Roundcube Webmail flaw CVE-2026-48842 lets attackers access all tenants' mail data

·1 views

A pre-authentication SQL injection vulnerability, CVE-2026-48842, was discovered in the Roundcube Webmail virtuser_query plugin, affecting versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The flaw allows attackers to bypass input filtering using crafted backslash sequences, executing malicious SQL queries without any credentials or user interaction. On shared hosting environments, where a single database account serves multiple tenants, the vulnerability can expose email records, invoices, and sensitive correspondence belonging to all users on the platform. The Canadian Centre for Cyber Security confirmed the vulnerability has been exploited in the wild, and it carries a CVSS score of 8.1. Roundcube released patches on 24 May 2026, and administrators are urged to upgrade immediately, restrict database privileges, and disable virtuser_query where virtual user mapping is not needed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

WClickHouse Adds Zero-Copy Apache Arrow Support for Faster Python Analytics

WClickHouse, an open-source Python library, has introduced zero-copy columnar data transfer between Apache Arrow and ClickHouse via new insert_arrow() and query_arrow() methods. The integration eliminates row-by-row serialization, a major bottleneck in Python analytics pipelines that causes high RAM usage and garbage collector pauses. Data in Arrow or Parquet format can now be streamed directly to ClickHouse over a socket without duplication in Python's heap. The library is compatible with Python 3.9 through 3.14 and supports Apache Arrow alongside Pydantic v2. It has been tested against live ClickHouse instances with over 95% test coverage and is available on GitHub and PyPI.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds CLI Tool That Uses AI to Generate Git Commit Messages

A software developer has created an open-source command-line tool called cmt-cli that uses OpenAI's API to automatically generate Git commit messages from staged changes. The tool addresses the common developer pain point of deciding on commit types and writing meaningful descriptions for every code change. Users install it via PyPI, configure an OpenAI API key, stage their changes, and run 'cmt suggest' to receive an AI-generated message for review or editing. The developer intentionally kept the human in the loop, allowing the final commit message to be reviewed or modified before use. Planned improvements include better handling of large diffs, custom commit rules, and support for additional AI providers beyond OpenAI.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

WClickHouse Adds Zero-Copy Arrow Integration for Faster Python Analytics

An open-source Python library called WClickHouse has introduced Apache Arrow-based zero-copy columnar data transfer to ClickHouse databases. The library's insert_arrow() and query_arrow() methods allow developers to stream millions of rows directly without Python row iteration or JSON serialization overhead. This approach addresses common bottlenecks in data engineering pipelines, including high RAM usage, garbage collection pauses, and slow object conversion. The project supports Python versions 3.9 through 3.14 and is built with Apache Arrow and Pydantic v2. It is available on both GitHub and PyPI and claims over 95% test coverage verified against live ClickHouse instances.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agent Circuit Breakers: How Runaway LLM Loops Are Draining Enterprise Budgets

Autonomous AI agents deployed without proper safeguards can enter infinite retry loops, causing API costs to spiral exponentially as each failed attempt expands the LLM context window. A real-world example illustrates how a single CAPTCHA encounter during a weekend staging run generated a $542 bill through unchecked recursive retries. An AI agent circuit breaker is an architectural pattern that monitors token consumption, tracks execution depth, detects runaway loops, and triggers fallbacks to human operators before costs escalate. Unlike traditional software retries that cost fractions of a cent, generative AI retries grow costlier with every iteration due to accumulating context. As autonomous agentic workflows scale through mid-2026, experts warn that ignoring state management in favor of prompt engineering alone is a leading driver of the $45,000–$250,000 average first-year cost overruns seen in enterprise AI deployments.

0 comments Read more at DEV Community