Loading story…
Security advisories disclosed multiple vulnerabilities across widely used web infrastructure components, including OWASP ModSecurity, PHP, and Roundcube Webmail. ModSecurity versions through 3.0.15 are affected by CVE-2026-52761 and CVE-2026-52747, flaws that can let attackers bypass web application firewall inspection by exploiting truncated UTF-8 processing on i386 systems and discrepancies in multipart/form-data parsing. The issues were fixed in ModSecurity 3.0.16, and defenders were advised to review rulesets that rely on input transformations and multipart inspection behavior.
PHP also published fixes for CVE-2026-12184 and CVE-2026-14355, which can trigger denial-of-service conditions in PHP-FPM and memory corruption through the OpenSSL extension’s AES-WRAP-PAD handling. Separately, Roundcube released security updates 1.6.17 and 1.7.2 for vulnerabilities affecting earlier versions of its webmail platform, with government guidance urging administrators to apply the patches. The disclosures highlight patching urgency across the web application stack, particularly for internet-facing services that depend on WAF filtering, PHP runtime stability, and webmail access.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Official PHP security advisories disclosed CVE-2026-12184 and CVE-2026-14355, which can cause denial-of-service conditions and memory corruption. PHP released patched versions for affected branches and advised organizations to upgrade.
Multiple vulnerabilities in OWASP ModSecurity, including CVE-2026-52761 and CVE-2026-52747, were disclosed as affecting versions up to 3.0.15. The flaws can enable firewall rule bypass under specific conditions and were fixed in ModSecurity version 3.0.16.
On July 5, 2026, Roundcube published security advisories for vulnerabilities affecting Roundcube Webmail. The advisories said versions prior to 1.6.17 and prior to 1.7.2 were affected, and security updates 1.6.17 and 1.7.2 were released to address the issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Roundcube Webmail released urgent security updates to fix multiple high-risk vulnerabilities across supported branches, including versions **1.6.16** and **1.7.1**, following earlier fixes in **1.6.14** for the 1.6.x line. The newly disclosed issues include **CVE-2026-48842**, a pre-authentication SQL injection flaw in the `virtuser_query` plugin with a CVSS score of **8.1**, and **CVE-2026-48844**, a code injection bug tied to direct code evaluation in LDAP autovalues configuration that could enable arbitrary command execution. Additional patches address XSS, session poisoning, arbitrary file deletion, and SSRF bypass vulnerabilities tracked as **CVE-2026-48845** through **CVE-2026-48849**, and a dCERT advisory also lists Roundcube as affected by multiple vulnerabilities. Earlier Roundcube fixes had already addressed a separate set of severe weaknesses, including a pre-authentication arbitrary file write issue in Redis and Memcached session handlers that could lead to unauthenticated remote code execution and full server compromise, along with account takeover, SSRF, IMAP injection, CSRF bypass, and HTML attachment preview XSS. Researchers credited across the disclosures include **y0us**, **Georgios Tsimpidas**, **flydragon777**, the **Martila Security Research Team**, **aikido_security**, and **nullcathedral**. Roundcube described the releases as stable and urged administrators to back up systems and deploy updates quickly to protect exposed email infrastructure from pre-authentication exploitation.
Jun 29, 2026
Roundcube released security updates for its webmail software to fix multiple vulnerabilities affecting versions prior to `1.6.14`, including a pre-authentication arbitrary file write tied to unsafe deserialization in the Redis/Memcache session handler and tracked externally as `CVE-2026-35537`. The updates in versions `1.5.14` and `1.6.14` also addressed a password change issue, an IMAP injection flaw with CSRF bypass, several remote image blocking bypasses, a fixed-position mitigation bypass, an XSS issue in HTML attachment preview, and an SSRF plus information disclosure weakness involving stylesheet links to local network hosts. Roundcube noted that `1.7` pre-release builds were also affected. A follow-up release in versions `1.5.15` and `1.6.15` corrected regressions introduced by the earlier fixes and patched an additional cross-site issue described as an SVG Animate FUNCIRI attribute bypass, which could allow remote image loading through `fill`, `filter`, and `stroke` attributes. That flaw was reported by class_nzm and appears to be tracked as `CVE-2026-35545`, extending the remediation effort beyond the initial advisory as administrators were urged to move to the latest patched builds.
Jun 29, 2026
Roundcube has released **Webmail 1.6.18** and **1.7.3** to fix **11 security vulnerabilities**, led by **`CVE-2026-74997`**, a high-severity remote code execution flaw in the **markasjunk** plugin’s **`cmd_learn`** driver. The bug, classified as **CWE-78**, affects **Roundcube 1.6.x before 1.6.18** and **1.7.x before 1.7.3** and can be triggered through crafted placeholder replacement values, potentially allowing command execution on the mail server with impacts to confidentiality, integrity, and availability. Roundcube urged all production deployments to upgrade, and administrators were advised to disable the **markasjunk** plugin if it is not needed. The security updates also address SSRF filter bypasses, remote content blocking bypass, LDAP filter injection, arbitrary Sieve script injection, IMAP command injection, stored XSS, HTML/CSS sanitization bypasses, and a **modoboa** password-driver issue that could leak an authentication token to a user-controlled host. Roundcube said the flaws could expose webmail environments to mail theft, persistence, and lateral movement if left unpatched, and recommended restricting outbound connectivity from Roundcube hosts in addition to applying the new releases.
Aug 18, 2026