China-Linked Hackers Exploit Roundcube Flaws at US, Canadian Universities

A China-aligned threat group exploited patched Roundcube vulnerabilities (CVE-2024-42009, CVSS 9.3) to steal credentials from physics and engineering departments at US and Canadian universities. The campaign targeted open-source webmail software, highlighting ongoing risks to academic institutions. Patches were available before the attacks, underscoring the importance of timely updates.