North Korean Lazarus Group Uses Windows Zero
Check Point links Lazarus Group's Operation Dream Job to a new Windows zero-day, CVE-2026-68820, targeting defense workers with fake Lockheed Martin job offers.
84
CVE-2025-49113
Authenticated PHP Object Deserialization RCE in Roundcube Webmail
CISA: RoundCube Webmail Deserialization of Untrusted Data Vulnerability
- CVSS 3.1
- 8.8 high
- EPSS
- 99%p100
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 contains a PHP object deserialization flaw (CWE-502) that allows remote code execution by authenticated users. The bug is in program/actions/settings/upload.php, where the _from URL parameter is not validated before deserialization, so any logged-in user can trigger it with a crafted URL to the settings upload action, with no user interaction required. Successful exploitation gives the attacker code execution on the web server with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). All deployments running affected versions are exposed, including Roundcube packages shipped with Debian Linux. The flaw reportedly existed for roughly a decade before disclosure, carries a 98.9% EPSS score (top percentile), and was added to CISA's KEV catalog on 2026-02-20, confirming exploitation in the wild.
What to do: Upgrade to Roundcube 1.6.11 or 1.5.10 (or later); Debian administrators should install the fixed roundcube package via security updates. Hunt for compromise by reviewing web access logs for requests to the settings upload action with unusual or crafted _from parameters, and check the web server runtime for unexpected processes, files, or webshells. Federal agencies must apply mitigations per vendor instructions under BOD 22-01 or discontinue use of the product if mitigations are unavailable.
| Product | Affected |
|---|---|
| Roundcube Webmail | all versions before 1.5.10, and 1.6.x before 1.6.11 |
| Debian Linux (Roundcube Webmail package) | Debian releases shipping affected Roundcube versions; fixes delivered via Debian security updates |
Estimated exposure
masslikely tens of thousands of internet-exposed Roundcube instances serving millions of mailboxes — Roundcube is the bundled/default webmail client for many hosting and mail platforms and is packaged in Debian, and public internet scans consistently surface tens of thousands of exposed instances that in aggregate serve well over one…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
KEVCISA Known Exploited Vulnerability
- Affected
- Roundcube Webmail
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Due date
- Ransomware use
- Unknown
- Products
- webmail, debian linux
- Weakness
- CWE-502
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
In the news
20 storiesLazarus hackers pair fake job offers with Windows zero-day exploit
Lazarus' Operation Dream Job targets the defense sector with fake job offers, a Windows LPE zero-day (CVE-2026-68820), and new Troy and RelayShell backdoors.
82
Hackers now exploit critical Roundcube flaw in code injection attacks
Attackers are exploiting patched Roundcube SQL injection CVE-2026-48842 to bypass login and steal database data.
78
Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
Lazarus exploits Windows AFD.sys zero-day CVE-2026-68820 in Operation Dream Job to deploy Troy backdoor at defense firms.
78
Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild
Pre-authentication Roundcube SQL injection CVE-2026-48842 is now exploited against unpatched webmail servers.
76
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
Roundcube pre-auth SQL injection CVE-2026-48842 is being exploited, Canadian cyber authorities warned.
75
Roundcube Webmail Vulnerability in Attackers’ Crosshairs
Attackers exploit unauthenticated SQL injection CVE-2026-48842 in Roundcube webmail's virtuser_query plugin; Canadian Cyber Centre confirms in-the-wild exploitation, 500,000+ servers exposed.
75
July 2026 CVE Landscape
60
60
60
60
60
Roundcube RCE: Dark web activity signals imminent attacks (CVE-2025-49113)
60
60
60
60
60
Week in review: Microsoft fixes exploited zero-day, Mirai botnets target unpatched Wazuh servers
60
60
60