Roundcube published 1.7.3 and 1.6.18 on August 9, security updates to its current and LTS branches. Both carry the same eleven security fixes, and the project recommends updating every production installation. For anyone running a hosting fleet, two details matter more than the list itself. The release notes carry no CVE identifiers. And cPanel, which ships Roundcube to hosting … Continue reading Roundcube Shipped Eleven Security Fixes Without a Single CVE Number