A high-severity vulnerability in Roundcube Webmail, patched in May 2026, is now being actively exploited in code injection attacks, according to the Canadian Centre for Cyber Security. The flaw, tracked as CVE-2026-48842, allows unauthenticated attackers to bypass security controls and execute malicious database commands, putting millions of email users at risk.  Roundcube is a browser-based IMAP email client used as the default mail interface by thousands of services and is pre-installed with the widely adopted cPanel web hosting control panel. The vulnerability resides in the virtuser_query plugin, which handles database-driven user lookups and maps users to email addresses. Successful exploitation enables threat actors with no privileges to inject and execute malicious SQL commands, steal data from Roundcube's database, and compromise email systems without requiring any user interaction.  The Roundcube security team addressed this issue in May by releasing patches in versions 1.6.16 and 1.7.1, strongly recommending that administrators update their servers immediately. For those unable to upgrade right away, disabling or removing the virtuser_query plugin eliminates the attack vector and reduces exposure. Despite the availability of fixes, Shadowserver currently tracks over 523,000 Roundcube instances exposed on the Internet, though it remains unclear how many are honeypots or already patched against this flaw.  This is not the first time Roundcube has been targeted by sophisticated threat actors. The Russian Winter Vivern (TA473) group exploited a cross-site scripting zero-day (CVE-2023-5631) against European government entities, while APT28 abused multiple Roundcube flaws to breach Ukrainian government email systems. More recently, in February 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) flagged two other Roundcube vulnerabilities as actively exploited, ordering federal agencies to secure their networks within three weeks. Since May 2022, CISA has tagged 11 Roundcube Webmail vulnerabilities as exploited in the wild, underscoring the platform's persistent appeal to cybercriminals and state-backed hackers.  Organizations relying on Roundcube should prioritize patching to versions 1.6.16 or 1.7.1 without delay, as the window for safe operation has closed. Administrators who cannot upgrade immediately must disable the vulnerable virtuser_query plugin and monitor logs for suspicious database queries or unauthorized access attempts. Given the scale of exposed instances and the history of active exploitation, treating this flaw as a critical priority is essential to prevent data theft, credential harvesting, and broader compromise of email infrastructure.

The event planning startup, which has raised over $27M from a16z and others, fixed the bug after TechCrunch found that Partiful was not removing granular location data from users' profile photos.

Many apps claim to respect privacy, but evidence shows some refuse to delete user data even after requests. What does this mean for

Google will soon cast an even wider net with its AI age estimation technology. From a report: After announcing plans to find and restrict underage users on YouTube, the company now says it will start...

While there is no confirmed link between the Fractal ID data breach and the Li.Fi exploit, the coincidence of timing raises questions.

The Washington Post reports: Meta was willing to go to extreme lengths to censor content and shut down political dissent in a failed attempt to win the approval of the Chinese Communist Party and bring...

Call recording app Neon was one of the top-ranked iPhone apps, but was pulled offline after a security bug allowed any logged-in user to access the call recordings and transcripts of any other user.

Malicious Android app steals $70K in cryptocurrency by posing as WalletConnect. Over 150 victims impacted.

Paidwork breach reveals sensitive data of 23 million users. Lack of transparency raises concerns about accountability and user security.

Form validation is a critical aspect of any application that interacts with users. Ensuring that user inputs are correct, secure, and meet…

In this tutorial, we explain how to make res.group into selection in res.user odoo 17 while actively guiding you through each step using clear examples and real code. We introduce the concept, explain the changes step by step, and illustrate the modifications you implement in Odoo 17. Moreover, we ensure that you get a hands-on experience as you follow along with our detailed walkthrough, complete with code samples and explanations.

 Following Veeam Backup & Replication's Tuesday patch release to patch a critical remote code execution vulnerability, researchers are advising customers to ensure their systems are completely upgraded to the latest version.  An authorised domain user can execute code on a backup server thanks to the vulnerability, which is tagged as CVE-2025-23121. It was previously revealed by watchTowr and Code White GmbH researchers that a fix for an earlier vulnerability, identified as CVE-2025-23120, could be circumvented. As a result of the disclosure, a new patch was prepared.  Benjamin Harris, CEO of watchTowr, claims that Veeam is essentially updating a blacklist of "dangerous deserialisation gadgets" once they have been identified. Harris said that throughout the deployment of multiple patches for the Backup & Replication product, researchers have observed this occur repeatedly. "This blacklisting approach will never be sufficient, as we advocated in March," Harris wrote in an email to Cybersecurity Dive, further stating that his team "demonstrated [this] once again in March when we reported further gadgets to Veeam that they have released patches for [on Tuesday] to address.”  Veeam stated that the patch fixes the issue, and automatic updates have been enabled for all backup versions. “When a vulnerability is identified and disclosed, attackers will still try to exploit and reverse-engineer the patches to use the vulnerability on an unpatched version of Veeam software in their exploitation attempts,” a Veeam spokesperson told Cybersecurity Dive via email. “This underlines the importance of ensuring customers are using the latest versions of all software and patches are installed in a timely manner.” In the case of a ransomware attack or other malicious infiltration, Veeam Backup & Replication is a solution that assists in backing up, replicating, and restoring enterprise data. Domain-joined backup servers, which Veeam has previously recommended against deploying, are at risk of being abused. However, it seems that the risky method is frequently employed for efficiency. Harris noted that Veeam employs a function to handle data that is known to be intrinsically insecure, and that rather than eliminating this function, they will try to maintain a list of bad "gadgets" that should not be processed within this function.  Veeam has around 550,000 customers, and ransomware gangs often exploit the product's flaws. Rapid7 researchers revealed on Tuesday that more than 20% of the firm's incident response cases in 2024 involved Veeam being accessed or abused.

[Medicaid] The Alabama Medicaid Agency now requires MFA when accessing the Medicaid Interactive Web Portal. MFA is an added step to the sign in process which improves security by requiring users to use a separate device to help verify your identity.

The idea that our smartphones might be eavesdropping on our conversations has sparked widespread concern and curiosity.

OpenAI says it's investigating after a hacker claimed to have stolen login credentials for 20 million OpenAI accounts and advertised the data for sale on a dark web forum. Though security researchers...

OCIO seeks expanded public identity solution to consolidate authentication for state agencies.

Download SkyLink - Bluesky DID Detector for Firefox. Detects Decentralized Identifiers (DIDs) in a domain's TXT records and links to the associated Bluesky profile.

Apple is taking the UK government to court over efforts to force the company to weaken iCloud encryption.