Roundcube's Pre-Auth SQL Injection Is Being Exploited: Check Your Webmail Version
Roundcube is the webmail interface quietly running on a very large fraction of the world’s shared-hosting stacks. cPanel installs it by default. Many Plesk and ISPConfig setups do too. Most sysadmins configure it once, move on, and never think about it again — which is precisely what makes CVE-2026-48842 worth paying attention to right now. The flaw is a pre-authentication SQL injection in Roundcube’s virtuser_query plugin. It was patched in May 2026. Then, four months later, active exploitation began showing up in honeypot networks and threat-intelligence feeds. The Canadian Centre for Cyber Security issued a formal exploitation warning on September 21. Singapore’s Cyber Security Agency followed on October 3. As of this writing, the attacks are ongoing and no credentials are needed to trigger the flaw. ...