Roundcube CVE-2026-48842: 523,000 exposed servers, about ten of them vulnerable
The affected plugin is off by default. Check your config before you schedule an emergency window.
Detection
CISA's KEV entry for the WSO2 flaw describes a different vulnerability
KEV says path traversal and file upload. Everyone else — including CISA’s own CWE field — says JWT signature bypass.
Rogue ScreenConnect clients: hunt the session, not the filenames
Modified ScreenConnect clients that infect every host they connect to. The durable detection is in the audit log.
The Telerik RCE chain: a two-month-old patch and a brand-new weapon
Progress fixed this in July. Public exploit code landed in September. EPSS still reads 0.5%.
Magento CVE-2026-75650: patch, then rotate everything the key touched
Adobe shipped a hotfix for the Magento flaw exploited since 4 September. Applying it is the easy half.