Active exploitation is confirmed against Barracuda Email Security Gateway appliances, with attackers gaining root-level access to devices that sit at one of the most sensitive positions in any network. Google has patched the eighth Chrome zero-day of 2026, a use-after-free vulnerability exploited in the wild. Russia’s Turla group is intercepting government Exchange email using new malware called Cereal, with implications for any UK small business in the public sector supply chain. Plus a note on SAP’s maximum-severity November patches. This briefing focuses on immediate operational steps: patching Barracuda ESG today, verifying Chrome updates across your entire fleet, reviewing Exchange forwarding rules, and closing the gap between security guidance and actual implementation. The common thread across all three stories is email infrastructure, the same attack surface organisations have been told to protect for fifteen years, and the persistent gap between published guidance and consistent application of basic security disciplines.
