Roundcube Webmail servers under attack – Week in security with Tony Anscombe

ESET researchers found that the Winter Vivern APT exploited a zero-day XSS vulnerability (CVE-2023-5631) in Roundcube Webmail to target European governmental entities and a think tank via specially crafted emails; the issue was reported on Oct 12 and Roundcube released patches four days later, with organizations urged to update immediately.