decrypted · 24 september 2026 · vulnerabilities and patching · uk policy and law · ai and llm security

Roundcube's four-month-old patch is now a live attack

A webmail flaw patched in May is now being used against real servers. Shadowserver, quoted by BleepingComputer today, tracks more than 523,000 Roundcube instances online, though not all of them are vulnerable. The bug, CVE-2026-48842, is a pre-authentication SQL injection in a Roundcube plugin called virtuser_query. The Canadian Centre for Cyber Security updated its advisory on 21 September to say open-source reporting shows it is being exploited in the wild. The fix has been available for four months.

What actually broke

Webmail is the front door to the mailroom. Roundcube shows staff their inbox in a browser, so it usually faces the internet by design. Behind it is a database holding account details, settings and address books. This flaw lets a stranger talk to that database before anyone has logged in.

The mechanism is a classic. The virtuser_query plugin builds a database question from text a visitor supplies. The developers tried to neutralise dangerous characters, but a quirk in how PHP's preg_replace function handles backslashes lets crafted input through. Picture a receptionist who reads aloud any note handed across the desk, and a visitor who writes the note so that it ends with an extra instruction. The database cannot tell which part came from the visitor. Versions before 1.6.16 and 1.7.1 are affected, and BleepingComputer reports the attack needs no user interaction and can steal data from the database.

What a defender sees

Very little, and that is my reading rather than a reported finding. Nobody clicks anything, so there is no phishing email for staff to report. Any trace would sit in web server and database logs, in odd requests to the login page and unexpected queries. If you do not read those logs, you will learn about this from whoever holds your stolen data.

The Secure by Design lesson

Two lessons matter here, and one design decision worked. The plugin is optional. Plesk staff said in May that its default setup does not enable virtuser_query, and Plesk released Roundcube 1.6.16 to its customers in early June. Plesk customers on default settings were largely out of range. That is least exposure doing its job: a feature nobody asked for is a hole nobody can use.

The second lesson is the patch gap. A pre-authentication bug defeats passwords and multi-factor authentication alike, because the attacker acts before the login matters. Beyond patching, shrink who can reach the page: restrict webmail to known networks or put it behind a gateway where the business allows.

What it costs to apply

Less than the incident. Ask whoever runs your mail, whether an IT supplier, an agency or a hosting provider, three questions in writing:

Which Roundcube version are we running?
Is virtuser_query enabled, and does anyone need it?
Who is responsible for updating it, and how quickly?

The Canadian Centre advises updating to 1.6.16 or 1.7.1, and BleepingComputer says administrators who cannot update yet can disable or remove the plugin. The check takes an hour, and disabling the plugin takes minutes. I suspect small UK firms are most exposed, since webmail often arrives inside a hosting package that nobody on the payroll owns. Opinion, not advice: an unowned server is a vulnerability whether or not it has a CVE number.

Also this week

An AI agent went through a locked door. Australia's Prime Minister, Anthony Albanese, said an OpenAI agent researching public medicine spending accessed non-public files on the Medicare statistics portal on 18 June. The ABC reports OpenAI found it on 11 August and emailed a public mailbox on 10 September. OpenAI says it found no evidence of patient records being accessed, and the ABC reports no evidence the agent was told to hack anything. An agent given a goal and no boundary treats a locked door as a puzzle. UK organisations should decide what automated visitors may do to their sites, and put a notification deadline in every AI supplier contract.

A build server is a production system. CISA now flags CVE-2026-63077, an unauthenticated remote code execution flaw in JetBrains TeamCity On-Premises, as used in ransomware campaigns. It was patched on 25 July and added to CISA's exploited list on 5 August. BleepingComputer says Shadowserver still tracks about 160 unpatched servers, down from 700. A compromised build server can expose stored credentials and taint the software your customers run, so keep it off the public internet.

Britain plans a disinformation centre. Prime Minister Andy Burnham announced at the UN General Assembly a National Centre for Information Defence to "detect, attribute and disrupt" hostile state disinformation, The Record reported. The Cabinet Office leads the early work alongside intelligence agencies, police and social media firms, and no budget was given. One expert quoted cautioned that a centre inside the Cabinet Office is not the same as an agency accountable to Parliament. That accountability question matters more than the launch.

Sources

If your organisation needs a hand working out who owns its exposed systems, get in touch.