Roundcube CVE-2026-48842: 523,000 exposed servers, about ten of them vulnerable
The affected plugin is off by default. Check your config before you schedule an emergency window.
Updated Tuesday 27 October
What's exploited, what's patched, and what to do today.
Daily security news and deep-dive analysis for the people who patch and detect. Every claim is checked against the vendor or researcher, and every item links its sources.
- Sources on every item
- Primary-source checked
- No exploit code
Today's desk · 27 Oct
Full page →Earlier news
Archive →- 26 Oct 2026: PHP2Shell, FortiOS, Gheist, Tailscale, Wasmtime + 32 more
- 25 Oct 2026: Electrum, AWS eMudhra, Java SE, PAN-OS, X100 + 9 more
- 24 Oct 2026: Collabora, PHP2Shell, Brotli, Okta OAG, ArubaOS + 31 more
- 23 Oct 2026: VeloCloud, Node2Shell, PHP2Shell, Railway + 16 more
- 22 Oct 2026: LiteLLM, PHP2Shell, GitLab, Storm-0940, Java SE + 20 more
- 21 Oct 2026: PHP2Shell, eMudhra CA keys, GlobalProtect, Plex + 11 more
Analysis
All analysis →CISA's KEV entry for the WSO2 flaw describes a different vulnerability
KEV says path traversal and file upload. Everyone else — including CISA's own CWE field — says JWT signature bypass.
The CRA reporting clock starts on Thursday, and most summaries of it are wrong
From 11 September, a 24-hour reporting clock applies to actively exploited vulnerabilities — including in products you shipped years ago.
Rogue ScreenConnect clients: hunt the session, not the filenames
Modified ScreenConnect clients that infect every host they connect to. The durable detection is in the audit log.
The Telerik RCE chain: a two-month-old patch and a brand-new weapon
Progress fixed this in July. Public exploit code landed in September. EPSS still reads 0.5%.
Magento CVE-2026-75650: patch, then rotate everything the key touched
Adobe shipped a hotfix for the Magento flaw exploited since 4 September. Applying it is the easy half.