8 mincritical
Cyber Centre Daily Advisory Digest — 2026-07-10 (4 advisories)
The Canadian Centre for Cyber Security published four security advisories on 2026-07-10 covering critical vulnerabilities in Roundcube Webmail, Broadcom/VMware Tanzu products, Microsoft Edge, and Bitwarden Server. The most urgent advisory (AL25-007 Update 1) confirms ongoing exploitation of CVE-2024-42009 and CVE-2025-49113 in Roundcube Webmail, where attackers first obtain valid credentials via CVE-2024-42009 and then leverage CVE-2025-49113 (a Post-Auth RCE via PHP Object Deserialization) to achieve remote code execution. Both CVEs are listed in CISA's KEV catalog, and a proof-of-concept exists for CVE-2025-49113.
Sens:■ Immediate
Detection / Hunteropenrouter
What Happened
The Canadian government's cyber security agency issued four security warnings on July 10, 2026. The most serious warning is about Roundcube Webmail, a popular open-source email application, which has a critical security flaw that lets attackers run malicious code on the server after logging in. Attackers are actively exploiting a related vulnerability to steal login credentials first, then using those credentials to trigger the more serious flaw. A step-by-step guide showing how to exploit this has been published publicly, increasing the risk. Organizations running Roundcube Webmail should update to the latest version immediately and watch for suspicious login attempts. The agency also warned about security updates needed for several VMware products, Microsoft Edge, and Bitwarden password manager.
Key Takeaways
- CVE-2025-49113 is a critical Post-Auth RCE vulnerability in Roundcube Webmail via PHP Object Deserialization, affecting versions prior to 1.5.10 and 1.6.11, with a published proof-of-concept and confirmed ongoing exploitation.
- CVE-2024-42009 is being actively exploited to obtain valid Roundcube credentials, which can then be leveraged to exploit CVE-2025-49113; both CVEs are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
- Organizations should immediately update Roundcube Webmail to versions 1.5.10+ or 1.6.11+ (latest recommended: 1.6.17 or 1.7.2) and monitor for brute-force attempts.
- Broadcom/VMware released critical updates for multiple Tanzu Greenplum and RabbitMQ products; specific versions listed in advisory AV26-681.
- Microsoft Edge (prior to 150.0.4078.65) and Bitwarden Server (prior to 2026.6.2) also require immediate patching per advisories AV26-682 and AV26-683.
Affected Systems
- Roundcube Webmail versions prior to 1.5.10
- Roundcube Webmail versions prior to 1.6.11
- VMware Tanzu Greenplum Command Center - multiple versions
- VMware Tanzu Greenplum Data Copy Utility - versions prior to 2.9.5
- VMware Tanzu Greenplum on Kubernetes - versions prior to 1.1.2
- VMware Tanzu Greenplum MCP Server - version prior to 1.0.2
- VMware Tanzu Greenplum Streaming Server - multiple versions
- VMware Tanzu Greenplum Text - versions prior to 4.0.2
- VMware Tanzu RabbitMQ - multiple versions
- Open Source RabbitMQ - multiple versions
- Microsoft Edge Stable Channel - versions prior to 150.0.4078.65
- Bitwarden Server - versions prior to 2026.6.2
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2025-49113 | Roundcube Webmail (versions prior to 1.5.10 and 1.6.11) | Critical | Post-Auth remote code execution via PHP Object Deserialization, allowing authenticated attackers to execute arbitrary code on the server. |
| CVE-2024-42009 | Roundcube Webmail | Vulnerability exploited to obtain valid credentials, which can then be used to authenticate and exploit CVE-2025-49113; added to CISA KEV catalog. |
Attack Chain
- Initial Access: Attacker exploits CVE-2024-42009 to obtain valid Roundcube Webmail credentials
- Authentication: Attacker uses stolen credentials to authenticate to Roundcube Webmail instance
- Execution: Authenticated attacker exploits CVE-2025-49113 via PHP Object Deserialization to achieve remote code execution
- Post-Exploitation: Attacker may establish persistence, move laterally, or exfiltrate data from the compromised server
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules, queries, or signatures are provided in the article. The advisory recommends monitoring affected systems for signs of exploitation and brute-force attempts but does not include specific detection logic.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | If EDR is deployed on the Roundcube Webmail host, process execution anomalies (e.g., unexpected child processes from the web server process) may be visible. However, Roundcube is often deployed on Linux servers where EDR coverage may be limited. |
| Network Visibility | Medium | Network monitoring could detect brute-force authentication attempts against Roundcube and unusual outbound connections from the webmail server post-exploitation, but the initial exploitation occurs over standard HTTP/HTTPS. |
| Detection Difficulty | Moderate | Detecting the initial credential theft via CVE-2024-42009 requires application-level visibility. The RCE via CVE-2025-49113 occurs post-authentication, making it harder to distinguish from legitimate activity without behavioral baselining. Brute-force detection is straightforward if authentication logging is enabled. |
Required Log Sources
- Roundcube Webmail application logs
- Web server access logs (nginx/Apache)
