Critical RCE Flaw in Roundcube Servers

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, more than 84,000 Roundcube servers exposed to a critical flaw, a Mexican education platform breached, exposing student data, and Dutch National Police try to scare straight Cracked users. A U.S. federal judge sentenced a Nigerian man for hacking into tax preparers. Marks and Spencer is partially back and United Natural Foods is still shipping on a limited basis. The British financial regulator disciplined four employees for sending data to personal email. SinoTrack GPS devices have feeble web panel security and Patch Tuesday.

See Also: On Demand | Global Incident Response Report 2025

More than 84,000 Roundcube webmail servers are exposed to CVE-2025-49113, a critical remote code execution vulnerability patched on June 1. The flaw affects Roundcube versions 1.1.0 through 1.6.10 – covering more than a decade of deployments – and arises from unsanitized $_GET['_from'] input, which allows PHP object deserialization and session corruption.

Security researcher Kirill Firsov discovered and disclosed the bug, detailing its exploitation to help defenders. Although the flaw requires authentication, attackers reportedly obtain credentials via cross-site request forgery, brute-force attacks or log scraping. An exploit was developed and sold shortly after the patch release.

Roundcube is commonly used in shared hosting platforms such as GoDaddy, Hostinger and OVH, as well as across government, education and tech sectors. Shadowserver scans show 84,925 vulnerable instances online, mostly in the U.S., India, Germany, France, Canada and the United Kingdom.

Hackers breached an education cloud platform used by public schools and universities across Mexico, putting personal data of more than one million students at risk, reported online newspaper Publimetro.

The platform, Servoescolar, serves at least 1,600 education centers.

Attackers reportedly accessed login credentials and private information, raising concerns about identity theft and further exploitation. Hackers shared screenshots and samples of the data online, including information such as identifying and contact data, recent photographs, academic history and payment history.

The attackers may have had prolonged access before detection. Officials have not confirmed the full extent of the breach.

Dutch National Police said they’ve pursued “various interventions” with 126 individuals residing across the Netherlands who maintained an account on the notorious online cybercrime marketplace called Cracked.

Early this year, an international law enforcement effort code-named “Operation Talent” disrupted Cracked and peer site Nulled, which collectively sported more than 10 million users. By April, Cracked claimed to be back in business.

Using information gleaned from the operation, Dutch police said they identified 126 Netherlands-based users, who have an average age of 20, with the youngest being just 11. Police sent personal letters or emails to many of them and held in-person conversations with 20 of the individuals. Police are passing evidence on eight individuals to public prosecutors, who will decide whether or not to prosecute them.

This isn’t the first time that police in the Netherlands have intervened directly with young cybercrime aficionados. Police said they emphasize the impact an individual’s actions can have on victims and also on themselves. Having a criminal record can make it impossible to pass a background check – required for many jobs – or obtain a mortgage (see: Stress Test: Police Visit Webstresser Stresser/Booter Users).

A U.S. federal judge sentenced Nigerian national Kingsley Uchelue Utulu to 63 months in federal prison for his role in a cybercrime ring that hacked into American tax preparation firms and stole personal data to file fraudulent tax and loan claims. Utulu and his co-conspirators used spear-phishing emails to breach systems of businesses in New York, Texas and other states, targeting customer tax records and identity information.

The group filed bogus tax returns seeking $8.4 million in refunds, ultimately receiving at least $2.5 million. They also stole nearly $820,000 through fraudulent claims under the Small Business Administration’s novel coronavirus-era disaster loan program. Utulu was arrested in the United Kingdom and extradited to the U.S. to face charges.

In addition to his 63-month prison sentence, Utulu must pay $3.68 million in restitution and forfeit nearly $300,000.

Multinational British retailer Marks & Spencer resumed taking online orders for select fashion items in England, Scotland and Wales, marking a step forward in its recovery from a cyberattack in April.

M&S suffered a data breach in April and admitted that customer data was stolen during the attack, suspected to involve DragonForce ransomware (see: Scattered Spider Linked to Marks & Spencer Hack).

The retailer estimates a $404.7 million hit to operating profits in the next fiscal year but aims to offset it through insurance claims and other cost-saving measures.

