Google Cloud Sets $250K Root Bounty as Barracuda Patches Flaws

MOUNTAIN VIEW & CAMPBELL, Calif. — Enterprise cloud architects and security operations teams received three major vulnerability and threat-intelligence updates on Tuesday morning, led by Google Cloud establishing a $250,000 top-tier reward for architectural cloud flaws, Barracuda Networks issuing emergency patches for 2 critical root-access vulnerabilities, and cybersecurity researchers dismantling the VasyGrek malware syndicate.

Google Cloud Unveils $250,000 "Root-in-Cloud" Vulnerability Reward Tier

In an announcement published by Google Bug Hunters, Google Cloud Chief Information Security Officer Chris Betz and Cloud Vulnerability Reward Program (VRP) Lead Michael Cote unveiled a new $250,000 maximum reward tier for "Root-in-Cloud" bugs.

The $250,000 tier targets deep architectural vulnerabilities that could allow an attacker to bypass multi-tenant hypervisor or control-plane isolation, compromise administrative identity infrastructure across tenant boundaries, or gain unauthorized root-level execution within core Google Cloud services. Betz and Cote noted that Google has awarded $81.6 million in bug bounties since launching its VRP in 2010, including $17.1 million paid to more than 700 security researchers in 2025—a 40% increase over the $12 million awarded in 2024.

Barracuda Networks Urges Customers to Patch Two Critical Root-Access Flaws

Simultaneously, SecurityWeek reported that Campbell-founded security vendor Barracuda Networks—which was established in 2003 and serves more than 200,000 global customers—issued an urgent advisory warning administrators to patch 2 critical vulnerabilities (CVE-2026-116606 and CVE-2026-111560) that could allow remote attackers to obtain root access on affected appliances.

According to Barracuda's security bulletin, the 2 vulnerabilities impact 6 product lines running unpatched firmware:

1. Barracuda Email Security Gateway
2. Barracuda Load Balancer ADC
3. Barracuda Message Archiver
4. Barracuda WAF Control Center
5. Barracuda Web Application Firewall (WAF)
6. Barracuda Web Security Gateway

Kaspersky and Investigators Dismantle "VasyGrek" ("Fluffy Wolf") Cybercrime Infrastructure

In international threat-enforcement news, SecurityWeek reported that Russia's Interior Ministry—announced by spokesperson Irina Volk—and cybersecurity firm Kaspersky dismantled the command-and-control infrastructure of the VasyGrek cybercrime group (tracked by Kaspersky as Fluffy Wolf) and detained 3 suspects.

Active since 2016, the group used spear-phishing emails disguised as tax, legal, and procurement notices to deploy remote-access trojans against corporate accounting departments. Kaspersky telemetry detected more than 100 attacks by the group across Russia, Belarus, and Kazakhstan between January and September 2026, including a documented 660,000-ruble ($8,000) unauthorized corporate transfer, with the detained suspects facing up to 10 years in prison.