Exploitation observed; activity peaked at 11 mentions and remains active
Immediate actions
Patch ollyo sp_page_builder systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Recommended action window: Immediate (within 24h)
NVD description
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-07-10. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
🚨 CVE-2026-48908 (CVSS 10.0)
A critical flaw in Joomla's SP Page Builder can enable unauthenticated file upload and potential RCE:
▪️Versions 1.0.0–6.6.1 affected
▪️Active exploitation reported
▪️Patched in 6.6.2
Censys observed 194,793 web properties loading the component.
Full advisory: https://bit.ly/3QW99gB #CensysARC#CVE202648908
Post summary
CVE-2026-48908 in Joomla's SP Page Builder is actively exploited via unauthenticated file upload leading to potential RCE, but a patch (6.6.2) is available to mitigate the issue.
Open directory find. Somebody left the full exploitation toolkit for CVE-2026-48908 (SP Page Builder for Joomla, unauth file upload to RCE, CVSS 10.0) sitting exposed on a single Contabo node in France (AS51167). Operator has been running it since at least 23 June 2026, last activity 2 July. Logs and version-stamped scripts on the box show at least five tool versions and three exploitation batches across that window. Maintained operation, not a one-off scan.
The bug. SPPB's asset.uploadCustomIcon task takes a ZIP with no auth and no CSRF token, then extracts it straight into a web-reachable path under the component media dir. Anything in the archive, PHP included, is live over HTTP the moment it lands. Hits every version 1.0.0 through 6.6.1. JoomShaper closed it in 6.6.2 by gating the upload behind admin auth. CISA added it to KEV on 7 July.
Campaign flow. Fingerprint sites running SPPB, throw unauthenticated upload attempts in parallel waves, drop a PHP file-manager webshell on whatever takes. Not a minimal backdoor, a standalone file manager: full filesystem access, command execution, upload/download, read on sensitive server files. This operator wants to stay. Result files on the server log hundreds of confirmed shells across academic, government-adjacent, and commercial Joomla sites in several ccTLDs.
The bit worth flagging. The shells land through a case-bypass chain, and it is the same one now showing up in the public PoCs for this CVE. The archive filter blocks lowercase .php but does not normalize case, so a mixed-case .PHP passes. Default Apache then serves .PHP as text, so they also drop a .htaccess (which the filter misses too) carrying AddType application/x-httpd-php .PHP to force execution. Practical consequence: a WAF that 403s the JCE wave paths will happily pass this one with a 200. If you patched JCE, wrote a WAF rule, and moved on, you are not covered here.
Fix. 6.6.2 or later, that is the only real fix. Then audit the iconfont dir, pull anything unexpected, and if you find a shell assume the host is compromised: rotate every credential on or reachable from that box and walk logs back to 23 June. Stopgap only: block unauth POSTs carrying task=asset.uploadCustomIcon.
Attribution. Single Contabo box (AS51167, FR), zero infra diversification, no espionage markers. Reads as opportunistic access collection, brokering or straight monetization of the compromised boxes. Strings and config patterns line up with a Turkish-speaking operator.
Hunt for:
- iconfont subdirs named ico + six random lowercase letters (icowvmlhh, icofcboxb), with PHP files under fonts/
- webroot dirs named neo_ + four random lowercase letters, e.g. /neo_abcd/fonts/
- PHP under fonts/ with any of .php .PHP .Php .pHp .php3 .php4 .php5 .php7 .pht .phtml .phar
- an unexpected .htaccess or .user.ini dropped inside fonts/ next to the PHP
- WAF/log signature: unauthenticated POST carrying task=asset.uploadCustomIcon
Big thanks to @Huntio.
Post summary
The report details the active exploitation of CVE-2026-48908 via a public exploitation toolkit, confirms widespread real‑world use, and provides patch guidance, highlighting that the vulnerability is severe and actively abused.
