Digest · Sunday

Security digest: August 4, 2024

1 editorial brief.

All digests · RSS · Markdown

Take stock

Check exposure: Roundcube CVE-2024-42009: Open-to-Exploit Email XSS. Anyone running Roundcube 1.6.7 or older or 1.5.7 or older, including copies bundled in hosting panels and distribution packages.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

Aug 4, 2024 · Vulnerability · CVE-2024-42009

Roundcube CVE-2024-42009: Open-to-Exploit Email XSS

Fixed since August 2024 but still used against unpatched Roundcube in 2026, as the first step to a server takeover; confirm every install is on 1.6.20 or 1.7.5, and on anything that ran 1.6.7 or older, hunt for stolen sessions and rogue Service Workers.

Must act: Anyone running Roundcube 1.6.7 or older or 1.5.7 or older, including copies bundled in hosting panels and distribution packages.

Can relax: Roundcube installs kept current on 1.6.x or 1.7.x since August 2024, and organizations that do not run Roundcube.

Inventory every Roundcube instance, including hosting-panel bundles, and record its version.
Upgrade to Roundcube 1.6.20 or 1.7.5; 1.6.8 is only the floor for this bug and leaves the exploited CVE-2025-49113 open.
Move any 1.5 install to 1.6 or 1.7, since 1.5 is no longer supported.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.