- Authentication logs for Roundcube
- Linux system audit logs (auditd)
- Network flow data for the webmail server
- EDR telemetry from the Roundcube host
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for unexpected child processes spawned by the web server process (e.g., php-fpm, apache2, nginx) on Roundcube hosts, which may indicate successful exploitation of CVE-2025-49113 via PHP Object Deserialization. | EDR process telemetry, Linux auditd logs, syslog | Execution | Medium — legitimate administrative scripts or cron jobs may spawn child processes from the web server context. |
| Consider hunting for elevated authentication failure rates or brute-force patterns targeting Roundcube Webmail login endpoints, which may indicate attempts to obtain credentials via CVE-2024-42009. | Roundcube application logs, web server access logs, authentication logs | Initial Access | Low to Medium — legitimate users with forgotten passwords may generate some failures, but sustained patterns are distinguishable. |
| Consider hunting for unusual outbound network connections from the Roundcube webmail server that deviate from baseline behavior, which may indicate post-exploitation activity such as C2 communication or data exfiltration. | Network flow data, firewall logs, EDR network telemetry | Post-Exploitation | Medium — Roundcube may legitimately connect to external SMTP/IMAP servers; correlation with process telemetry is needed. |
| Consider hunting for PHP deserialization artifacts in web server logs, such as unusually long POST request bodies or serialized PHP objects in request parameters targeting Roundcube endpoints. | Web server access logs, WAF logs, network IDS | Execution | Low — legitimate Roundcube requests typically do not contain serialized PHP objects in parameters. |
Control Gaps
- WAF rules may not detect PHP Object Deserialization payloads without specific signatures for CVE-2025-49113
- Network-based detection alone cannot distinguish authenticated exploitation from legitimate webmail usage
- Without application-level logging in Roundcube, credential theft via CVE-2024-42009 may go undetected
- Linux server environments may lack EDR coverage compared to Windows endpoints
Key Behavioral Indicators
- Unexpected child processes spawned from the web server or PHP-FPM process on Roundcube hosts
- Sustained authentication failures followed by successful login from the same source IP
- Unusually large or structured HTTP POST bodies targeting Roundcube endpoints
- New or modified PHP files in the Roundcube web root directory after exploitation
- Outbound connections from the webmail server to previously unseen destinations
False Positive Assessment
Low — The advisory describes specific vulnerabilities with confirmed exploitation; detection of the described TTPs (PHP deserialization payloads, brute-force authentication, unexpected process execution from web server context) would have relatively low false positive rates when properly scoped to Roundcube Webmail environments.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Prioritize updating Roundcube Webmail to version 1.5.10+ or 1.6.11+ (ideally 1.6.17 or 1.7.2) on all affected systems without delay.
- Consider reviewing Roundcube Webmail installations for signs of prior exploitation, including examining application logs for anomalous authentication patterns and web server logs for suspicious POST requests.
- If applicable, consider implementing rate limiting on Roundcube authentication endpoints to mitigate brute-force attempts related to CVE-2024-42009.
- Consider applying the Broadcom/VMware Tanzu product updates referenced in advisory AV26-681, the Microsoft Edge update (AV26-682), and the Bitwarden Server update (AV26-683) according to your patch management priorities.
Infrastructure Hardening
- Evaluate whether network segmentation can isolate Roundcube Webmail servers from internal systems to limit lateral movement potential following exploitation.
- Consider deploying or tuning WAF rules to detect and block PHP Object Deserialization payloads targeting Roundcube endpoints.
- If supported by your infrastructure, consider implementing multi-factor authentication for Roundcube Webmail access to reduce the impact of credential theft via CVE-2024-42009.
- Consider enabling enhanced logging in Roundcube Webmail (e.g., authentication logs, application-level audit logging) if not already configured.
User Protection
- Consider deploying the latest Microsoft Edge update (version 150.0.4078.65 or later) to all endpoints via your browser management tooling.
- If your organization uses Bitwarden Server, consider updating to version 2026.6.2 or later and reviewing access controls.
- Evaluate whether users accessing Roundcube Webmail should be notified to report any suspicious authentication prompts or unexpected session terminations.
Security Awareness
- Consider incorporating information about the active exploitation of Roundcube Webmail vulnerabilities into existing security awareness communications for IT staff.
- If applicable, remind users to report any unexpected password reset emails or authentication failures that may indicate credential harvesting attempts.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping3 techniques
Tactic
Execution
Tactic
Credential Access
Tactic
