[roundcube]

September 27, 2026

• Roundcube CVE-2026-48842 is being exploited in the wild, per the Canadian Centre for Cyber Security. It is a pre-auth SQL injection in the virtuser_query plugin (1.6.x < 1.6.16, 1.7.x < 1.7.1) stemming from a preg_replace() backslash escape bypass, patched back in May 2026. Shadowserver counts 523,000+ exposed Roundcube instances, 10 flagged vulnerable as of 23 September (The Hacker News). · Vulnerabilities & Exploits

in Citrix NetScaler Zero-Days Land Mid-Weekend, No Patch Until Next Week

September 25, 2026

• A Roundcube Webmail code-injection flaw patched in May is now under active exploitation, per the Canadian Centre for Cyber Security. BleepingComputer · Vulnerabilities & Exploits

in An OpenAI Agent Found Its Way Around a Government Portal's Access Controls