Email Gateways Under Active Attack, Chrome Zero-Day Number Eight

Active exploitation is confirmed against Barracuda Email Security Gateway appliances, with attackers gaining root-level access to devices that sit at one of the most sensitive positions in any network. Google has patched the eighth Chrome zero-day of 2026, a use-after-free vulnerability exploited in the wild. Russia’s Turla group is intercepting government Exchange email using new malware called Cereal, with implications for any UK small business in the public sector supply chain. Plus a note on SAP’s maximum-severity November patches. This briefing focuses on immediate operational steps: patching Barracuda ESG today, verifying Chrome updates across your entire fleet, reviewing Exchange forwarding rules, and closing the gap between security guidance and actual implementation. The common thread across all three stories is email infrastructure, the same attack surface organisations have been told to protect for fifteen years, and the persistent gap between published guidance and consistent application of basic security disciplines.

Chapters

• Intro Opening summary of three active threat stories, all with immediate operational relevance to UK small businesses. Focus on Barracuda Email Security Gateway under active exploitation.
• Barracuda Email Security Gateway: Active Exploitation, Root Access Barracuda Networks confirms active exploitation of two vulnerabilities allowing root access to Email Security Gateway appliances. History of ESG targeting, operational implications of email gateway compromise, and immediate patching and log review requirements.
• CTA Call to action: follow the show and share the briefing, particularly the Barracuda item which is actively exploited.
• Chrome Zero-Day Number Eight Google patches eighth Chrome zero-day of 2026, a use-after-free vulnerability exploited in the wild. Discussion of the patch management gap in small business environments and practical steps to verify Chrome updates across managed and unmanaged devices.
• Turla’s Cereal Malware: Intercepting Government Exchange Email Russia’s Turla group deploys Cereal malware to intercept Microsoft Exchange email at government organisations. Supply chain implications for UK businesses working with public sector clients, and the case for reviewing on-premise Exchange security posture.
• SAP Maximum-Severity Patches SAP’s November 2026 security updates include four maximum-severity vulnerabilities in NetWeaver, Web Dispatcher, and Gateway. Relevant for mid-market professional services, manufacturing, and distribution sectors.
• The Pattern Analysis of the common thread across today’s stories: email infrastructure, browsers, and mail servers remain the same attack surface organisations have been told to protect for fifteen years. The gap between published guidance and consistent implementation of basic security disciplines.
• Outro Summary of practical takeaways: patch Barracuda ESG, verify Chrome updates, review Exchange configuration. Closing remarks.