Today’s Field Note

Three separate confirmed-exploitation events landed at once, so triage accordingly. The Canadian Centre for Cyber Security flagged CVE-2026-48842, a pre-auth SQL injection in the Roundcube virtuser_query plugin (1.6.x before 1.6.16, 1.7.x before 1.7.1), being hit in the wild. CISA added two more to KEV on evidence of active attacks: CVE-2026-5430, a 9.8 path traversal in WSO2 API Control Plane, and an Adobe Commerce/Magento flaw. Meanwhile suspected North Korean actors drained $351.6M from Bitget hot and warm wallets after a backend compromise, a reminder that DPRK crews are still funding the regime through exchange infrastructure, not just phishing. None of this is theoretical today.

Today’s Action

  • Patch Roundcube to 1.6.16 or 1.7.1 immediately; if you cannot, disable the virtuser_query plugin and check webmail logs for anomalous SQL error patterns and auth bypass attempts.
  • Apply the WSO2 API Control Plane fix for CVE-2026-5430 and audit for path-traversal file reads; treat any internet-exposed WSO2 instance as a priority.
  • Patch Adobe Commerce/Magento per the KEV entry and hunt for webshells and unexpected admin accounts on storefronts.
  • Confirm both KEV items are logged against your BOD 22-01 remediation clock and report status.
  • If you touch exchange or custody infrastructure, review backend service accounts and hot-wallet signing paths for the Bitget compromise pattern.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

Patch the three that are already being used against you; admire the rest later.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.