Roundcube CVE-2026-48842: 523,000 exposed servers, about ten of them vulnerable
The affected plugin is off by default. Check your config before you schedule an emergency window.
Vulnerabilities
CISA's KEV entry for the WSO2 flaw describes a different vulnerability
KEV says path traversal and file upload. Everyone else — including CISA’s own CWE field — says JWT signature bypass.
The Telerik RCE chain: a two-month-old patch and a brand-new weapon
Progress fixed this in July. Public exploit code landed in September. EPSS still reads 0.5%.
Magento CVE-2026-75650: patch, then rotate everything the key touched
Adobe shipped a hotfix for the Magento flaw exploited since 4 September. Applying it is the easy half.