html2text conversion script vulnerability

[bigworm]

I have several old versions of roundcube deployed for clients.  Recently two of them were compromised using this vulnerability.  My fault for not staying up to date, I think I even emailed myself the security update bulletin just never did it.

At any rate, the vulnerability was used to create an adware serving system.

My real question is this, contained in the adware directory are some large text files that I deduce the adware author used to rotate links etc., these files contain links to other compromised roundcube sites.

What would be the best way to go about the process of notifying these admins??

[bigworm]

wow no suggestions..

[rosali]

Please contact devs @ Roundcube - Mailing Lists