The Exploit Bulletin — Tuesday, November 3, 2026: 4 issues require action
Tuesday, November 3, 2026 — 4 issues require action. If you run none of the software below, you are done.
Affects: Synology DSM / BeeStation OS · CryptoPayment Gateway WordPress plugin · BTCPay Server · Barracuda ESG / Load Balancer ADC / WAF / Web Security Gateway / Message Archiver
1. Unauthenticated remote code execution in Synology DSM system plugin daemon used in NAS ransomware attacks (CVE-2024-10441)
RANSOMWARE · CRITICAL · CVSS 9.8
Synology said on 2026-10-29 that attackers are exploiting a DSM flaw patched in December 2024, pointing to Synology-SA-24:20 which lists this CVE, in ransomware attacks against NAS devices on outdated DSM versions, with VulnCheck recording known ransomware use — an unpatched, reachable NAS is a direct target for data encryption.
An improper output encoding flaw in the system plugin daemon of Synology DiskStation Manager and BeeStation OS lets a remote, unauthenticated attacker execute arbitrary code on the NAS. Synology fixed it in December 2024, but devices still running older DSM builds are being compromised and their data encrypted.
Affected: Synology DSM 7.2.2 before 7.2.2-72806-1; Synology DSM 7.2.1 before 7.2.1-69057-6; Synology DSM 7.2 before 7.2-64570-4; Synology DSM 7.1 before 7.1.1-42962-7; Synology BeeStation OS 1.0/1.1 before 1.1-65374
How to Test: Check the installed DSM or BeeStation OS build in the device's system information / update screen and compare against the fixed builds above (7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, BSM 1.1-65374); anything older is vulnerable. Check whether the NAS is reachable from the internet (port forwarding or direct exposure). For signs of compromise, look for encrypted files or ransom notes on shared volumes, unexpected new user accounts or scheduled tasks, and unfamiliar remote logins in DSM's log center; a compromised device should be isolated and restored from offline backups.
How to Patch: Upgrade DSM to 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, or 7.1.1-42962-7 (and DSM 6.2 to 6.2.4-25556-8) and BeeStation OS to 1.1-65374 or later; Synology lists no mitigation other than updating, so until patched remove the device from direct internet exposure.
Evidence: VulnCheck KEV · Vendor confirmed · The Hacker News (2026-11-03): Synology NAS devices targeted in ransomware attacks · VulnCheck XDB public exploit
2. Unauthenticated AJAX endpoint in CryptoPayment Gateway WordPress plugin exposes wallet credentials and allows file deletion (CVE-2026-81648)
CREDENTIAL EXPOSURE · CRITICAL · CVSS 10.0
Defused Cyber reported exploitation attempts on 2026-11-02, VulnCheck added the flaw to its KEV catalog the same day, and a public exploit is available while the plugin remains unpatched — a store that leaves it active risks losing its wallet credentials and having its payment configuration redirected.
The CryptoPayment Gateway WordPress plugin 1.2.1–1.2.2 performs no authorization check on one of its AJAX endpoints, so anyone on the internet can invoke administrative operations: deleting arbitrary files on the server, overwriting the payment gateway configuration, and reading stored wallet credentials in cleartext. No fixed release exists.
Affected: CryptoPayment Gateway WordPress plugin 1.2.1 through 1.2.2 (no fixed version available)
How to Test: In the WordPress admin Plugins screen (or via wp plugin list), check whether CryptoPayment Gateway is installed and whether its version is 1.2.1 or 1.2.2 — any such install is vulnerable. Review web server logs for unauthenticated POST requests to admin-ajax.php invoking the plugin's actions from unfamiliar IPs, verify the plugin's payment gateway configuration (wallet/payout settings) has not been altered, look for unexpectedly deleted files in the WordPress install, and assume stored wallet credentials are compromised if any suspicious activity is found — rotate them.
How to Mitigate: No patched version exists. Deactivate and delete the CryptoPayment Gateway plugin until the vendor ships a fix; if it cannot be removed, block unauthenticated access to the plugin's AJAX actions at the web server or WAF and move the exposed wallet credentials to fresh keys.
