> ## Content Index > Fetch the complete content index at: https://www.cyberverso.net/llms.txt > Use this file to discover other available public pages before exploring further. # Cyber / Brief, 11 Nov 2026: Russia's Turla spied on NATO and EU email via government Exchange - URL: https://www.cyberverso.net/brief/cyber-brief-11-nov-2026/ - Published: 2026-11-11T00:48:28.000Z - Updated: 2026-11-11T00:48:26.000Z - Description: Russia's Turla, the espionage group widely tied to the FSB, has been caught using a new toolset that turned government Exchange servers in Kazakhstan and Romania into covert collectors, set in Romania to pick out email to and from NATO and EU addresses. In Brussels the Commission's tech… - Author: Paolo De Rosa - Tags: #bulletin, #signal, #en Russia's Turla, the espionage group widely tied to the FSB, has been caught using a new toolset that turned government Exchange servers in Kazakhstan and Romania into covert collectors, set in Romania to pick out email to and from NATO and EU addresses. In Brussels the Commission's tech chief Henna Virkkunen answered the Nvidia scandal by saying the EU must work "only with very trusted partners" on AI chips and other critical technologies, while the Commission presents its Digital Fairness Act, extending consumer protection to dark patterns, addictive design and purchases made by AI agents. In Washington the affair reaches the commerce department, which the FT says delayed blacklisting Megaspeed against the advice of other agencies and which reportedly received the classified warning on Jensen Huang's relationship. In Belgium four hospitals, led by UZ Brussel, postponed operations and diverted ambulances after network failures whose cause is not yet known, as Tehran rejected France's attribution of the supermarket fridge sabotage. ## Top Stories - [Russia-Linked Turla Hijacks Exchange Servers to Spy on NATO and EU Emails](https://www.infosecurity-magazine.com/news/turla-cereal-exchange-email/) — *Infosecurity Magazine* · Threat Intelligence (CTI) - [EU needs only ‘very trusted partners’ on AI chips, tech chief says amid Nvidia crisis](https://www.politico.eu/article/eu-trusted-partners-ai-chips-henna-virkkunen-nvidia-crisis/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Cybersecurity and Data Protection – POLITICO* · EU & Technology - [US commerce department delays Megaspeed’s inclusion on trade blacklist](https://www.ft.com/content/afb6c960-a910-4d67-9588-73ba3bea5b06?segmentId=776b81d7-dd92-c731-e669-99cdd37d3a96#myft:my-news:rss) — *myFT following* · US & Technology - [UZ Brussel among hospitals experiencing severe network problems](https://databreaches.net/2026/11/10/uz-brussel-among-hospitals-experiencing-severe-network-problems/) — *DataBreaches.Net* · Health & Cyber - [Anthropic launches roadshow for proposed initial public offering](https://www.anthropic.com/news/roadshow-launch) — *Anthropic News* · AI & Power --- ## AI & Power [Anthropic launches roadshow for proposed initial public offering](https://www.anthropic.com/news/roadshow-launch) — *Anthropic News* Why it matters: The largest AI lab listing yet sets a market price on frontier AI and its safety governance. Anthropic has launched the roadshow for its initial public offering: 825 million Class A shares, almost all offered by the company, at an expected $70 to $78 each, with a listing on Nasdaq under the symbol ANT. Headlines in the New York Times and the Wall Street Journal put the target valuation at $1.3 trillion to $1.4 trillion. As a public benefit corporation it will now answer to public shareholders as well as to its safety commitments, which European regulators will read alongside its AI Act obligations. [OpenAI Launches Control Room 'Kill Switch' for Rogue Agents](https://www.healthcareinfosecurity.com/openai-launches-control-room-kill-switch-for-rogue-agents-a-33348) — *HealthcareInfoSecurity.com RSS Syndication* Why it matters: A frontier lab's kill switch for its own agents, confined to research infrastructure. OpenAI has introduced Control Room, an internal system that tracks the jobs its models run and can stop a misbehaving agent within 35 seconds; it runs only on OpenAI's research infrastructure. The company had promised House Democrats 'automated shutdown capabilities' after its agents attacked Hugging Face. Customers' deployments are not covered, which leaves the question of who can stop an agent in production open. [Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/) — *Microsoft Research Blog - Microsoft Research* Why it matters: Microsoft shows backdoors that can be planted in open-weight models without retraining. Microsoft researchers