Roundcube CVE-2026-48842: 523,000 exposed servers, about ten of them vulnerable
The affected plugin is off by default. Check your config before you schedule an emergency window.
Exploited-in-the-Wild
CISA's KEV entry for the WSO2 flaw describes a different vulnerability
KEV says path traversal and file upload. Everyone else — including CISA’s own CWE field — says JWT signature bypass.
Magento CVE-2026-75650: patch, then rotate everything the key touched
Adobe shipped a hotfix for the Magento flaw exploited since 4 September. Applying it is the easy half.