This edition opens with a hijacked update channel: thousands of hosting servers received a backdoor via cPGuard. In addition, Node-RED installations are being actively taken over, Barracuda is warning of two chainable flaws in its gateways, and CISA has confirmed that the WordPress update flaw from Saturday’s edition is being actively exploited.
- cPGuard update channel hijacked: backdoor and data theft on thousands of hosting servers
- Node-RED: attackers exploit critical flaw to deploy Linux bot and web shells
- Barracuda warns of two chainable flaws that give root on email and web gateways
- WordPress update flaw: CISA confirms exploitation and adds it to the KEV catalogue
cPGuard update channel hijacked: backdoor and data theft on thousands of hosting servers
| Vulnerability | Hijacked update channel of cPGuard (OpsShield), a security suite for Linux hosting servers. Versions 5.88.12 to 5.88.19 contain a malicious script that installs a backdoor and steals data. The cause was stolen login credentials for the update CDN; no software bug is involved |
| CVE number | No CVE assigned |
| Actively exploited | Yes, the malicious updates went out on 2 November 2026 from 02:06 UTC; OpsShield reported the incident on 3 November |
| Patch available | Yes, version 5.88.25 or later removes the backdoor and the script. Passwords, database credentials, cloud secrets and SSH keys must then be replaced |
How has this been exploited?
According to Security.nl, an attacker using compromised login credentials gained access to OpsShield’s update CDN. Servers that updated during the attack window received a script that planted a backdoor and collected Linux password hashes, the configuration of the MariaDB and MySQL root user, root’s shell history and root’s SSH files. The stolen data was sent to OpsShield’s licence server. BleepingComputer also reported on the incident. OpsShield says it stopped the distribution within 12 hours.
What could the impact be?
According to BleepingComputer, an OpsShield spokesperson put the number of affected servers at 2,946, with 32 files per customer, and the billing database was also copied. OpsShield cannot confirm that every server ran the script, as update checks take place at intervals. If you run cPGuard on shared hosting or cPanel servers, root secrets may have been stolen. For MSPs managing hosting environments for clients, that is reason enough to check immediately what may have been exposed.
What should IT administrators do now?
Update every cPGuard server to version 5.88.25 or later. Assume data has been stolen if a version between 5.88.12 and 5.88.19 was installed on 2 or 3 November: replace root and user passwords, database and cloud secrets, and SSH keys. OpsShield is working on a separate update that removes previously installed support access keys. More on the response can also be found at The Hacker News.
Node-RED: attackers exploit critical flaw to deploy Linux bot and web shells
| Vulnerability | Missing authentication in Node-RED’s HTTP interface, allowing a remote attacker to create flows and execute code without logging in. In August, Siemens warned about Industrial OS devices running Node-RED prior to V4.3.4.1, including the SIMATIC IoT2050 Advanced |
| CVE number | CVE-2026-58115 |
| CVSS score | 10.0 (Siemens score) |
| Actively exploited | Yes, VulnCheck observed the first complete exploit on 30 October 2026. It is listed in VulnCheck’s KEV catalogue; CISA had not yet added it when the report was published |
| Patch available | Yes for Siemens Industrial OS: V4.3.4.1 or later. For other Node-RED installations: protect them with authentication (adminAuth) and do not expose them directly to the internet |
How has this been exploited?
According to Help Net Security, a VulnCheck canary captured a complete exploit in a single POST request on 30 October. It deployed a self-running flow that used inject and exec nodes to download a binary named bot-linux-amd64, hidden in a memory-backed location. Subsequent requests delivered a shell script, a file masquerading as a kernel worker thread, and web shells. The source address, in a Microsoft range that points to Brazil, made 16 attempts between 30 October and 1 November. VulnCheck describes it as opportunistic mass scanning. Security.nl also reported the attacks.
What could the impact be?
The bot disappears after a reboot unless it makes itself persistent, but the web shells remain in place. An attacker has the highest privileges on the server. Node-RED is widely used on IoT gateways, in building management and in industrial environments, so for MSPs with such clients, a forgotten instance could serve as a gateway into the client’s network.
