Episode 20: Security tool update hijacked to backdoor Linux servers, Barracuda root flaws and LLMjacking bills reach US$1 million, 4 November 2026

An attacker hijacked the update channel of the cPGuard Linux security tool to backdoor hosting servers and steal password hashes, and attackers are exploiting a maximum-severity flaw in Siemens SIMATIC IoT2050 gateways. Barracuda disclosed a chainable path to root on its email and web appliances, Google and Mandiant say LLMjacking has cost some organisations US$1 million in AI charges, and Binance explained how its theft unfolded over five months.

Australian focus

• First State Auctions confirms a customer data incident. Mostly basic contact details accessed; no evidence card details or passwords affected; ACSC and OAIC informed. Cyber Daily
• Amadeus breach: airlines quantify exposure (update). Cathay Pacific about 53,000 bookings, JAL about 92,000 passengers; Qantas still assessing. Cyber Daily

Global threats

• cPGuard update channel hijacked. Versions 5.88.12 to 5.88.19 carried a backdoor and data-collecting script; update to 5.88.25 and rotate root, database and SSH credentials. The Hacker News
• Siemens SIMATIC IoT2050 Advanced flaw exploited (CVE-2026-58115). Unauthenticated Node-RED code execution; fixed in 4.3.4.1. The Hacker News
• Barracuda flaws chain to root (CVE-2026-116606, CVE-2026-111560). ESG, Load Balancer ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway; restrict admin interfaces. BleepingComputer; The Hacker News
• Linux IPv4 TCP race (CVE-2026-98432): Red Hat fixes ship (update). RHEL 8, 9 and 10 kernels out; Ubuntu fixes still in -proposed. The Hacker News
• Binance details a months-long campaign (update). Trojanised Homebrew installer, fake job interview, abused internal AI tool. The Record; The Hacker News
• Refrigeration attacks reach UK suppliers (update). Copeland XWEB 1.12.1 and earlier; firmware fix available since August. The Record
• Gorbag targets Ukrainian justice, local government and defence. Russia-aligned, per ESET. The Hacker News
• mSecure warns of suspicious activity. Customers advised to consider changing passwords and resetting 2FA and passkeys; scope unknown. The Hacker News

AI security

• LLMjacking charges reach US$1 million. Stolen cloud tokens and exposed API keys used to run up AI model bills. BleepingComputer; The Hacker News
• 3AM ransomware on a UK school estate, suspected AI-assisted. Bitdefender's inference from command timing. BleepingComputer
• DIVD names ARTEX behind its September breach (update). Two zero-days chained to root in 12 minutes. BleepingComputer

Industry

• UK NCSC warns of an "unprecedented rise" in incidents. The Record
• Google Cloud VRP adds a US$250,000 root-in-cloud reward. BleepingComputer

Outlook and patch priorities

• Critical: cPGuard 5.88.25 plus credential rotation; Siemens IoT2050 Advanced 4.3.4.1 or remove Node-RED.
• High: Barracuda patches and admin interface restriction; RHEL kernels for CVE-2026-98432; Copeland XWEB firmware; spend alerts and key scoping for AI projects.
• Indicators: Siemens IoT2050 campaign (VulnCheck, via The Hacker News): 85.215.73[.]250; 45.194.90[.]57:38472; files /dev/shm/.b and /tmp/.kworker.

Show notes page | Follow on X (@u51cyber)