Threat Analysis: Barracuda ESG Under Active Exploitation, Chrome's Eighth Zero-Day, and Turla's Email Interception Campaign
This is your Daily Threat Analysis for the 10th of November 2026.
Three separate stories broke this morning, and all three are actionable right now. I’m going to cover them in order of immediate operational risk to UK SMBs, which puts Barracuda at the top, Chrome second, and Turla’s Exchange campaign third, not because Turla is less serious, but because its current targeting is government-focused and the SMB exposure is indirect rather than direct.
Barracuda Email Security Gateway: Active Exploitation, Root Access
Barracuda Networks confirmed this morning that attackers are actively exploiting two recently patched vulnerabilities in its Email Security Gateway (ESG) appliances. The flaws allow command execution with root privileges, meaning an attacker who gets in does not have a constrained foothold; they have the whole device.
What the advisory says is that the vulnerabilities have been patched and customers should update. What it does not say is how long attackers have had these flaws in hand before the patch was issued, how many appliances are exposed on the public internet right now, or what attackers are doing once they have root on an email gateway.
That last point is worth dwelling on. Email security gateways sit at one of the most sensitive positions in any network. They see every inbound and outbound message. They have credentials to internal mail infrastructure. In smaller organisations they frequently have high-trust relationships with Exchange or Microsoft 365 tenants. Root access to that device is not an edge-case compromise, it is a position from which an attacker can read mail, intercept credentials, and pivot inward with minimal noise.
Barracuda has been here before. In 2023, a zero-day in the same product family, CVE-2023-2868, resulted in Barracuda advising customers to physically replace affected appliances rather than patch them, because the company could not guarantee clean remediation on a device that had been owned. That advisory applied to appliances dating back to 2007. The fact that ESG is being targeted again, with active exploitation confirmed the same day as the patch announcement, suggests this product line continues to draw sustained attacker attention.
What to do if you run Barracuda ESG:
- Apply the available patches immediately. Do not wait for a scheduled maintenance window.
- Pull your ESG logs and look for unexpected outbound connections, particularly to unfamiliar IP addresses or unusual DNS lookups.
- If your appliance was internet-exposed before patching, treat it as potentially compromised and review your incident response posture accordingly. At minimum, check whether any mail forwarding rules have been added without authorisation.
- If you use an MSP and are not sure whether your Barracuda ESG is managed or self-maintained, today is the day to ask that question directly.
Chrome Zero-Day Number Eight: Use-After-Free in the Wild
Google has released emergency security updates to patch a new Chrome vulnerability being actively exploited. This is the eighth Chrome zero-day exploited in attacks since the start of 2026.
Eight. In ten months.
The vulnerability is a use-after-free flaw, a class of memory corruption bug where code attempts to access memory that has already been freed. In a browser context these flaws are particularly dangerous because they can be triggered by malicious web content, meaning a user does not need to download or install anything. Visiting a compromised or attacker-controlled page is sufficient.
Google’s disclosure, as is standard, confirms exploitation is occurring but does not detail the target profile or the threat actor responsible. That information will come later, if at all. By the time attribution is public, the patch should already be deployed everywhere, but that assumes patch deployment is reliable.
In larger organisations with central endpoint management, Chrome updates are typically pushed automatically and the gap between patch availability and patch deployment is measured in hours or days. In an SMB where staff are running Chrome on personally managed or lightly managed devices, the gap can be weeks or months. The same applies to hybrid working environments where corporate policy reaches office machines but not home devices used to access company systems.
The advisory says: update Chrome. What it does not say is that in the absence of central patch management, telling staff to update Chrome is roughly as effective as telling them to eat more vegetables. It sounds sensible, but the compliance rate is not what you would hope.
What to do:
- If you have central endpoint management, verify Chrome has been updated to the latest stable version across your fleet today.
- If you do not have central endpoint management, send a direct instruction to all staff to open Chrome, navigate to
chrome://settings/help, and confirm the browser is on the latest version and has been restarted. - Consider whether this is the moment to have a conversation about browser patch management as a formal control rather than a user responsibility. Eight zero-days in one year makes a reasonable business case.
Turla’s Cereal Malware: Intercepting Government Exchange Email
Russia’s Turla threat group, one of the most technically capable and patient state-sponsored actors tracked by the security research community, has a new toolset. It is called Cereal, and it is designed specifically to intercept email on Microsoft Exchange servers at government organisations.