What should IT administrators do now?
Check whether Node-RED is reachable from outside the network, including in OT environments. VulnCheck warns that instances without adminAuth are automatically discovered and exploited. Install available updates, search for the indicators listed in VulnCheck’s report and check for unknown flows and web shells.
Barracuda warns of two chainable flaws that give root on email and web gateways
| Vulnerability | Two vulnerabilities in Barracuda appliances: an authorisation bypass in the Email Security Gateway (ESG) and a command injection in ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Combined, they give root access |
| CVE number | CVE-2026-116606 (authorisation bypass, ESG only) and CVE-2026-111560 (command injection) |
| CVSS score | 9.3 for CVE-2026-116606 and 8.6 for CVE-2026-111560 |
| Actively exploited | No, Barracuda and The Hacker News report no exploitation in the wild |
| Patch available | Yes. For ESG: BNSF-40425 (firmware 9.4.017 and later) and BNSF-40430 (older than 9.4.017); also BNADC-16586 (Load Balancer ADC and WAF), BNMA-32468 (Message Archiver), BNWF-60060 (WAF Control Center) and BNYF-24789 (Web Security Gateway) |
How could the vulnerability be exploited?
According to Barracuda’s advisory, the two flaws only lead to root access when combined: the authorisation checks are bypassed, followed by command execution. An attacker needs access to the device’s management interface to do this. The advisory does not name who discovered the flaws. Barracuda describes it as a pre-authentication flaw, while the same page also mentions administrator privileges, so check with Barracuda exactly how this works. The Hacker News and BleepingComputer reported on the warning earlier, on 3 November.
What could the impact be?
An attacker with root on an email gateway or web application firewall can see the traffic of all customers behind it and can use the device as a springboard. Barracuda equipment sits at the network edge at many Dutch MSPs and SMEs.
What should IT administrators do now?
Make sure management interfaces are never reachable from the internet and restrict them to trusted internal networks. Install the patch for your product. If the firmware is several versions behind, Barracuda says multiple updates may be required.
WordPress update flaw: CISA confirms exploitation and adds it to the KEV catalogue
| Vulnerability | TOCTOU race condition in the WordPress Core update process. During a full core update, files briefly sit in a predictable directory under wp-content/upgrade, where an attacker can get code executed. Affected versions include 7.1.0 to 7.1.3 and 7.0.0 to 7.0.7 |
| CVE number | CVE-2026-119977 |
| CVSS score | 8.1 (Wordfence as CNA) |
| Actively exploited | Yes, CISA added the vulnerability to the KEV catalogue on 3 November 2026 |
| Patch available | Yes, 7.1.4 for the 7.1 branch and 7.0.8 for the 7.0 branch; older branches also have a fix, such as 6.9.11 and 6.8.12 |
What’s new?
This flaw was already covered in the Patchwork edition of Saturday 31 October, at that point without a CVE number and with attempts shortly after the patch. What is new is that CISA has now added it as an actively exploited vulnerability to its catalogue of known exploited vulnerabilities.
How could the vulnerability be exploited?
During a full update, WordPress unpacks the new files into a predictable directory under wp-content/upgrade, which is web-accessible on many servers. If an attacker requests the installation file in that staging copy at the right moment, they can use it to execute PHP code. That window usually lasts only seconds, so attackers poll repeatedly. According to the analysis by Rescana, Wordfence observed more than 18,500 requests to installer paths in the staging directory within the first 21 hours. The fix in 7.1.4 randomises the directory name and adds index protection.
What should IT administrators do now?
Check that the update to 7.1.4, 7.0.8 or the fixed version for your own branch has actually been applied, particularly on sites with automatic updates disabled and on managed client sites. In addition, block web access to wp-content/upgrade/ in the server configuration and search logs for requests to PHP files in that directory, unknown administrator accounts and new plugins. According to Wordfence, a PHP firewall alone is not sufficient, because the request bypasses WordPress.
This article was originally published in Dutch on MSP Business. Read the original →
