CISA lists Barracuda OS command injection in KEV (CVE-2026-111560)
An authenticated administrator can run root commands through a crafted timezone value; the federal due date is November 13.
1
Stories per day · 30 days
4 RSS
Relatedcisco4proofpoint4secure-email-gateway4barracuda3phishing3acquisition2asyncos2business-email-compromise2command-injection2cve-2026-765192data-security2m&a2varonis2account-takeover1active-exploitation1actively-exploited1ai-security1amp1
50 stories, newest first · one card per story
Stories tagged #email-security
The race to secure record-like information for domains
Signed MX adoption is 12.3% in the Tranco top 1,000 and 1.4% of .COM, so apps cannot assume DNSSEC.
Commentary: signature email security misses fraud from trusted accounts
The essay cites Verizon’s 2026 report, with third parties in 48% of breaches, and FBI BEC losses above $3 billion.
Barracuda products have pre-auth bypass and command injection flaws
Six Barracuda gateways and management products below stated builds are affected; the Cyber Centre says updates are available.
Anthropic-themed phishing emails bypass secure email gateways
Since September, an unnamed actor has used fake Anthropic previews to steal Google and Microsoft credentials.
Proofpoint Joins Microsoft ICES Ecosystem
Proofpoint integrates its Core Email Protection API into Microsoft Defender for Office 365, allowing unified visibility of detections for Microsoft 365 customers.
1
Unicode Consortium publishes UTS #39 version 18.0.0
Version 18.0.0, dated August 27, specifies identifier security profiles and confusable and mixed-script detection.
Kaseya promotes INKY to detect stealthy email account takeover
The sponsored piece says attackers linger in inboxes, then phish customers and suppliers from trusted accounts that ordinary filters accept.
1
Proofpoint says generative AI is weakening email behavior detection
One actor emailed more than 30 agents with unique property pitches that all ended in the same meeting request.
1
Proofpoint lines up $6.3 billion deal for Varonis’ data security
Proofpoint agreed to buy data-security firm Varonis for $6.3 billion in cash.
Proofpoint to buy Varonis for $6.3 billion
Proofpoint agreed to acquire data-security company Varonis for approximately $6.3 billion in cash.
2
Cisco warns of actively exploited Secure Email Gateway flaw
Cisco says attackers are exploiting CVE-2026-76519 in Secure Email Gateway to run root commands via crafted attachments.
4
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
Cisco says attackers are exploiting critical Secure Email Gateway flaw CVE-2026-76519 to write files and gain root.
3
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
Cisco Secure Email Gateway flaw lets unauthenticated attackers write files and run root commands via crafted attachments.
CISA lists Cisco email gateway file-write flaw in KEV (CVE-2026-76519)
With file reputation enabled, a crafted email attachment can write files and run root commands; federal action is due October 17.
1
Fighting GenAI with GenAI: The New Email Security Landscape
A Kaseya-sponsored piece says generative AI is making phishing emails harder for traditional filters to catch.
3
Microsoft Outlook to block MSIX attachments starting November
Microsoft will block .msix and .msixbundle attachments in Outlook on the web and new Outlook starting November.
Hoxhunt expands Respond to automate phishing investigations and email removal
Hoxhunt expanded Respond to automatically investigate reported phishing and remove confirmed malicious email within a minute.
Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes
Microsoft patched CVE-2026-96940, an Exchange flaw that lets authenticated attackers read other users' mailboxes.
Fortinet security advisory (AV26-989)
Canada's Cyber Centre warns FortiMail path-traversal CVE-2026-104286 is exploited in the wild and listed in CISA KEV.
Fortinet sounds the alarm over actively exploited FortiMail zero-day
Fortinet says attackers are exploiting critical FortiMail zero-day CVE-2026-104286 to write files without authentication.
Critical FortiMail zero-day exploited in the wild (CVE-2026-104286)
Attackers are exploiting critical FortiMail zero-day CVE-2026-104286 before patches are available.
Fortinet FortiMail Path Traversal Flaw Actively Exploited to Compromise Servers
Attackers are exploiting critical FortiMail path-traversal CVE-2026-104286 to write files and compromise email appliances.
Critical Fortinet FortiMail 0-Day Vulnerability Actively Exploited in Attacks
Attackers are exploiting critical FortiMail zero-day CVE-2026-104286 to write files without authentication.