Roundcube Releases 1.6.20 and 1.7.5 Fix 20 Bugs; Older SQL Injection Under Active Exploitation

·2 views

On 19 October 2026, the Roundcube project released versions 1.6.20 and 1.7.5, which address 20 reported vulnerabilities, and urged all production installations of the 1.6.x and 1.7.x branches to update. Separately, Singapore's Cyber Security Agency warned on 3 October that an older pre-authentication SQL injection flaw in Roundcube's virtuser_query plugin was reportedly being actively exploited. That flaw affects versions before 1.6.16 and 1.7.x before 1.7.1, and was fixed in May 2026, with CSA rating it 8.1 under CVSS v3.1. Administrators are advised to check their installed version, remove unused plugins, back up their data, and apply the appropriate update promptly, since servers untouched since spring remain the most exposed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AI Can Generate Code, but Engineers Are Still Needed to Make Software Work

Tech leaders Marc Benioff of Salesforce and Mark Zuckerberg of Meta have predicted that AI will transform software engineering, with Benioff citing productivity gains for possibly limiting 2025 hiring. The article argues that generating code is only one part of building dependable software, since engineers must grasp user needs, integrate changes into complex systems, and verify outcomes. A 2025 METR study of 16 experienced developers found they took about 19% longer on tasks with AI tools, even though they believed the tools had sped them up. Google's 2024 DORA research linked higher AI adoption to lower delivery stability across the organizations it studied, though it did not establish causation. The piece concludes that AI will reshape engineering work but will not remove the need for human judgment, review, and responsibility.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why a clean static analysis scan can still miss real vulnerabilities

A security series author ran a free static analyzer on their own service's code and got zero findings with its default rule set. A second run using a JavaScript-specific rule set flagged the post-login redirect logic, and the underlying flaw went unnoticed by every Semgrep rule set they tried. An AI code reviewer caught the issue when the fix was tested, and it has since been patched. The author's takeaway is that zero findings does not guarantee safety, so developers should layer different checking methods, verify every hit, and rerun scans regularly. The piece also notes that static analysis can reveal secrets such as API keys left in git history, including a deactivated AWS key found with Gitleaks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Remote Teams Can Choose the Right Online Whiteboard Tool

Online whiteboards have replaced physical walls for remote and hybrid teams, supporting brainstorming, retrospectives, diagrams and design work. The article argues that tools look alike in demos, so differences only emerge after weeks of real use with large boards and many participants. It recommends first listing the main situations where a team will use a whiteboard, then ranking them to decide which trade-offs are acceptable. Teams should test the canvas with realistic content, including performance on large boards, text handling, connectors, frames and recovery options. Collaboration features such as cursors, facilitation tools, guest access and asynchronous commenting also deserve trial sessions before a decision is made.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Researcher Claims Flaw in Vaani Voice AI Let Him Hijack Agents Across Tenants

A security researcher describes finding a flaw in Vaani, a voice AI agent platform that won Product Hunt's top daily spot, at a company hackathon. He says a single HTTP request from a free account could take over AI agents belonging to other customers, redirecting their outbound calls to read attacker-supplied prompts. The issue reportedly stemmed from predictable agent identifiers that were not properly protected by access controls. The researcher says he demonstrated the hijack without accessing private data and that the vendor has since patched the problem. The account highlights risks in multi-tenant voice AI systems that place outbound phone lines under automated agent control.

0 comments Read more at DEV Community