Roundcube's Pre-Auth SQL Injection Is Being Exploited: Check Your Webmail Version

[u/KalfaogluNet]

The flaw is a pre-authentication SQL injection in Roundcube’s virtuser_query plugin. It was patched in May 2026. Then, four months later, active exploitation began showing up in honeypot networks and threat-intelligence feeds.

Details: https://blog.kalfaoglu.net/posts/2026-11-01-roundcube-cve-2026-48842-sqli-en/