Libraesva ESG issues emergency fix for bug exploited by state hackers

Libraesva released an emergency update for its Email Security Gateway to fix CVE-2025-59689, a command-injection flaw exploitable via specially crafted compressed email attachments that can execute arbitrary shell commands as a non-privileged user; the vendor reports at least one confirmed exploitation by an actor believed to be a foreign hostile state and has deployed patches and automated IOCs and self-assessment checks for supported versions.