[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7uSD10VUxGy-ixP3qAFuHevaX0p-RdwNRdxhLH-fPsA":3},{"article":4,"iocs":46,"watch_terms":66,"solutions":67,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"56139ef2-9539-476d-8ad1-9904326d64b0","Hackers now exploit critical Roundcube flaw in code injection attacks","hackers-now-exploit-critical-roundcube-flaw-in-code-injection-attacks-d7761a","A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security. [...]","A critical vulnerability in Roundcube Webmail, patched in May as CVE-2026-48842, is now being actively exploited by hackers. This pre-authenticated SQL injection flaw allows attackers to bypass authentication, execute malicious database commands, and steal data. The Canadian Centre for Cyber Security has warned administrators to update their servers or disable the affected virtuser_query plugin.","Hackers exploit critical Roundcube flaw CVE-2026-48842 in code injection attacks.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcritical-roundcube-flaw-now-actively-exploited-in-code-injection-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F24\u002FRoundcube.jpg","2026-09-24T13:27:57+00:00","2026-09-24T14:00:10.26849+00:00",9,[17,20,23,25],{"name":18,"type":19},"Roundcube Webmail","product",{"name":21,"type":22},"Winter Vivern","threat_actor",{"name":24,"type":22},"APT28",{"name":26,"type":27},"cPanel","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,36,41],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51,54,57,59,61,64],{"type":48,"value":49,"context":50},"cve","CVE-2026-48842","Critical Roundcube Webmail SQL injection vulnerability",{"type":48,"value":52,"context":53},"CVE-2023-5631","Roundcube XSS zero-day exploited by Winter Vivern",{"type":48,"value":55,"context":56},"CVE-2020-35730","Roundcube flaw exploited by APT28",{"type":48,"value":58,"context":56},"CVE-2020-12641",{"type":48,"value":60,"context":56},"CVE-2021-44026",{"type":48,"value":62,"context":63},"CVE-2025-49113","Roundcube flaw flagged as actively exploited by CISA",{"type":48,"value":65,"context":63},"CVE-2025-68461",[18],{"controls":68,"vendors":154},[69,98,126],{"slug":70,"name":71,"problem":72,"products":73},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":99,"name":100,"problem":101,"products":102},"patch-management","Automated patch management","Known holes get closed in days, not months.",[103,111,118],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":99,"product_name":115,"url":116,"description":117},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":45,"name":127,"problem":128,"products":129},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",[],{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":170},"critical-roundcube-sql-injection-flaw-now-actively-exploited","Critical Roundcube SQL Injection Flaw Now Actively Exploited","A pre-authenticated SQL injection vulnerability in Roundcube Webmail (CVE-2026-48842) is being actively exploited despite a patch being available since May, highlighting the persistent danger of delayed patch adoption. Because the flaw requires no prior authentication, attackers can bypass login controls entirely, execute arbitrary database commands, and exfiltrate sensitive data at scale. The fact that exploitation is now widespread indicates that many administrators failed to apply the patch within an acceptable risk window. This case underscores that unpatched internet-facing applications — especially email platforms handling sensitive communications — represent a high-priority attack surface that adversaries actively monitor for newly disclosed vulnerabilities.",[160,161,162,163,164,165,166,167,168,169],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-53 AC-3: Access Enforcement","NIST CSF ID.VM-1: Vulnerabilities are identified and documented","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated","GDPR Article 32: Security of Processing (obligation to apply timely security patches)","ITIL Change Management: Emergency Change procedure for critical patches","OWASP A03:2021 – Injection",{"OWASP A03:2021 – Injection":171,"NIST SP 800-53 SI-2: Flaw Remediation":172,"NIST SP 800-53 AC-3: Access Enforcement":173,"CIS Control 12: Network Infrastructure Management":174,"CIS Control 7: Continuous Vulnerability Management":175,"NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning":176,"NIST CSF ID.VM-1: Vulnerabilities are identified and documented":177,"NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated":178,"ITIL Change Management: Emergency Change procedure for critical patches":179,"GDPR Article 32: Security of Processing (obligation to apply timely security patches)":180},"Covers injection flaws, the vulnerability class exploited in Roundcube.","Requires flaw remediation, applying the Roundcube patch.","Requires access enforcement, which the pre-authentication flaw bypasses.","Asks for secure network infrastructure, such as limiting exposure of webmail servers.","Asks for continuous vulnerability management, so CVE-2026-48842 is patched instead of left open since May.","Requires vulnerability scanning, identifying unpatched Roundcube instances.","Asks that vulnerabilities are identified and documented, including in webmail.","Asks for new vulnerabilities to be mitigated, critical for an exploited flaw.","Provides an emergency change route for critical Roundcube patches.","Requires appropriate security, including timely patching of webmail."]