Active Exploitation of Two Joomla Extensions and Emerging Ransomware Automation
Active Exploitation of Two Joomla Extensions and Emerging Ransomware Automation
CISA has confirmed active exploitation of two Joomla extensions, iCagenda and Balbooa Forms, both vulnerable to unauthenticated PHP code execution. The vulnerabilities, tracked as CVE-2026-48939 and CVE-2026-56291, allow attackers to run code without credentials, creating immediate legal and operational risks for UK small businesses running Joomla websites. Australia’s cybersecurity agency flagged these as part of a coordinated campaign targeting CMS platforms. For businesses holding customer data, this represents…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.