Roundcube CVE-2026-48842: Pre-Auth SQL Injection Exploitation Reported

CVE-2026-48842 is a pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin. Roundcube fixed it in versions 1.6.16 and 1.7.1 on May 24, 2026. On September 21, 2026, the Canadian