Thursday, September 24, 2026 · Daily editionBack issueBack issues · Search

SitRep

An independent cybersecurity briefing — what matters, with its sources.

You are reading a back issue. Go to the latest edition →

The situation

Roundcube Pre-auth SQL Injection Exploited

Critical Roundcube flaw exploited; 523k+ exposed instances; patch or mitigate now; also cover WordPress, TeamCity, Docker.

Composed by SitRep’s AI editors from 3 sources — BleepingComputer, SecurityWeek, The Hacker News

Critical Roundcube Flaw Actively Exploited

BleepingComputer reports the pre-auth SQL injection in Roundcube (CVE-2026-48842) is actively exploited four months after a patch; Shadowserver records over 523,000 exposed instances. The bug enables data theft and authentication bypass; updates 1.6.16/1.7.1 mitigate the issue, or disable virtuser_query if updates are unavailable.

Context

Internet-facing application exposures are being automated and weaponized by both wormy malware and agentic tooling, increasing blast radius across webmail, CMS, CI, and container management services. Practitioners should assume large-scale scanning and rapid exploit chaining against any unpatched or misconfigured public service.

“Today's stories show rapid post-disclosure RCE, active ransomware exploitation, and autonomous malware abusing exposed services.”
The move

5 things to do today

  1. Patch Roundcube to 1.6.16/1.7.1 or disable virtuser_query immediately (CVE-2026-48842).
  2. Upgrade WordPress to 7.1.2 or apply vendor backports and audit active themes for pearcmd[.]php and traversal attempts (CVE-2026-87902).
  3. Apply JetBrains TeamCity patches (2025.11.7 / 2026.1.3 or later) and isolate internet-facing CI servers (CVE-2026-63077).
  4. Block TCP port 2375 at network edge and inventory Docker hosts for exposed APIs; require registry auth and monitor for unexpected container launches.
  5. Hunt for automated reconnaissance: high-rate web probes, unusual User-Agent strings, rapid template/file reads, calendar-sourced HTTP callbacks, and signed-binary launches; block ClickFix indicators.

On the wire

P0Exploit

Patch or Mitigate CVE-2026-48842 in Roundcube Immediately

CVE-2026-48842 is actively exploited and enables pre-auth SQL injection leading to data theft and auth bypass; apply Roundcube 1.6.16/1.7.1 or, if patching is not possible, disable virtuser_query. Monitor webmail access logs for anomalous queries and evidence of user table reads.

BLEEPINGCOMPUTER · Critical Roundcube Flaw Exploited in Code Injection Attacks

P1Exploit

Update WordPress for CVE-2026-87902 or Isolate Affected Themes

CVE-2026-87902 allows unauthenticated path traversal to RCE and was exploited within hours of disclosure; upgrade to WordPress 7.1.2 or apply backports and review active themes (Twenty Twelve, Twenty Fourteen, Neve, Hestia, Sydney). Detect exploitation by logging template file access patterns and blocking requests attempting page-template resolution with traversal sequences.

SECURITYWEEK · Critical WordPress CVE-2026-87902 Exploited Within Hours

P1Ransomware

Remediate JetBrains TeamCity CVE-2026-63077 Immediately

CISA reports ransomware actors exploiting CVE-2026-63077 to bypass auth and execute commands; install the July 25 patches for 2025.11.7 and 2026.1.3 or later and isolate internet-facing TeamCity instances. Hunt for post-auth command execution and unexpected service creations on CI hosts.

BLEEPINGCOMPUTER · CISA warns ransomware gangs exploiting critical TeamCity flaw CVE-2026-63077

P1Infrastructure

Harden Docker Hosts; Block Unauthenticated API on Port 2375

Carbonato targets unauthenticated Docker daemons on port 2375 to deploy Hermes AI agents and create reverse tunnels, spreading every five minutes; remove public exposure of Docker API, require registry authentication, and block port 2375 at the perimeter. Alert on new Docker containers launched by unexpected images and on rapid, repeated neighbor host connections.

BLEEPINGCOMPUTER · Carbonato malware hijacks exposed Docker hosts using Hermes AI

P2Delivery

Detect and Block ClickFix/Malicious Trusted-site Delivery Chains

ClickFix leverages 17,000 infected URLs to deliver payloads via trusted sites; combine blocklisting of known ClickFix indicators, monitor signed-binary launches, and audit inbound referral chains. Expect on-chain per-visitor targeting and use heuristics for low-reputation transient redirects and calendar-sourced download callbacks used by MacSync.

THE HACKER NEWS · ClickFix Attack Turns Trusted Sites Into Malware Traps

Indicators named in this edition

KindValueNote
CVECVE-2026-48842Roundcube pre-auth SQL injection
CVECVE-2026-87902WordPress path traversal to RCE
CVECVE-2026-63077JetBrains TeamCity auth bypass / RCE
PORT2375Unauthenticated Docker API abused by Carbonato

Elsewhere in the edition

FBI Investigates Breach Of Jobs Website After Data Theft Claims

The FBI is investigating a breach of a job-application website after hackers claimed very sensitive data was stolen, including thousands of FBI personnel records. The incident is being reported across outlets such as The Guardian, The New York Times, Reuters, The Washington Post, and ABC News, with coverage date noted as September 24, 2026.

3 reports

TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts

Proofpoint details an active TeamFiltration campaign (UNK_CondorFiltration) that targeted over 5,700 Microsoft 365 accounts across 28 tenants, compromising seven accounts—dormant service accounts with default passwords and no MFA. The operation used 1,487 AWS EC2 IPs across three waves (late July–Aug 2026), mainly impacting Chilean retail/financial sectors. Six of seven breaches occurred within 7…

2 reports

Also reported

End of the Thursday, September 24, 2026 edition.