Daniel's Daily Threat Intel & CVE Briefing (from claude)
Tue 15 Jul 2026
Top of the stack: Microsoft's July Patch Tuesday (14 Jul) is the day's priority — a record ~570 Microsoft CVEs with two actively-exploited zero-days, both privilege-escalation bugs in identity infrastructure (AD FS and SharePoint). Patch those two first. In parallel, CISA added a decades-old Cisco IOS CSRF flaw (CVE-2008-4128) to KEV on 13 Jul after confirmed exploitation — audit legacy IOS management planes. Three items are flagged actively-exploited today.
1. CISA KEV / Actively Exploited (lead)
CVE-2008-4128 — Cisco IOS CSRF → arbitrary command execution. Added to KEV 13 Jul 2026; confirmed in-the-wild exploitation of an 18-year-old flaw in the IOS web management interface. So what: internet-exposed or poorly-segmented IOS device web UIs are being abused for command execution — disable the HTTP(S) server or lock it behind ACLs. (SecurityAffairs, SC Media)
CVE-2026-56155 — Microsoft AD FS EoP (CVSS 7.8), actively exploited. Local privilege escalation via insufficient access-control granularity in AD FS (see MS section). (ZDI)
CVE-2026-56164 — Microsoft SharePoint EoP (CVSS 5.3), actively exploited. Missing authentication for a critical function, network-reachable, no user interaction. (BleepingComputer)
Same-week KEV wave (7–10 Jul), all exploited — worth confirming remediation if in scope: Adobe ColdFusion path traversal → RCE (CVE-2026-48282); Langflow auth-bypass/IDOR (CVE-2026-55255) — noted as the first AI-agent platform added to KEV; and Joomla-ecosystem file-upload/access-control bugs (JoomShaper SP Page Builder CVE-2026-48908, Joomlack CVE-2026-56290, Balbooa CVE-2026-56291, iCagenda CVE-2026-48939). (The Hacker News, SecurityWeek)
2. Edge / Network Gear
Quiet in the strict 24–48h window aside from the Cisco IOS KEV item above (CVE-2008-4128) — treat that as the actionable edge item today. No newly-corroborated critical Fortinet/Palo Alto/Citrix/Ivanti/SonicWall advisories published in the last day; the recent SecurityWeek Fortinet/Ivanti critical set (FortiSandbox CVE-2026-25089 CVSS 9.8, Ivanti Sentry CVE-2026-10520 CVSS 10.0) dates to mid-June and should already be in your patch cycle.
3. Microsoft / Windows / Active Directory
Patch Tuesday, 14 Jul 2026 — largest on record. ~570 Microsoft-issued CVEs (≈621 counting all republished/third-party CVEs addressed); 59–63 rated Critical, ~48 of them RCE. (Tenable, ZDI)
CVE-2026-56155 — AD FS EoP (7.8), exploited. Local EoP; high value in federated-identity environments. Patch AD FS servers first.
CVE-2026-56164 — SharePoint EoP (5.3), exploited. Unauthenticated, network-based privilege escalation via missing auth — SharePoint remains under sustained attack (distinct from the CVE-2026-45659 RCE added to KEV on 1 Jul). Patch on-prem SharePoint immediately.
CVE-2026-50661 — BitLocker security-feature bypass, publicly disclosed (not yet exploited). Requires physical access to reach encrypted data — relevant to lost/stolen-device and evil-maid threat models.
So what: two of the three zero-days are identity/domain-compromise primitives — sequence AD FS and SharePoint ahead of the broader 570-CVE backlog.
4. Web / Cloud / DevOps
Adobe ColdFusion CVE-2026-48282 (path traversal → RCE) and Langflow CVE-2026-55255 (auth-bypass IDOR — authenticated users can execute other users' flows) are both actively exploited and in KEV as of this week. If you run ColdFusion or Langflow (LLM/agent app builder), patch now. (http://Threat-Modeling.com)
Adobe's July batch also included a ColdFusion CVSS 9.9 issue (not yet exploited) — standard-priority patch. (ZDI)
No fresh corroborated Kubernetes/critical supply-chain 0-day in the 24h window; ongoing npm/PyPI credential-stealer campaigns continue as background noise.