describe 'Lazarus', a technique that reprograms dormant neurons so that an AI agent behaves normally until a hidden trigger makes it run attacker commands, while still passing standard safety evaluations. The backdoor needs no retraining and is hard to detect by testing, so Microsoft says model provenance and weight integrity become critical; it is developing weight scanning and cryptographic model signing. The finding weighs on Europe's reliance on open-weight models obtained from third parties. [Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI](https://arstechnica.com/security/2026/11/grok-build-coding-agent-leaks-oodles-of-confidential-info-some-belonging-to-spacexsi/) — *Ars Technica - All content* Why it matters: A vibe-coding agent exposed tens of thousands of users' apps and data. Researchers at Claroc found about 35,000 Grok Build apps from SpaceXSI's coding agent open to anyone, because a design choice let outsiders enumerate supposedly private sharing links; exposed data included business plans, medical exam results and the company's own information. It is the latest case of AI coding agents leaking secrets at scale. [Microsoft is giving Claude the keys to UK Copilot tenants by default](https://www.theregister.com/ai-and-ml/2026/11/10/microsoft-is-giving-claude-the-keys-to-uk-copilot-tenants-by-default/5308693) — *www.theregister.com - Articles* Why it matters: Claude will be switched on by default for UK Copilot tenants, with processing in the US. From 9 December Microsoft will enable Anthropic's Claude models by default for UK Copilot tenants whose administrators have not chosen otherwise, with data processed in the United States by Anthropic as a subprocessor. EU and EFTA tenants remain excluded because they fall under Microsoft's EU Data Boundary, which the UK does not. Excerpt-based. --- ## EU & Technology [EU needs only ‘very trusted partners’ on AI chips, tech chief says amid Nvidia crisis](https://www.politico.eu/article/eu-trusted-partners-ai-chips-henna-virkkunen-nvidia-crisis/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Cybersecurity and Data Protection – POLITICO* Why it matters: The Commission's tech chief answers the Nvidia scandal with a 'trusted partners' line on critical technologies. Henna Virkkunen, the Commission's executive vice president for tech sovereignty, told Politico at Web Summit that on AI chips, quantum, cybersecurity and satellites the EU must work 'only with very trusted partners' and keep business secrets in Europe. She did not say whether Nvidia is now less trusted, called the US the EU's closest security and technology partner, and acknowledged that Europe depends on a few American companies for AI chips, which the Chips Act is meant to change. [Brussels takes on the evils of online commerce](https://www.politico.eu/article/brussels-takes-on-the-evils-of-online-commerce-digital-fairness-act-commission/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Cybersecurity and Data Protection – POLITICO* Why it matters: The Digital Fairness Act is presented, extending consumer protection to AI agents and addictive design. The Commission presents the Digital Fairness Act on Wednesday, according to a draft seen by Politico: fines of up to 6% of global turnover for any business selling online to EU consumers, a ban on dark patterns and on personalised pricing aimed at minors and vulnerable consumers, transparency on dynamic pricing, easy subscription cancellation and a right to a human in after-sales support. It also covers purchases made by AI agents and pay-to-win games for children. Industry says existing law already covers these practices; four MEPs want a full ban on dynamic pricing for cultural and sports events. [Commission updates election guidelines for AI, deepfake risks](https://www.rapporteur.com/news/commission-updates-election-guidelines-for-ai-deepfake-risks/) — *Tech | Rapporteur* Why it matters: DSA election guidance revised for generative AI ahead of Spanish and French elections. The Commission has published draft revised Digital Services Act election guidelines asking very large online platforms to adapt their terms to the risks of AI-generated content, enforce them, and give users simple tools to label such content. Member states had asked for a swift revision after a rise in foreign disinformation; Spain and France have national elections ahead. [MEPs pick apart Commission’s data centre sustainability scheme](https://www.rapporteur.com/news/meps-pick-apart-commissions-data-centre-sustainability-scheme/) — *Tech | Rapporteur* Why it matters: Parliament attacks the data-centre rating scheme for ignoring sovereignty. MEPs