login page. If you or your contractor can reach the controller from a browser outside your premises without a VPN, it is probably exposed.
• Look for default passwords and shared logins that former staff or old contractors still know.
• Check firmware age. If nobody has updated the controller since installation, assume it is missing fixes.
• Watch for odd behaviour: unexplained defrost cycles, setpoints you did not change, alarms that were switched off, or temperature graphs that look too flat.

What you should do

1. Take controllers off the public internet. This is the agencies’ first recommendation. If remote access is genuinely needed, put it behind a VPN or a secure remote access service with strong authentication.
2. Change default and shared passwords on every controller and management console, and give each contractor their own account.
3. Apply firmware and software updates from the manufacturer. Ask your contractor to confirm the version in writing.
4. Separate the cold chain network from the office Wi-Fi and point-of-sale systems so one compromise cannot spread.
5. Set safe limits in the controller so it cannot be driven outside acceptable temperature ranges, as the advisory recommends.
6. Keep an independent check. A simple standalone thermometer or data logger that is not connected to the controller gives you a second opinion if the main system is tampered with.
7. If you suspect tampering, follow CERT-FR’s advice: disconnect or restrict network access, factory reset, patch, change all credentials, review accounts and reconfigure from scratch. In Nigeria you can also report incidents to ngCERT.

Refrigeration has quietly become part of your IT estate. Treat the controller box on the cold room wall with the same care you give your router and your accounting software.

Sources

• BleepingComputer: FBI, CISA warn of cyberattacks targeting refrigeration systems
• The Register: French supermarket refrigeration attacks
• Infosecurity Magazine: French supermarket cyber-attack impacts more refrigeration controllers

Featured image: Photo: “Digbeth Cold Storage – 123 – 135 Digbeth” by ell brown, CC BY 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications

A newly disclosed OpenSSH weakness lets an attacker sign in to certain locked or key-only Linux accounts simply by typing an extremely long password. The bug, nicknamed “*sshole” by the researcher who found it, only affects systems built on the musl C library, such as Alpine Linux, but those systems are everywhere: in Docker containers, cloud images, routers and embedded devices. OpenSSH has already shipped a fix in version 10.6p2. This article explains who is exposed, how to check, and what to change today.

What happened

On 5 November 2026, security researcher Ozgun Kultekin published details of an authentication bypass in the way OpenSSH checks passwords on musl-based Linux systems. According to his write-up and reporting by BleepingComputer and The Register, an attacker can log in to an account whose password field in /etc/shadow is a single asterisk (*) by sending a password longer than 256 bytes. The researcher’s page describes passwords between 257 and 1,024 characters being accepted.

An asterisk in the shadow file is a long-standing Unix convention meaning “no password can ever match this account”. Administrators use it for accounts that should only sign in with SSH keys, for service accounts, and on Alpine for the root account. The flaw turns that “locked” marker into a password that any sufficiently long string can satisfy.

BleepingComputer reports that the researcher used AI agents to run roughly 17,600 authentication tests while hunting for the behaviour. The Register says there is no indication that vulnerable systems have been exploited so far, but full technical details and a checking tool are now public, so that window may not last.

How the bug works, in plain terms

Three separate design decisions, each reasonable on its own, combine to create the hole:

1. musl’s crypt() returns “*” on failure. Since 2012, when musl’s password hashing function fails it returns the string * rather than an empty value.
2. musl rejects passwords over 256 bytes. Its SHA-512 password hashing refuses very long inputs as a denial-of-service safeguard, and that refusal counts as a failure, so the function returns *.
3. OpenSSH still hashes the attempt. A 2016 OpenSSH change, made to stop attackers discovering valid usernames by timing logins (CVE-2016-6210), makes sshd hash the supplied password even for accounts without a usable hash, borrowing a salt from another account that does have a real password.

Put together: the overlong password fails to hash, musl returns *, sshd compares that with the stored *, the two match, and the login succeeds.