Watch / developing
Langflow's KEV entry signals attackers are now hunting AI-agent/LLM orchestration platforms as an access vector — inventory any internet-exposed Langflow/agent tooling. Also watch the sheer triage load from the 570-CVE Patch Tuesday: with 48 critical RCEs, expect rapid PoC development over the coming days beyond the three flagged zero-days.
Sign-off: 3 items flagged as actively exploited today (CVE-2026-56155, CVE-2026-56164, CVE-2008-4128), with a cluster of 4–6 additional exploited KEV entries from earlier this week still worth confirming as patched.
Sources:
CISA — CVE-2008-4128 Cisco IOS added to KEV (SecurityAffairs)
ZDI — July 2026 Security Update Review
BleepingComputer — July 2026 Patch Tuesday, 3 zero-days
Tenable — July 2026 Patch Tuesday analysis
The Hacker News — Adobe/Joomla/Langflow KEV additions
SecurityWeek — CISA urges patching ColdFusion, Langflow, Joomla
http://Threat-Modeling.com — CVE-2026-55255 Langflow IDOR
SC Media — CISA adds Cisco IOS flaw to KEV
Post summary
The briefing reports multiple CVEs currently being exploited in the wild, emphasizes patching priority for affected Microsoft, Cisco, Adobe, and other products, and highlights the urgency of addressing active attacks.
The post enumerates several CVEs with publicly available exploits, noting that CVE-2026-48908 is currently being exploited in the wild, but offers no patch or exploit code details.
🛡️ We added JoomShaper SP Page Builder vulnerability CVE-2026-48908, Langflow vulnerability CVE-2026-55255, & Joomlack Page Builder vulnerability CVE-2026-56290 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #InfoSec https://t.co/IsmhmuWqlr
Post summary
The post announces that three CVEs were added to the KEV catalog and urges readers to apply available mitigations, implying active exploitation in the wild.
CVE‑2026‑48908 is a critical unauthenticated arbitrary file upload vulnerability in Joomla SP Page Builder (≤6.6.1) that can lead to remote code execution; no exploitation or patch information is provided in this tweet.
The post lists three critical CVEs added to CISA’s catalog, confirms in‑the‑wild exploitation, provides partial PoC references, and notes vendor‑issued patches.
🪲🪲🪲 Siber Güvenlik Zaafiyet Bülteni #SiberGüvenlik#GüvenlikBülteni#Zafiyet: JoomShaper SP Page Builder - Yetkisiz Dosya Yükleme (Unrestricted File Upload)
CVE Kodu: CVE-2026-48908
Zafiyet Türü: Tehlikeli Türde Dosyanın Kısıtlamasız Yüklenebilmesi (CWE-434)
Fidye Yazılımı (Ransomware) Faaliyeti: Bilinmiyor
📌 Zafiyetin Özeti
#JoomShaper SP Page Builder üzerinde, tehlikeli dosya türlerinin yüklenmesini kısıtlamayan kritik bir zafiyet tespit edilmiştir. Bu güvenlik açığı, kimliği doğrulanmamış (unauthenticated) kullanıcıların sisteme rastgele dosyalar yüklemesine ve nihayetinde sunucu üzerinde zararlı PHP kodlarının çalıştırılmasına olanak tanımaktadır.
🛠️ Alınması Gereken Aksiyonlar
👉 Yama ve Güncelleme: Üretici tarafından yayınlanan güvenlik güncellemelerini ve hafifletici önlemleri (mitigations) ivedilikle test ve prod ortamlarınıza uygulayın.
👉 Risk ve Uyumluluk: CISA'nın BOD 26-04 (Risk Temelli Güvenlik Güncellemelerinin Önceliklendirilmesi) ve Adli Bilişim Triyaj Gereksinimleri yönergelerine uygun hareket edin.
👉 Erişim Kontrolü: İlgili varlıkların internete maruz kalma durumunu (internet exposure) değerlendirin ve yetkisiz dosya yüklemelerini engellemek için gerekli sıkılaştırmaları yapın.