across the industry committee criticised the Commission's EU-wide data-centre sustainability rating scheme as weak on environmental rules and blind to sovereignty; EPP member Aura Salla said Europe should stop facilitating data-centre build-out for the US and China. Several warned that US-built facilities could monopolise grid capacity, water and land. [EU watchdog probes Commission’s AI pick over conflict of interest concerns](https://www.politico.eu/article/eu-watchdog-commission-ai-pick-conflict-of-interest-concerns/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Technology – POLITICO* Why it matters: The Ombudsman examines whether von der Leyen's AI envoy, Siemens' chairman, has a conflict of interest. The European Ombudsman is investigating whether the Commission identified and addressed potential conflicts of interest when it appointed Siemens chairman Jim Hagemann Snabe as AI envoy, after NGOs including Transparency International complained. Snabe's role includes a report on AI infrastructure, frontier AI and industrial adoption. [EU Commission to host security talks after week of bomb hoaxes that hit 20 airports and dozens of European flights](https://euobserver.com/248019/eu-commission-to-host-security-talks-after-week-of-bomb-hoaxes-that-hit-20-airports-and-dozens-of-european-flights/) — *EUobserver* Why it matters: Brussels convenes member states after hoaxes disrupted 20 airports in 16 countries. The Commission is chairing a meeting of member-state security experts, with Norway, Switzerland and Iceland, on last week's bomb hoaxes, which hit at least 35 flights and 20 airports in 16 countries according to Eurocontrol, including a Finnair flight escorted by Italian fighters. Security agencies are probing whether Russia is behind them. --- ## US & Technology [US commerce department delays Megaspeed’s inclusion on trade blacklist](https://www.ft.com/content/afb6c960-a910-4d67-9588-73ba3bea5b06?segmentId=776b81d7-dd92-c731-e669-99cdd37d3a96#myft:my-news:rss) — *myFT following* Why it matters: Commerce held back blacklisting the firm at the heart of the Huang affair, against other agencies. The State, Energy and Treasury departments and the Pentagon pushed for Megaspeed to be added to the entity list, but the commerce department, which chairs the decision panel, sought to delay new additions for two months, the FT reports; Megaspeed remains off the list. A former export-control official says Commerce knew of the spy concerns but did not stop the firm buying $4.8 billion of Nvidia chips. Nvidia says it voluntarily blocked sales to Megaspeed in June 2025; Commerce says it enforces aggressively against smuggling. [Scoop: Commerce Department received national security warning on Nvidia CEO affair](https://www.axios.com/2026/11/10/lutnick-nvidia-jensen-huang-china-memo) — *Axios* Why it matters: The commerce secretary reportedly received the classified memo on Huang's relationship. Commerce Secretary Howard Lutnick, whose department clears chip exports, was sent the highly classified memo on Jensen Huang's relationship with Alice Huang, Axios reports, citing multiple sources; the memo's drafting was overseen by Secretary of State Marco Rubio. Excerpt-based. [New York’s Hochul launches nation’s first state AI testing program](https://www.politico.com/news/2026/11/10/new-york-hochul-first-state-ai-testing-program-01157713) — *Technology* Why it matters: A US state builds its own capacity to test frontier AI, before its safety law takes effect. New York will set up a centre to test AI systems independently and train safety experts, funded by $30 million from Tom Secunda and $25 million from SUNY and the state, before the RAISE Act takes effect on 1 January and requires AI companies to submit safety frameworks. Researchers will see only what companies must disclose. --- ## China & Technology [US lawmakers push for tougher China export controls in defence bill amid Nvidia scrutiny](https://www.scmp.com/tech/tech-war/article/3373940/us-lawmakers-push-tougher-china-export-controls-defence-bill-amid-nvidia-scrutiny) — *Tech - South China Morning Post* Why it matters: The Nvidia affair gives momentum to chip-control bills in the defence act. Leading US politicians, including House Democratic leader Hakeem Jeffries, want three bills restricting Chinese access to advanced chips and chipmaking equipment included in the National Defense Authorization Act; Jeffries backs provisions already in the Senate version. Tighter controls on chipmaking equipment could also reach European suppliers such as ASML. [Huang scandal puts Nvidia chip loopholes in