Who is affected

Conditions that must all be true

Per the researcher and BleepingComputer, a system is only exposed when every one of these applies:

• OpenSSH is running on a musl-based distribution such as Alpine Linux, OpenWrt, Buildroot or Yocto, or in a container image built on one.
• PAM authentication is not in use. Alpine’s openssh-server package does not use PAM by default.
• SSH password authentication is enabled, which is OpenSSH’s default.
• At least one account has * as its password hash.
• At least one other account has a real password hash.

Cloud images deserve special attention

BleepingComputer notes that Alpine’s official AWS and Azure images include a default alpine account with passwordless doas rights. On those images, a successful bypass of that account could lead straight to root access.

Who is not affected

Systems using glibc, which includes Debian, Ubuntu and Fedora, are not affected, and neither are setups that authenticate through PAM. The researcher also lists the Dropbear SSH server and OpenBSD as unaffected, so embedded devices that run Dropbear rather than OpenSSH fall outside this issue.

Why this matters for African businesses and developers

Alpine is popular precisely because it is small. Many Nigerian and African startups, agencies and fintech teams use Alpine-based Docker images to keep cloud bills and image sizes down, and many small ISPs and hotspot operators run musl-based firmware on routers and access points. These systems are often set up once and forgotten. If any of them expose SSH to the internet with password logins switched on, they should be checked now rather than at the next maintenance window.

How to check your systems

1. Find musl-based hosts and containers. List servers, VMs, containers and appliances running Alpine, OpenWrt, Buildroot or Yocto with OpenSSH installed.
2. Check whether password login is on. Run sshd -T | grep -i passwordauthentication on each host. If it says yes, the host is a candidate.
3. Look for asterisk accounts. On Alpine, BleepingComputer suggests grep '^alpine:' /etc/shadow; more broadly, look for any account whose second field is *.
4. Review logs. Search authentication logs for password logins to accounts that should never accept one. On Alpine, grep "Accepted password" /var/log/messages is a starting point. A successful password login for an account with * in its shadow field is a red flag.
5. Use the researcher’s checker. The disclosure page links a checking tool on GitHub; review it before running it in production.

What you should do

• Update OpenSSH to 10.6p2 or later. On Alpine, run apk upgrade openssh and restart sshd. Rebuild Docker images so containers do not keep shipping the old package.
• If you cannot update yet, turn off password logins. Add PasswordAuthentication no to a file in /etc/ssh/sshd_config.d/ (or to sshd_config) and restart the SSH service. Make sure your key-based access works first so you do not lock yourself out.
• Do not expose SSH to the whole internet. Restrict it with a firewall, VPN or allow-list of office IP addresses.
• Treat suspicious logins as an incident. If logs show unexpected password logins, rotate keys and credentials, check for new users or cron jobs, and rebuild the host from a clean image where possible.
• Ask your vendors. If you rely on routers or appliances built on OpenWrt or Yocto, ask the vendor whether they ship OpenSSH and when a firmware update is due.

Key-only SSH with password logins disabled has long been best practice. This bug is a sharp reminder of why: an account you believe is locked may not be, and the simplest defence is not to accept passwords over SSH at all.

Sources

• BleepingComputer: OpenSSH flaw lets attackers log into password-disabled Linux accounts
• *sshole: researcher’s technical disclosure
• The Register: Get root on a musl Linux system with an overly long password

Featured image: Photo: “Inside Introduction to the Command Line” by OsamaK, CC BY-SA 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications

This alert is for IT administrators, managed service providers and business owners who run Barracuda security appliances, especially the Email Security Gateway (ESG) that filters company email. On 2 November 2026, Barracuda released fixes for two vulnerabilities that, used together, could give an attacker full root control of an ESG appliance. One of the two flaws also affects five other Barracuda products.

Key takeaways

• CVE-2026-116606 is an authorisation bypass in the ESG web management interface, rated 9.3 by Barracuda.
• CVE-2026-111560 is a command injection flaw rated 8.6 that affects ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway.
• Chained together, the two flaws can lead to root access on ESG.
• No active exploitation or public exploit code had been reported at the time of writing, but ESG has been targeted quickly in the past.
• Patch now and keep the management interface off the public internet.

