Barracuda Networks Has a Predator that Can’t be Patched

On May 19, network security vendor Barracuda Networks identified a vulnerability (CVE-2023-2868) in their email security gateway (ESG) device and on May 20, pushed patches to the flaw for all affected appliances. In its advisory, Barracuda said the vulnerability existed in the software component that scans email attachments for malware. More alarmingly, the devices appear to have been exploited as early as October 2022 with a malware strain granting persistent backdoor access....