Evidence: VulnCheck KEV · The Hacker News (2026-11-03): attackers attempting to exploit the unpatched flaw, per Defused Cyber · VulnCheck XDB public exploit
3. Hot-wallet drains on self-hosted instances running 2.4.1 or earlier — vendor says upgrade and rebuild (BTCPay Server)
UNVERIFIED PUBLIC REPORT · NO CVE · CREDENTIAL EXPOSURE · CRITICAL
The vendor published its investigation findings and attacker wallet addresses in the last 48 hours and is telling every operator on 2.4.1 or earlier to assume compromise and rebuild — funds on those hosts are at direct risk now.
BTCPay Server, the self-hosted open-source crypto payment processor, says its investigation found Bitcoin and Litecoin being stolen from hot wallets on instances running 2.4.1 (23 July 2026) or earlier. The maintainers say attackers used a new method to exploit the critical vulnerability fixed in 2.4.2 (7 August 2026), which they describe as actively exploited to obtain LND admin macaroon credentials and drain connected wallets. Reports of this new wave surfaced around 1 November 2026; the vendor says no credible drain reports have come from the current 2.4.7 release, which also fixes one critical and several medium issues. Not known: when the current campaign began, the exact exploitation technique, and no CVE has been assigned. BTCPay's August alert described the flaw fixed in 2.4.2 as letting an unauthenticated remote attacker obtain LND .macaroon credential files.
Affected: BTCPay Server 2.4.1 and earlier
How to Test: Check Server Settings > Version in the BTCPay admin UI or the image tag in your docker-compose/btcpay-docker deployment; anything below 2.4.7 (and especially 2.4.1 or earlier) is affected. Review hot-wallet transaction history for unexpected outbound transfers, particularly to bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7 (BTC) or ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee (LTC). Check whether your hosting provider shut your instance down automatically — BTCPay says some providers did this for older versions.
How to Patch: Update to BTCPay Server 2.4.7 (btcpay-update.sh on docker deployments). If the instance ran 2.4.1 or earlier while reachable from the internet, do not just patch in place: stand up a fresh server, create a new wallet, rotate every secret (LND macaroons, API keys, store credentials), and sweep funds to it. Keep only operating float on the server's hot wallet and hold the rest in a wallet whose spending keys are off the server.
Evidence: The Hacker News: Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets
4. Pre-auth authorization bypass and command injection across six appliance lines, updates available (Barracuda Networks)
UNVERIFIED PUBLIC REPORT · NO CVE · REMOTE CODE EXECUTION · CRITICAL
The Cyber Centre advisory and Barracuda fixes landed yesterday; these are internet-facing security appliances with a pre-auth command-injection class of bug, the same class that led Barracuda to tell ESG customers to replace hardware in 2023.
The Canadian Centre for Cyber Security's AV26-1112 (2 November 2026) relays a Barracuda Networks product security advisory describing pre-authentication authorization bypass and command injection vulnerabilities in six appliance lines: Email Security Gateway before 9.4.0.030, Load Balancer ADC before 6.4.0, Web Application Firewall before 11.0.1, Web Security Gateway before 16.1.100.100, Message Archiver before 5.5.4.0 and WAF Control Center before 2.2.1. Pre-auth command injection on an edge appliance means an unauthenticated attacker reaching the vulnerable interface can run commands on the device. Not known: no CVE identifier has been published, the advisory does not say which interface (management vs. service) is affected, there is no CVSS score, and neither Barracuda nor the Cyber Centre reports exploitation.
Affected: ESG prior to 9.4.0.030; Load Balancer ADC prior to 6.4.0; WAF prior to 11.0.1; Web Security Gateway prior to 16.1.100.100; Message Archiver prior to 5.5.4.0; WAF Control Center prior to 2.2.1
How to Test: On each Barracuda appliance, check the firmware version under Advanced > Firmware Update (or the System page on WCC/BMA) and compare against the fixed versions above. Inventory which appliances expose a web interface to the internet; the advisory does not name the vulnerable endpoint, so treat any externally reachable Barracuda web interface on an older build as exposed. Review appliance logs for unexpected administrative sessions or outbound connections, since no vendor indicators have been published.
How to Patch: Apply the listed firmware: ESG 9.4.0.030, Load Balancer ADC 6.4.0, WAF 11.0.1, WSG 16.1.100.100, Message Archiver 5.5.4.0, WAF Control Center 2.2.1 or later, via the appliance's firmware update page or Barracuda Cloud Control. Where an update cannot be applied today, place the management interface behind a VPN or allow-list and block it from the internet.
Evidence: Canadian Centre for Cyber Security AV26-1112: Barracuda Networks security advisory
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