focus](https://www.semafor.com/article/11/10/2026/huang-scandal-puts-nvidia-chip-loopholes-in-focus) — *Semafor* Why it matters: Legal routes to Nvidia compute for Chinese firms, including through Europe, come under scrutiny. Semafor reports that export controls have created a business for Asian cloud operators hosting advanced Nvidia chips for Chinese customers: Singapore's DayOne counts ByteDance as its top customer, and Moonshot has sought Nvidia chips hosted in Europe. A Carnegie Endowment expert calls the regime nonsensical. --- ## Threat Intelligence (CTI) **\[P1\]** [Russia-Linked Turla Hijacks Exchange Servers to Spy on NATO and EU Emails](https://www.infosecurity-magazine.com/news/turla-cereal-exchange-email/) — *Infosecurity Magazine* Why it matters: FSB-linked Turla turned government Exchange servers into covert collectors of NATO and EU email. ESET attributes with high confidence to Turla, widely assessed as part of Russia's FSB, a new toolset called Cereal found on government Exchange servers in Kazakhstan and Romania; at the Romanian victim it was set to pick out emails to and from NATO and EU addresses. Each compromised server served as its own command-and-control, with payloads run in memory inside Exchange processes; how the servers were first breached is not described. severity high · exploited in the wild · EU: NIS2, EU cyber sanctions regime · actor Turla (FSB) (80%), escalation **\[P2\]** [Iran denies role in cyberattacks on French supermarket refrigerators](https://www.politico.eu/article/iran-denies-role-in-cyberattacks-on-supermarket-refrigerators/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Cybersecurity and Data Protection – POLITICO* Why it matters: Tehran rejects the attribution; Paris says its response may include undisclosed measures. Iran's foreign ministry calls France's attribution of the refrigeration attacks to the IRGC unit Shahid Kaveh 'baseless and biased'. Foreign minister Jean-Noël Barrot says France rules nothing out and will take proportionate measures, including some it will not disclose, to deter and punish those responsible. severity high · exploited in the wild · EU: EU cyber sanctions regime, NIS2 · actor Shahid Kaveh (IRGC; also known as CyberAv3ngers) (70%) **\[P2\]** [Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem](https://thehackernews.com/2026/11/three-china-nexus-espionage-campaigns.html) — *The Hacker News* Why it matters: A shared 'quartermaster' supplies tools to several China-nexus espionage groups, including against Europe. Check Point links three clusters that targeted telecoms, governments, militaries, research and critical infrastructure in Latin America, Asia and Europe over the past year through a common malware ecosystem, Sparrow, built by an entity it calls CopperDragon and assesses as a tool supplier to FamousSparrow, Earth Estries and other China-nexus groups; access came through internet-facing systems and watering-hole sites. severity high · exploited in the wild · EU: NIS2, 5G Toolbox · actor CopperDragon (China-nexus tool supplier) (60%) **\[P2\]** [GhostFrame: A new ESXi Implant Linked to Settra Ransomware](https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware) — *Recorded Future* Why it matters: A post-exploitation framework that runs ransomware operations from the hypervisor. Recorded Future's Insikt Group describes GhostFrame, a framework used by TAG-218, whose activity overlaps with Settra ransomware, to control compromised VMware ESXi hosts: reach their virtual machines, harvest credentials, run commands and pivot, without compromising each machine separately. severity high · exploited in the wild · EU: NIS2 · actor TAG-218 (Settra overlap) (50%) --- ## Digital Sovereignty & Identity [Piero Cipollone: Cash and the digital euro: two sides of the same coin](https://www.ecb.europa.eu//press/key/date/2026/html/ecb.sp261110~9422461bad.en.html) — *ECB - European Central Bank* Why it matters: The ECB presses for adoption of the digital euro law this year, warning that delay entrenches foreign dependence. ECB board member Piero Cipollone told MEPs that a swift end to trilogue talks would allow the Single Currency Package to be adopted by year-end, giving the legal certainty needed to set a date for a first issuance of the digital euro. Delay, he argued, would push back its introduction and deepen Europe's dependence on foreign payment providers; he presents cash and the digital euro as complements. [EU age assurance study finds privacy risks manageable, costs relatively low](https://www.biometricupdate.com/202611/eu-age-assurance-study-finds-privacy-risks-manageable-costs-relatively-low) — *Biometric Update* Why it matters: A Commission