Roundcube is an open-source application for managing email through a Web interface. It runs on Web servers that support the PHP server-side scripting language. Roundcube may be a good choice for your ...

Attackers are exploiting CVE-2026-48842 against unpatched Roundcube servers months after a fix was released, raising urgency for organizations to update.

Roundcube shipped emergency security updates on August 9, 2026, patching eleven distinct vulnerabilities across both its LTS and current stable branches simultaneously — a batch that includes a ...

The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before ...

Add Yahoo as a preferred source to see more of our stories on Google. Fingers hover over a computer keyboard with numbers on a screen, against a shadowy backdrop. Threat actors are targeting a ...

The threat associated with a critical decade-old remote code execution vulnerability in Roundcube webmail has increased sharply in recent days, with proof-of-concept (PoC) code for the bug becoming ...

A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security.

The Winter Vivern Russian hacking group has been exploiting a Roundcube Webmail zero-day in attacks targeting European government entities and think tanks since at least October 11. The Roundcube ...

Jesus Vigo reviews the steps necessary to add a front-end webmail application using Roundcube that’s hosted on OS X Server. In a previous article, I covered the steps on how to setup and configure the ...

Attackers are currently exploiting a security vulnerability in Roundcube webmail. However, the prerequisites must be met.

Attackers have exploited an XSS vulnerability (CVE-2024-37383) in the Roundcube Webmail client to target a governmental organization of a CIS country, Positive Technologies (PT) analysts have ...

The Winter Vivern APT group has been exploiting a zero-day vulnerability (CVE-2023-5631) in Roundcube webmail servers to spy on email communications of European governmental entities and a think tank, ...