What Barracuda fixed

CVE-2026-116606: configuration restore without logging in

According to Barracuda’s advisory and an analysis by Beazley Security Labs, this flaw lets an unauthenticated attacker reach a configuration-import function in the ESG administrative interface and restore a crafted backup file. That overwrites the device’s global settings without needing a password. Only the Email Security Gateway is affected by this bug.

CVE-2026-111560: commands hidden in the timezone field

The second bug is an operating system command injection flaw in the timezone setting, in code shared across several Barracuda appliances. On its own it requires administrator access, but a malformed timezone value can make the device run shell commands as root. The flaws were reported by Mandiant researchers, according to SecurityOnline.

Why the chain matters

Combined, the first flaw can give an attacker the administrative foothold needed to trigger the second, which results in full root control of the appliance. Barracuda notes that exploitation requires access to the administrative interface, which is why internet-exposed management pages are the biggest worry. SecurityOnline reports that Shodan searches show thousands of Barracuda management portals reachable from the public internet.

Affected products and patches

Barracuda lists the following patches. Beazley Security Labs lists the affected version ranges.

• Email Security Gateway (ESG): versions before 9.4.0.030 are affected by both flaws. Patch BNSF-40425 applies to 9.4.017 and later; BNSF-40430 applies to earlier versions. Upgrading to 9.4.0.030 or later addresses both CVEs.
• Load Balancer ADC: versions before 6.4.0, patch BNADC-16586.
• Web Application Firewall (WAF): versions before 11.0.1, patch BNADC-16586.
• Web Security Gateway (WSG): versions before 16.1.100.100, patch BNYF-24789.
• Message Archiver (BMA): versions before 5.5.4.0, patch BNMA-32468.
• WAF Control Center (WCC): versions before 2.2.1, patch BNWF-60060.

Barracuda says patches that were not applied automatically should be installed manually as soon as possible, and that devices several versions behind may need more than one update to reach a fixed release.

Is it being exploited?

Barracuda’s advisory does not state that the flaws are being exploited, and Beazley Security Labs and SecurityOnline reported no active attacks and no public proof-of-concept code at the time of writing. That is good news, but it is not a reason to wait. Beazley points out that ESG appliances have historically been attacked soon after flaws become known, citing the 2023 campaign in which a group tracked as UNC4841 exploited earlier ESG zero-days. Email gateways see every message entering a company, which makes them valuable targets for spies and fraudsters alike.

Why this matters for African businesses

Email remains the main channel for invoices, payment instructions and supplier communication for many Nigerian and African companies. An attacker in control of the email gateway could, in principle, read, alter or redirect sensitive messages, which is exactly what business email compromise and invoice fraud depend on. Organisations that rely on a managed service provider for their Barracuda appliances should confirm that the provider has applied these patches, rather than assuming it has been done.

What you should do

1. List your Barracuda appliances. Include ESG, WAF, Load Balancer ADC, Message Archiver, Web Security Gateway and WAF Control Center, whether physical or virtual.
2. Check firmware versions. Each device shows its current version and the latest version available. Compare it with the affected ranges above.
3. Apply the patches. Install the patch listed for each product, manually if it was not applied automatically. Follow the product-specific steps on Barracuda Campus.
4. Turn on automatic patching. Barracuda recommends enabling it if it is switched off.
5. Lock down the admin interface. Restrict web administration to trusted internal networks or a VPN, and block access from the public internet with firewall rules.
6. Review recent changes. Look for unexpected configuration restores, new admin accounts or changed timezone settings, and contact Barracuda support if anything looks wrong.
7. Ask your provider. If a partner manages your appliances, ask for written confirmation that the November 2026 fixes are installed.

Sources

• Barracuda Trust Center: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities
• Beazley Security Labs advisory BSL-A1240
• SecurityOnline: Barracuda patches critical authorization bypass and command injection flaws

Featured image: Photo: “Mediq Utrecht Data center Gwan Kho” by Gwan Kho, CC BY-SA 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications