Daily Threat Briefing
← All briefings

SP Page Builder extension for Joomla · SP LMS · iCagenda extension for Joomla

DAILY THREAT INTELLIGENCE BRIEFING Date: 2026-06-21 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

EXECUTIVE SUMMARY

Today’s most significant new developments are two critical unauthenticated remote code execution vulnerabilities in widely deployed Joomla extensions (SP Page Builder and SP LMS), a North Korean supply chain attack against the Mastra AI npm ecosystem attributed to Sapphire Sleet affecting over 140 packages, and a new ransomware operation named Prinz Eugen with an unusual file-prioritization behavior. No new CISA KEV additions or BSI advisories were published in the last 24 hours. The CISA KEV deadline for CVE-2026-20253 (Splunk Enterprise) falls today — verify patch status immediately.

CRITICAL VULNERABILITIES

NEW

CVE-2026-48908 (SP Page Builder for Joomla)

  • Affected products: SP Page Builder extension for Joomla, versions 1.0.0 through 6.6.1
  • Severity: CVSS 10.0 (Critical)
  • EPSS: 0 (newly published; no exploitation data yet)
  • Technical detail: An unauthenticated attacker can upload arbitrary files, including PHP webshells, through the SP Page Builder component without any authentication. Successful exploitation results in full remote code execution on the web server. SP Page Builder is one of the most widely installed Joomla page-building extensions, making the attack surface broad. No authentication or special configuration is required; any internet-facing Joomla site running the affected versions is vulnerable.
  • Exploitation status: No confirmed in-the-wild exploitation reported. CVSS 10.0 and unauthenticated file upload to RCE make this a high-priority target for opportunistic attackers.
  • Remediation: Update SP Page Builder to version 6.6.2 or later immediately. Audit web server directories for recently uploaded PHP files. Review web server access logs for POST requests to SP Page Builder upload endpoints. Consider temporarily disabling the extension if patching is not immediately possible.

CVE-2026-48909 (SP LMS for Joomla)

  • Affected products: SP LMS (com_splms) by JoomShaper, versions 1.0.0 through 4.1.3
  • Severity: CVSS 9.5 (Critical)
  • EPSS: 0 (newly published)
  • Technical detail: The SP LMS component deserializes user-controlled cookie data without validation. An unauthenticated remote attacker can craft a malicious serialized PHP object in the cookie and trigger arbitrary code execution on the server. PHP deserialization vulnerabilities are well-understood and reliably exploitable when a suitable gadget chain exists in the application’s dependency tree. SP LMS is a learning management system extension used by educational institutions and enterprises across Europe.
  • Exploitation status: No confirmed in-the-wild exploitation. The unauthenticated attack vector and CVSS 9.5 rating warrant immediate action.
  • Remediation: Update SP LMS to version 4.1.4 or later immediately. If patching is delayed, consider disabling the component or blocking external access. Monitor for anomalous deserialization-related PHP errors or unexpected process spawning from the web server.

CVE-2026-48939 (iCagenda for Joomla)

  • Affected products: iCagenda extension for Joomla, versions 1.0.0 through 3.9.14 and 4.0.0 through 4.0.7
  • Severity: CVSS 10.0 (Critical)
  • EPSS: 0 (newly published)
  • Technical detail: An unauthenticated attacker can upload arbitrary files, including PHP code, via the file attachment feature in iCagenda. The vulnerability mirrors CVE-2026-48908 in class and impact: no authentication is required, and successful exploitation yields remote code execution. iCagenda is a popular event calendar extension used by public-sector and nonprofit organizations, including in Germany and across the EU.
  • Exploitation status: No confirmed in-the-wild exploitation. The CVSS 10.0 rating and unauthenticated nature make this a critical priority.
  • Remediation: Update iCagenda to version 3.9.15 or 4.0.8 or later. Audit upload directories for unexpected PHP files. Apply web application firewall rules to block file upload attempts to iCagenda endpoints as a compensating control.

CVE-2026-5366 (Prefect)

  • Affected products: Prefect workflow orchestration platform, version 3.6.23 and likely earlier versions up to latest
  • Severity: CVSS 9.9 (Critical)
  • EPSS: 0 (newly published)
  • Technical detail: The GitRepository storage class in Prefect passes the user-controlled commit_sha parameter to a git command without adequate sanitization, enabling remote code execution via command injection. Prefect is used in data engineering and MLOps pipelines; instances exposed to untrusted users or accessible via API without strict input controls are at risk. The near-maximum CVSS score reflects the broad impact and ease of exploitation.
  • Exploitation status: No confirmed in-the-wild exploitation reported.
  • Remediation: Upgrade Prefect to a version beyond 3.6.23 once a patched release is available. In the interim, restrict access to Prefect API endpoints to trusted users and networks. Validate and sanitize all user-supplied git parameters at the application layer.

ONGOING

  • CVE-2026-41679 (Paperclip AI): Weaponized Metasploit module; restrict network access and apply patches when available.
  • Gogs Authentication Bypass (TRA-2026-50): Disable reverse proxy auth or enforce network-level controls; no patch yet.
  • NTLM Relay-to-Self (Windows): Enable LDAP signing and channel binding; disable WebDAV client on workstations.
  • CVE-2026-4020 (Gravity SMTP WordPress): Actively exploited; update plugin and rotate all credentials immediately.
  • CVE-2026-20253 (Splunk Enterprise): CISA KEV deadline today (2026-06-21) — confirm patch is applied.
  • CVE-2026-42271 (LiteLLM): CISA KEV deadline 2026-06-22 — upgrade to v1.83.7-stable today.
  • CVE-2026-20262 (Cisco Catalyst SD-WAN Manager): Actively exploited; CISA KEV deadline 2026-06-29; patch immediately.
  • CVE-2026-0257 (Palo Alto PAN-OS GlobalProtect): Actively exploited; apply PAN-OS patches.
  • CVE-2026-5027 (Langflow): Actively exploited; isolate from internet.
  • CVE-2026-50751 (Check Point Security Gateway): Actively exploited; apply hotfix sk185033.

EUROPEAN ADVISORIES

No new BSI WID or CERT-EU advisories were published in the last 24 hours.

The three critical Joomla extension vulnerabilities detailed above (CVE-2026-48908, CVE-2026-48939, CVE-2026-48909) are directly relevant to European organizations. Joomla is widely deployed across German public-sector, educational, and nonprofit websites. BSI advisories covering these flaws are anticipated; organizations should not wait for formal BSI publication before patching.

Previously reported advisories remain active: WID-SEC-2026-2013 (Gogs), WID-SEC-2026-2014 (Webmin), WID-SEC-2026-2012 (HAProxy), WID-SEC-2026-2011 (ffmpeg), WID-SEC-2026-2009 (GKE containerd, unpatched), WID-SEC-2026-2004 (Node.js), and WID-SEC-2026-1991 (PTC Windchill, unpatched) — apply vendor patches per prior guidance.

ACTIVE THREATS AND CAMPAIGNS

NEW — Prinz Eugen Ransomware A new ransomware operation named Prinz Eugen has been identified. It exhibits an unusual behavioral characteristic: it prioritizes recently modified files for encryption, maximizing operational damage by targeting the most current and business-critical data first. Notably, it does not drop a ransom note on the compromised system, complicating initial incident identification and potentially indicating a destructive rather than financially motivated intent, or an evolving operational model. No confirmed attribution, IOCs, or sector targeting data are available at this time. Organizations should ensure offline or immutable backups are current and monitor for mass file modification events.

NEW — Sapphire Sleet (North Korea) Mastra AI npm Supply Chain Attack Microsoft has attributed a supply chain attack targeting the Mastra AI framework to Sapphire Sleet (also tracked as BlueNoroff), a North Korean threat actor with a history of financially motivated operations targeting cryptocurrency and technology sectors. More than 140 npm packages were compromised. Organizations using Mastra AI or dependent packages in development or production pipelines should audit their npm dependency trees immediately, check for unexpected package versions or maintainer changes, and review CI/CD pipeline logs for anomalous activity. Treat any system that installed affected packages as potentially compromised.

ONGOING — FortiBleed: CISA and NCSC advisories active; rotate credentials and enforce MFA on all Fortinet devices. ONGOING — Gentlemen RaaS / GentleKiller: EDR killer suite in active distribution; verify EDR tamper protection. ONGOING — DragonForce Ransomware: C2 via Microsoft Teams relay; review Teams relay traffic. ONGOING — Large-scale credential attacks on security vendor devices (Unit 42): enforce MFA on all perimeter device admin interfaces.

SECURITY NEWS AND CONTEXT

Sapphire Sleet npm supply chain attack: Microsoft’s attribution of the Mastra AI compromise to North Korean actors underscores the continued targeting of AI and developer tooling ecosystems; organizations should apply npm package integrity verification controls.

Gravity SMTP active exploitation: Threat actors are actively harvesting API keys and OAuth tokens from approximately 100,000 WordPress sites running the unpatched Gravity SMTP plugin; credential rotation remains the immediate priority for affected site operators.

RECOMMENDED ACTIONS

  1. Update SP Page Builder (CVE-2026-48908) and iCagenda (CVE-2026-48939) on all Joomla installations immediately; audit upload directories for PHP webshells.
  2. Update SP LMS to version 4.1.4 or later (CVE-2026-48909); monitor for deserialization-related anomalies on Joomla servers.
  3. Upgrade Prefect beyond version 3.6.23 (CVE-2026-5366); restrict API access to trusted networks in the interim.
  4. Audit all npm dependencies for Mastra AI packages; treat systems that installed affected packages as potentially compromised and review CI/CD pipeline logs.
  5. Investigate any Prinz Eugen ransomware indicators; verify offline or immutable backups are current and test restoration procedures.
  6. Confirm Splunk Enterprise patch is applied — CISA KEV deadline is today (2026-06-21).
  7. Upgrade LiteLLM to v1.83.7-stable today — CISA KEV deadline is 2026-06-22.
  8. Update Gravity SMTP WordPress plugin and rotate all SMTP credentials, API keys, and OAuth tokens if not already completed.
  9. Apply web application firewall rules blocking file uploads to Joomla extension endpoints as a compensating control where patching is delayed.
  10. Continue remediation of previously reported items: CVE-2026-20262 (Cisco SD-WAN, KEV deadline 2026-06-29), CVE-2026-42530 (NGINX), CVE-2026-0257 (PAN-OS), CVE-2026-5027 (Langflow), CVE-2026-50751 (Check Point), Gogs auth bypass, NTLM relay-to-self.