https://blog.kalfaoglu.net/tags/webmail/Recent content in Webmail on kalfaoglu.netHugoenSun, 01 Nov 2026 00:00:00 +0000https://blog.kalfaoglu.net/posts/2026-11-01-roundcube-cve-2026-48842-sqli-en/Sun, 01 Nov 2026 00:00:00 +0000https://blog.kalfaoglu.net/posts/2026-11-01-roundcube-cve-2026-48842-sqli-en/<p>Roundcube is the webmail interface quietly running on a very large fraction of the world&rsquo;s shared-hosting stacks. cPanel installs it by default. Many Plesk and ISPConfig setups do too. Most sysadmins configure it once, move on, and never think about it again — which is precisely what makes CVE-2026-48842 worth paying attention to right now.</p> <p>The flaw is a pre-authentication SQL injection in Roundcube&rsquo;s <code>virtuser_query</code> plugin. It was patched in May 2026. Then, four months later, active exploitation began showing up in honeypot networks and threat-intelligence feeds. The Canadian Centre for Cyber Security issued a formal exploitation warning on September 21. Singapore&rsquo;s Cyber Security Agency followed on October 3. As of this writing, the attacks are ongoing and no credentials are needed to trigger the flaw.</p>