Summary

This week is packed: there's a critical bug already being actively exploited in the wild (Node-RED) and one real supply-chain incident (cPGuard), plus routine security releases from Rails, Django, and Pillow, along with important bugs in Barracuda, ActiveMQ, and CGI Perl. Teams running Node-RED (including ICS/OT devices based on Siemens SIMATIC IoT2050) and anyone who has ever run a cPGuard update should act first.

Node-RED HTTP interface with no authentication, already exploited

CVE-2026-58115 (CVSS 10/10) is a missing authentication issue in the Node-RED HTTP interface that grants access to the programming node to run system commands. Siemens found it in the SIMATIC IoT2050 Advanced running Industrial OS with Node-RED. VulnCheck reports successful exploitation since October 30 from a single IP on a Microsoft network (AS8075), which creates a malicious Node-RED flow, deploys it automatically, then downloads a Linux bot binary through three layers of encoding without checking whether the installation succeeded; by November 1, 15 additional attacks from the same IP had been recorded, including the installation of a persistent webshell. A fix is available in SIMATIC IoT2050 Advanced version 4.3.4.1 and later — patch immediately or make sure adminAuth is enabled on your Node-RED instances. SecurityWeek

cPGuard update channel hijacked, backdoor + password hash theft

On November 2, attackers breached cPGuard's update system and pushed a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files; OPSSHIELD (the maker of cPGuard) confirmed that data had been exfiltrated. The versions reported as affected are cPGuard 5.88.25 and later. If your servers run cPGuard, assume the credentials on them are compromised and start incident response (rotate credentials, check for backdoors, check for altered files). The Hacker News

Barracuda: two bugs chained into root access

Barracuda disclosed two flaws — a pre-authentication authorization bypass and a command injection — that, when chained, let an attacker bypass authorization controls and gain root access to vulnerable devices. It was assigned CVE-2026-116606 with a CVSS score of 9.3. The article hasn't yet detailed the specific affected products and versions or mitigation steps — watch Barracuda's official advisory for patch details. The Hacker News

Rails 8.0.5.2 and 8.1.4.1: 21 security issues, including one Critical

The Rails 8.0.5.2 and 8.1.4.1 releases patch 21 issues. The most severe: GHSA-f3w6-w445-fwh9, a possible arbitrary file write/read in Active Storage's image analysis (Critical). Then there are several High-severity ones: GHSA-v924-7rp8-4mxh (arbitrary file read + RCE in Active Storage video preview/analysis/image processing), GHSA-wm3x-v3qw-4jh3 (Strong Parameters bypass via Parameters#each_key in Action Pack), GHSA-2gff-2mmg-m73p (IP spoofing in Action Dispatch RemoteIp, 8.1 only), and GHSA-8474-xrp6-wh69 (DoS in Active Support's safe_constantize). The rest are Medium-severity XSS issues in several Action View helpers. Upgrade to Rails 8.0.5.2 or 8.1.4.1; also note that support for the 8.0 series ends on November 7, 2026. oss-security mailing list

Pillow: code execution via a crafted EPS file

A critical flaw in Pillow allows code execution via a specially crafted EPS file. It has been fixed in Pillow 13.0.0 along with several other issues. Upgrade the Pillow library in your Python projects right away. PyCoder's Weekly via Planet Python

CGI Perl: 20 CVEs before version 5.00

The CGI module for Perl before version 5.00 has 20 CVEs, including a DoS via regex in CGI::Cookie and Content-Type XForms (CVE-2026-120631, CVE-2026-120632), blind trust in the X-Forwarded-Host header (CVE-2026-120633), leakage of warnings across requests in CGI::Carp (CVE-2026-120634), form field smuggling via multipart parsing that deviates from RFC (CVE-2026-120635), open redirect and script injection via REQUEST_URI (CVE-2026-120636), request parameters being taken from command-line arguments (CVE-2026-120637), open redirect via HTML entity decoding after application validation (CVE-2026-120638), header injection via entity decoding after newline checks (CVE-2026-120639), POSTDATA/PUTDATA/PATCHDATA/XForms:Model parameters that can be populated from the query string (CVE-2026-120640), path traversal in upload file names (CVE-2026-120641), and request values not being untainted under taint mode (CVE-2026-120642). Upgrade to CGI version 5.00. oss-security mailing list

ActiveMQ: write access persists after ACL revocation

CVE-2026-111822 (important severity) causes already-authenticated connections to retain the ability to write to a destination even though the runtime-config plugin just revoked its write permission, including via a new anonymous producer — while new connections and explicit producers are correctly rejected under the latest rules. Affected: Apache ActiveMQ 6.0.0 before 6.3.3 and before 5.19.12, as well as ActiveMQ Runtime Config in the same version ranges. Upgrade to 6.4.0, 6.3.3, or 5.19.12. oss-security mailing list

Django 6.1.3, 6.0.10, 5.2.19: low-severity issues

This release patches CVE-2026-108147 (memory exhaustion in MultiPartParser via base64-encoded file uploads that get fully buffered in memory, ignoring FILE_UPLOAD_MAX_MEMORY_SIZE) and CVE-2026-111211 (log injection via unescaped GeometryField values in django.contrib.gis.forms, which could insert control characters into logs). Both are rated low severity under the Django Security Policy. There's also CVE-2026-111362, an SSRF via the crs field on GeoJSON geometry because GDAL was still resolving old CRS URLs, which Django now validates and rejects. Upgrade to Django 6.1.3, 6.0.10, or 5.2.19. Django Weblog via Planet Python

Checklist

  • [ ] Patch or disable unauthenticated access on all Node-RED instances (including SIMATIC IoT2050 Advanced to 4.3.4.1+); check for webshell/backdoor indicators if exposed to the internet
  • [ ] Audit which servers have ever run a cPGuard update since November 2; rotate credentials and search for backdoors
  • [ ] Watch Barracuda's advisory for product/version details and the patch for CVE-2026-116606
  • [ ] Upgrade Rails to 8.0.5.2 / 8.1.4.1 before support for the 8.0 series ends on November 7, 2026
  • [ ] Upgrade Pillow to 13.0.0
  • [ ] Upgrade the CGI Perl module to 5.00
  • [ ] Upgrade Apache ActiveMQ / Runtime Config to 6.4.0, 6.3.3, or 5.19.12
  • [ ] Upgrade Django to 6.1.3 / 6.0.10 / 5.2.19

---

Sources summarized:

Read also