👉 İzolasyon: Eğer bulut servisleri veya on-prem sistemler için geçerli bir yama veya hafifletici önlem henüz bulunmuyorsa, zafiyet giderilene kadar ürünün kullanımını durdurun veya dış ağ erişimini tamamen kısıtlayın.
Post summary
The bulletin reports an unrestricted file‑upload flaw (CVE‑2026‑48908) in JoomShaper SP Page Builder that lets unauthenticated users upload arbitrary PHP code, and it urges applying vendor‑released patches and mitigations.
O CAIS alerta a comunidade de segurança cibernética sobre a CVE-2026-48908 no SP Page Builder para Joomla, que permite execução remota de código. Mais informações: https://bit.ly/4weWtAI
Post summary
CAIS has alerted the cybersecurity community about CVE-2026-48908, a remote code execution vulnerability in SP Page Builder for Joomla, providing a link for additional details.
Se detectó una campaña de Defacement que explota las vulnerabilidades CVE-2026-48907, CVE-2026-48908 y CVE-2026-49049 en Joomla!, dirigida a portales institucionales de Ecuador.
Mas información: https://www.ecucert.gob.ec/wp-content/uploads/2026/07/Al-2026-037-Campana-de-Defacement-en-Portales-Institucionales-Basados-en-Joomla-en-Ecuador.pdf
#PorUnEcuadorCiberseguro@Arcotel_ec@CsirtCEDIA@CsirtEPN https://t.co/hvVTFt35KM
Post summary
A defacement campaign in Ecuador targeting Joomla! sites has been detected, actively exploiting CVE-2026-48907, CVE-2026-48908, and CVE-2026-49049.
CVE-2026-48908: 🚨 CVE-2026-48908 (CVSS 10.0) A critical flaw in Joomla's SP Page Builder can enable unauthenticated file upload and potential RCE: ▪️Versions 1.0.0–6.6.1 affected ▪️Active exploitation reported ▪️Patched in 6.6.2 Censys observed 194,793 web properties…
Post summary
The text announces a critical Joomla SP Page Builder flaw with a CVSS of 10.0, notes active exploitation in the wild, specifies a patch release, and provides detailed technical information.
Joomla Extension - http://joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
CVE: CVE-2026-48908
PT ID: PT-2026-51135
Vendor: Joomla (http://joomshaper.net)
Product: SP Page Builder extension for Joomla
CVSS: 10
Credits: Phil Taylor
Description:
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
References:
• https://dbugs.ptsecurity.com/vulnerability/CVE-2026-48908
• https://www.joomshaper.com/page-builder
PoC/Exploit: https://github.com/papageo75/CVE-2026-48908-PoC
#dbugs_vuln
Post summary
The post announces a critical RCE vulnerability in SP PageBuilder and shares a proof‑of‑concept exploit on GitHub, but does not report active exploitation or a vendor patch.
En esta tanda cubrimos tres vectores de explotación activa:
- wp2shell (CVE-2026-63030 y CVE-2026-60137, WordPress core): /wp-json/batch/v1 y parámetros REST
- SP Page Builder (CVE-2026-48908): tarea asset.uploadCustomIcon
- Helix3 (CVE-2026-49049): manejador AJAX com_ajax
Post summary
The post reports three CVEs with active exploitation vectors, detailing specific API endpoints and AJAX handlers used, but does not provide PoC code, exploits, patches, or debunking statements.
00:14 UTC: Thread live on @lyrie_ai.
CVE-2026-48908 added to CISA KEV: JoomShaper SP Page Builder
Post summary
The brief tweet states that CVE-2026-48908 for JoomShaper SP Page Builder has been added to the CISA KEV list, implying it is recognized as an actively exploited vulnerability.
00:03 UTC: Lyrie Sentinel flagged it.
CVE-2026-48908 added to CISA KEV: JoomShaper SP Page Builder
Post summary
CVE-2026-48908, affecting JoomShaper SP Page Builder, was flagged by Lyrie Sentinel and subsequently added to the CISA KEV list, indicating that the vulnerability is being actively exploited in the wild.