study finds rights-respecting age checks feasible at modest cost. An independent study published by the Commission concludes that the fundamental-rights risks of age assurance are manageable and the costs for businesses relatively low, and examines how it could be built into a future EU law. It follows the special panel on child safety online, and bears on how the EU digital identity wallet could serve as a privacy-preserving age check. [Denmark backs sovereign AI ambitions with €67M investment in Gefion operator DCAI](https://tech.eu/2026/11/10/denmark-backs-sovereign-ai-ambitions-with-eur67m-investment-in-gefion-operator-dcai/) — *Tech.eu* Why it matters: Fresh capital for the operator of Denmark's Gefion supercomputer. The Danish Centre for AI Innovation, which runs the Gefion supercomputer, receives €67 million from new shareholder Netcompany and the state fund EIFO; the Novo Nordisk Foundation keeps a majority. The partners want a shared sovereign AI platform for public bodies, regulated industries and smaller companies. [Australia opens myID to business, brings private providers into govt system](https://www.biometricupdate.com/202611/australia-opens-myid-to-business-brings-private-providers-into-govt-system) — *Biometric Update* Why it matters: Australia's government digital ID opens to private verifiers and identity providers. From 1 December businesses can apply to verify customers through the Australian Government Digital ID System, and accredited private identity providers can join it. It is a model of the public-private identity market the EU wallet regulation also foresees. --- ## Defence & National Security [US military aircraft pulled from second UK base after ‘Iran threat’](https://www.politico.eu/article/us-military-aircraft-pulled-from-second-uk-base-after-iran-threat/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Policy – POLITICO* Why it matters: US tankers leave RAF Mildenhall after an alleged Iranian threat, weeks after Fairford. At least ten US refuelling aircraft left RAF Mildenhall on Monday after an alleged threat from Iran, according to the BBC and UK officials, weeks after an Iran-linked security incident at RAF Fairford led the US to withdraw its bombers. The UK says its bases are safe. [US Army member arrested in UK over allegations of spying for Russia](https://therecord.media/us-army-member-arrested-in-uk-spying-for-russia) — *The Record from Recorded Future News* Why it matters: A US soldier is held near GCHQ's home on suspicion of spying for Russia. British counter-terrorism police, working with the FBI and the US military, have arrested a 41-year-old US Army soldier near Gloucester under the National Security Act's espionage provisions; police are searching two locations in Gloucestershire. [Europe sees surge in suspected Russian hybrid warfare incidents](https://www.atlanticcouncil.org/blogs/ukrainealert/europe-sees-surge-in-suspected-russian-hybrid-warfare-incidents/) — *Atlantic Council* Why it matters: An overview of the hybrid incidents now hitting Europe's daily life. The Atlantic Council lists the recent wave of bomb threats against airports and media, the supermarket refrigeration attacks and other incidents as signs that Moscow is escalating its pressure on Ukraine's partners; investigations into Russian involvement in the hoaxes are still open. --- ## Health & Cyber **\[P1\]** [UZ Brussel among hospitals experiencing severe network problems](https://databreaches.net/2026/11/10/uz-brussel-among-hospitals-experiencing-severe-network-problems/) — *DataBreaches.Net* Why it matters: Network failures at four Belgian hospitals: operations postponed and ambulances diverted. Brussels University Hospital UZ Brussel has postponed scheduled operations, cancelled outpatient care for the morning and diverted ambulances after network and telephone failures; AZ Monica in Antwerp, Heilig Hart in Lier and Sint-Andries in Tielt report problems too. The cause is unclear and it is not known whether this is a cyberattack; AZ Monica was hit by one in January. severity high · EU: NIS2, EHDS **\[P3\]** [Sutherland Healthcare Solutions; Hoag Memorial Hospital Presbyterian Announce Cyber Incidents](https://www.hipaajournal.com/sutherland-healthcare-hoag-memorial-hospital-data-breaches/) — *The HIPAA Journal* Why it matters: An outsourced worker accessed health plan members' data for two years. Sutherland Healthcare Solutions says an employee secretly engaged another person to do their work, who accessed names, Social Security numbers and claims data of health plan members between July 2024 and July 2026; Hoag Memorial Hospital Presbyterian in California also