Mail that passes through a Barracuda Email Security Gateway needs patching today. The Hacker News reports that two flaws in the email-filtering appliance can be chained to run commands on it as root, its highest level of access. No login required. The company released patches on Monday, so treat any unpatched window as a reason to reset credentials for the accounts that pass through it. In the same stretch, RS Web Solutions covered a WordPress core flaw landing on CISA's critical vulnerabilities list, and BigGo Finance reported that Japan's Bic Camera Group says data on about 14.9 million customer email addresses may have leaked after unauthorized access at its contractor Arara. The appliance in front of your mail, the platform your site runs on, and the contractor holding your customer list are all paths into your accounts, and nobody on your team wrote any of them, which is probably why they go unowned. We do security reviews of account and payment flows, including what appliances and third parties can reach. Send us a list of what sits in front of your mail and your logins, and we'll come back with cost and timeline within a day.
Was this useful?