Roundcube Releases Urgent Security Update to Fix Critical Bugs

Roundcube Webmail released urgent security update 1.6.14 that fixes eight critical vulnerabilities — including a pre-auth arbitrary file write via unsafe deserialization (the most severe), authentication bypass, IMAP injection combined with CSRF, SSRF, XSS, and multiple privacy bypasses — and urges administrators to update immediately, back up data, and verify package checksums.