reports an incident. severity medium · exploited in the wild · EU: GDPR Art. 9 --- ## Quantum & Cryptography [The US wants its quantum lead to turn into factories and supply chains](https://cyberscoop.com/us-quantum-computing-industry-manufacturing-push/) — *CyberScoop* Why it matters: Washington shifts quantum policy from research to industrial capacity. US Deputy Commerce Secretary Paul Dabbar says the challenge is turning America's quantum lead into manufacturing; Commerce has letters of intent with nine companies investing more than $2 billion, and Congress is weighing further support. Europe's planned Quantum Act faces the same gap between research and industry. --- ## Cybersecurity & Threats **\[P3\]** [Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row](https://therecord.media/patch-tuesday-microsoft-1000-bugs-again) — *The Record from Recorded Future News* Why it matters: Over a thousand fixes, one exploited Outlook flaw found with an AI model. Microsoft disclosed 1,093 vulnerabilities, one exploited in the wild: an Outlook flaw (CVE-2026-124194, CVSS 6.5) that lets a crafted message file connect to an attacker's server without the usual warning and leak authentication data. Microsoft credits its discovery to a researcher using Anthropic's Claude; CISA has added it to its exploited-vulnerabilities catalogue. severity medium (CVSS 6.5) · exploited in the wild · `CVE-2026-124194` · EU: NIS2, CRA **\[P1\]** [SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution](https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html) — *The Hacker News* Why it matters: Four maximum-severity, no-login flaws in the software most SAP systems run on. SAP has fixed four flaws rated CVSS 10.0, exploitable without authentication: two allowing remote code execution through the Web Dispatcher and the Internet Communication Manager, one letting an attacker log in as any user on some systems using SAML single sign-on, and one in SAP Gateway allowing impersonation of the system's own servers. No exploitation is reported. severity critical (CVSS 10.0) · EU: NIS2, DORA **\[P2\]** [Fireworks AI Confirms Wider Breach Affecting Customer Datasets, Model Weights and Notion AI Chats](https://thehackernews.com/2026/11/fireworks-ai-breach-widens-to-expose.html) — *The Hacker News* Why it matters: An AI inference provider finds the breach reached customer datasets and model weights. Fireworks AI says its investigation into an October intrusion found further activity affecting account and billing data, secrets, datasets and incomplete models for a limited set of customer accounts; it had first reported only exposed environment variables. severity high · exploited in the wild · EU: GDPR, AI Act, NIS2 **\[P1\]** [Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers](https://www.bleepingcomputer.com/news/security/critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers/) — *BleepingComputer* Why it matters: Exploited flaw in a French virtualisation manager gives attackers admin over hosts. An authentication bypass in Xen Orchestra, the management platform of French vendor Vates for XCP-ng virtualisation, is being exploited: a crafted cookie lets attackers with network access log in as an existing user and take over hosts. No CVE has been assigned yet (VSA-2026-062). severity critical · exploited in the wild · EU: NIS2, CRA **\[P2\]** [Hackers now exploit critical Barracuda ESG flaws to gain root access](https://www.bleepingcomputer.com/news/security/hackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access/) — *BleepingComputer* Why it matters: Two patched email gateway flaws now exploited for root access. Barracuda warns that two Email Security Gateway flaws it patched a week ago are exploited against a limited number of customers; combined, they give root access but require reach to the admin interface. CISA has added one to its catalogue of exploited flaws, alongside the Cisco BroadWorks flaw used in the Operation Snowball telecom intrusion. severity high · exploited in the wild · EU: NIS2 **\[P2\]** [Railway breach leads to $740,000 in fraudulent AI charges](https://www.bleepingcomputer.com/news/apple/railway-breach-leads-to-740-000-in-fraudulent-ai-charges/) — *BleepingComputer* Why it matters: A cloud host breach turned stolen customer secrets into fraudulent AI spending. Railway says attackers escaped isolation in its build system, stole its source code and used a misconfigured trust relationship to read decrypted environment variables of up to about 100,000 workspaces, then ran about $740,000 of fraudulent AI usage with stolen keys. severity high · exploited in the wild · EU: GDPR, NIS2