The hack was one of an apparent spring wave of ransomware attacks against British retailers. An incident at Co-op reportedly also included DragonForce ransomware. Harrods additionally detected an attack. The incidents amounted to a wake-up call, a government official said. Pat McFadden, minister for intergovernmental relations, said British businesses “must treat cybersecurity as an absolute priority” (see: Hacks of UK Retailers Are a ‘Wake-Up Call,’ Minister Says).

United Natural Foods, the largest health and specialty food distributor in the United States and Canada – and the main supplier for high-end supermarket chain Whole Foods – is shipping groceries “on a limited basis,” its CEO told investors Tuesday.

UNFI disclosed Monday it discovered unauthorized activity on parts of its IT systems that disrupted its ability to fulfill and distribute customer orders (see: Whole Foods Supplier Faces Cyberattack Disrupting Operations).

During an earnings call, CEO James Douglas refused to say what percentage of normal orders the company is able to fulfill. When asked whether UNFI can still move food from its distribution centers to the more than 30,000 locations it services, Douglas said it depends on the technology platform. “Some are further along on the recovery than others, but we are partnering with customers across the country and across our formats in various short-term modes to serve their needs as best as we possibly can,” he said. He also vowed to “look at every aspect of our defense, every aspect of how our tools are working and what may be necessary to bolster it going forward.”

Some Whole Foods supermarkets have already begun to experience some shortages. An internal email sent to employees of the Amazon-owned chain seen by TechCrunch instructed staff to limit discussions of the incident with customers. The “only single approved customer talking point” that Whole Foods employees can share with customers is that it is having “temporary supply challenges,” TechCrunch reported.

Britain’s Financial Conduct Authority, which regulates the country’s financial services firms, disciplined four employees for violating its “information and systems acceptable use” policy by sending “FCA data to personal email.”

As Financial News first reported, based on a Freedom of Information Act request submitted by the Conservative-leaning Parliament Street think tank, the FCA issued three first written warnings, and one final warning, to its own personnel for sending sensitive data to a personal email account. The warnings occurred from April 2022 to April 2023.

“We take any breaches of our email security policies seriously and have systems and controls in place to manage breaches of email security. Breaches can and do result in an investigation and can lead to disciplinary sanctions,” a spokesperson told Information Security Media Group. “We have had no such incidents which required disciplinary sanctions in the years 2023/24 and 2024/25.”

Two security vulnerabilities in GPS tracking devices made by Hong Kong manufacturer SinoTrack could allow unwanted parties to surveil users’ location – or even disable a car by cutting power to the fuel pump. The vulnerabilities affect every SinoTrack device, and there are no patches.

SinoTrack GPS devices are compact devices installed in vehicles, assets or even on pets. They’re used in fleet management, logistics and anti-theft solutions. Remote start is a feature of some devices.

The U.S. Cybersecurity and Infrastructure Security Agency said Tuesday the SinoTrack device management web panel is coded with a publicly-known default password and the setup process doesn’t force a change. A malicious actor could retrieve device identifiers to gain access to web panels using the default panel, a flaw tracked as CVE-2025-5484.

A hacker might not need to physically gain access to device numbers, since the other flaw, tracked as CVE-2025-5485, notes that web panel user names are restricted to device identifiers, which are 10 digits or less. “A malicious actor can enumerate potential targets by incrementing or decrementing from known identifiers or through enumerating random digit sequences,” CISA warned.

CISA said SinoTrack didn’t respond to outreach.

Microsoft’s latest Patch Tuesday includes fixes for 66 vulnerabilities, including two zero-days – one actively exploited and one publicly disclosed. Of the total flaws, ten are classified as critical, including eight remote code execution vulnerabilities and two privilege escalation bugs.

The actively exploited flaw, CVE-2025-33053, is a RCE vulnerability in Windows Web Distributed Authoring and Versioning. Discovered by Check Point Research, the bug was used by the Stealth Falcon APT group in an attempted cyberattack against a Turkish defense firm. Exploitation requires a user to click a crafted WebDAV URL.

The second zero-day, CVE-2025-33073, affects the Windows SMB client. The flaw allows attackers to escalate privileges to System via a malicious SMB script. Microsoft recommends updating immediately. Affected systems can mitigate the SMB flaw by enabling server-side SMB signing.

Other Stories From Last Week

With reporting from Information Security Media Group’s Mathew Schwartz in Scotland and David Perera in Northern Virginia.