Turla has been operating in various forms since at least the late 1990s. They do not rush. They do not make noise. When a new tool surfaces with Turla attribution, it is typically because it has been in use for some time before discovery, which is worth keeping in mind when interpreting the coverage today.
The advisory attributes this to Turla and notes government Exchange server targeting. What it does not say is how long Cereal has been deployed, how many organisations are affected, or whether the targeting has remained strictly governmental or has extended into the private sector supply chain.
That supply chain point is the relevant one for UK SMBs. If you provide professional services to government departments, legal, accountancy, consultancy, IT support, facilities management, your Exchange infrastructure may be of interest not because you are the primary target, but because you are a trusted communications channel with the people who are. Turla has historically used supply chain positioning to gather intelligence rather than to cause disruption, but intelligence gathered about contract negotiations, procurement decisions, or policy discussions has real commercial and legal implications for the organisations involved.
The specific mechanism, intercepting Exchange server email, also has implications for organisations that run on-premise Exchange rather than Exchange Online. On-premise Exchange has had a difficult few years from a security standpoint. If you are still running on-premise Exchange, the question of whether that investment is justified against the security overhead is one worth revisiting with your IT provider.
What to do:
- If you run on-premise Exchange and work with public sector clients, review your Exchange patch status and ensure you are running a supported, current version.
- Look for any unusual transport rules, forwarding rules, or mailbox delegates that you do not recognise.
- If your Exchange environment has had unusual authentication activity, accounts logging in from unfamiliar locations or at unusual times, that warrants investigation rather than dismissal.
- If you have been considering a move to Exchange Online or Microsoft 365, the security management overhead of on-premise Exchange is a legitimate factor in that decision.
Also Worth Noting: SAP Maximum-Severity Patches
SAP patched 35 vulnerabilities in its November 2026 security updates, including four rated at maximum severity affecting NetWeaver, Web Dispatcher, and Gateway. The flaws are named ICM2SHELL and PROXYGATE in coverage.
SAP is not an SMB staple, but it is common enough in mid-market professional services, manufacturing, and distribution businesses that it warrants a mention. If your business runs SAP in any capacity, including through a managed service provider, confirm that November’s patches are in the queue. Maximum-severity SAP vulnerabilities have historically attracted attention from both criminal and state-sponsored actors fairly quickly.
The Pattern Worth Noting
Look at today’s three main items together. Barracuda ESG: an appliance sitting on the network perimeter handling email. Chrome: the browser on every desk. Turla targeting Exchange: the email server at the centre of business communication. Email infrastructure, browsers, and mail servers, the same attack surface organisations have been told to protect for fifteen years, remains the most productive territory for attackers in 2026.
The NCSC published guidance on securing email infrastructure some years ago. The fact that we are still seeing active, successful exploitation of email gateways and mail servers tells you everything about how seriously that guidance has been implemented in practice.
Patching is not glamorous. It is also not optional.
If the Threat Analysis briefing is useful to you, follow the show wherever you listen so tomorrow’s briefing lands automatically, and if someone in your network needs the heads-up on today’s stories, pass it along. The Barracuda item in particular is live and active; the sooner it reaches the right person, the better.
Sources
| Source | Title | URL |
|---|---|---|
| BleepingComputer | Hackers now exploit critical Barracuda ESG flaws to gain root access | https://www.bleepingcomputer.com/news/security/hackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access/ |
| BleepingComputer | Google patches eighth Chrome zero-day exploited in attacks this year | https://www.bleepingcomputer.com/news/security/google-patches-eighth-chrome-zero-day-exploited-in-attacks-this-year/ |
| The Register | Chrome zero-day whack-a-mole continues as 2026 tally hits 8 | https://www.theregister.com/security/2026/11/10/chrome-zero-day-whack-a-mole-continues-as-2026-tally-hits-8/5308732 |
| BleepingComputer | Turla hackers use new Cereal malware to spy on govt Exchange servers | https://www.bleepingcomputer.com/news/security/turla-hackers-use-new-ceral-malware-to-spy-on-govt-exchange-servers/ |
| BleepingComputer | SAP patches ICM2SHELL and PROXYGATE maximum severity flaws | https://www.bleepingcomputer.com/news/security/sap-patches-four-maximum-severity-security-vulnerabilities/ |