Daily Threat Briefing
← All briefings

Balbooa Forms for Joomla · iCagenda for Joomla · Flowise

DAILY THREAT INTELLIGENCE BRIEFING Date: 2026-07-11 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

EXECUTIVE SUMMARY

The most critical new developments today are two actively exploited file upload vulnerabilities in Balbooa Forms and iCagenda (both added to CISA KEV with a 2026-07-13 remediation deadline), a Metasploit module now available for a Flowise unauthenticated RCE (CVE-2026-41264), active exploitation of a critical authentication bypass in the Gitea Docker image, and an urgent advisory from Progress Software directing ShareFile Storage Zone Controller customers to shut down servers immediately over a credible external threat. Unit 42 has also published new research on The Gentlemen ransomware affiliate operation.

CRITICAL VULNERABILITIES

NEW

CVE-2026-56291 (Balbooa Forms — Joomla extension)

  • Affected products: Balbooa Forms for Joomla, all versions prior to the patched release
  • Severity: Critical (CWE-434, unrestricted file upload)
  • EPSS: Not yet scored
  • Technical detail: An unauthenticated attacker can upload arbitrary files, including PHP executables, through the Forms component. Successful exploitation results in full remote code execution on the web server. No authentication or user interaction is required, making this trivially weaponizable against any internet-facing Joomla installation running the plugin. The vulnerability class (CWE-434) is well understood and exploit code is typically straightforward to develop.
  • Exploitation status: Actively exploited in the wild — added to CISA KEV 2026-07-10.
  • Remediation: Apply the vendor patch immediately. CISA BOD 26-04 deadline for federal agencies is 2026-07-13. All organizations should treat this as urgent. Audit web roots for recently uploaded PHP files and review web server access logs for suspicious POST requests to Forms endpoints.

CVE-2026-48939 (iCagenda — Joomla extension)

  • Affected products: iCagenda for Joomla, all versions with the vulnerable file attachment feature
  • Severity: Critical (CWE-434, unrestricted file upload)
  • EPSS: Not yet scored
  • Technical detail: The file attachment feature in iCagenda allows upload of arbitrary files, including PHP scripts, which are then executable on the server. The attack path leads to PHP code execution and full server compromise. Like CVE-2026-56291, this requires no authentication and targets a common Joomla extension, broadening the potential victim pool across shared hosting and CMS-heavy European web infrastructure.
  • Exploitation status: Actively exploited in the wild — added to CISA KEV 2026-07-10.
  • Remediation: Apply the vendor patch immediately. CISA deadline 2026-07-13. Audit web roots for uploaded PHP files; consider temporarily disabling the file attachment feature if patching cannot be completed before the deadline.

CVE-2026-41264 (FlowiseAI — Flowise CSV Agent)

  • Affected products: Flowise versions 1.3.0 through 3.0.13
  • Severity: Critical (unauthenticated RCE)
  • EPSS: Not yet scored
  • Technical detail: The CSV Agent feature evaluates LLM-generated Python code without adequate sandboxing. An attacker with an API key holding chatflows:create permission — but without full Flowise authentication — can upload a crafted CSV file containing arbitrary Python code and achieve remote code execution as the Flowise server process. A Metasploit module (multi/http/flowise_auth_rce_cve_2026_41264) was published 2026-07-11, significantly lowering the barrier to exploitation. BSI has previously flagged Flowise in advisory WID-SEC-2025-2048 (updated 2026-07-10).
  • Exploitation status: No confirmed in-the-wild exploitation; public Metasploit module materially elevates risk. Treat as imminent.
  • Remediation: Upgrade Flowise beyond 3.0.13 immediately. Restrict API key issuance and audit existing keys. Isolate Flowise instances from the internet where possible.

CVE-2026-59792 (JetBrains IntelliJ IDEA)

  • Affected products: IntelliJ IDEA before 2026.1.4 and 2026.2
  • Severity: Critical (CVSS 9.6)
  • EPSS: Not yet scored
  • Technical detail: A path traversal vulnerability in project workspace ID handling allows code execution when a developer opens a maliciously crafted project. This is a supply chain-relevant attack vector: a threat actor who can deliver a poisoned project repository (e.g., via a compromised dependency, a social engineering lure, or a malicious open-source contribution) can achieve code execution on the developer’s workstation without further interaction. Developer IDE compromise is a high-value initial access vector.
  • Exploitation status: No active exploitation confirmed.
  • Remediation: Update IntelliJ IDEA to 2026.1.4 or 2026.2. Apply the same scrutiny to other JetBrains products; CVE-2026-59793 (TeamCity arbitrary file access via Perforce VCS, CVSS 8.8) was published simultaneously — update TeamCity to 2026.1.2.

CVE-2026-54088 (filebrowser — File Browser)

  • Affected products: filebrowser (gtsteffaniak fork) prior to 2.63.6
  • Severity: Critical (CVSS 9.3)
  • EPSS: 0.53 — high exploitation probability
  • Technical detail: A command injection vulnerability in the authentication hook shell substitution allows pre-authentication remote code execution. An unauthenticated attacker can inject shell metacharacters into the authentication hook, achieving arbitrary command execution on the host. The companion CVE-2026-54089 (CVSS 9.1, EPSS 0.34) allows authentication bypass via proxy auth header forgery. Both affect the same product and should be remediated together. File Browser is commonly self-hosted in developer and homelab environments but also appears in enterprise internal tooling.
  • Exploitation status: No confirmed exploitation; EPSS 0.53 indicates elevated probability.
  • Remediation: Upgrade to filebrowser 2.63.6 or later. Restrict network access to File Browser instances; do not expose to the internet.

ONGOING

  • CVE-2026-50656 (Microsoft Defender, RoguePlanet): patch released; verify Defender engine update on all endpoints, especially unmanaged and air-gapped systems.
  • CVE-2026-57026 / CVE-2026-57023 (Juniper Junos OS): patch required; disable SIP/TCP proxy inspection as interim measure.
  • CVE-2026-59827 / CVE-2026-59826 (Metabase, CVSS 9.9/9.1): patch required; restrict internet exposure and migrate from H2 database.
  • CVE-2026-52778 (YesWiki, CVSS 9.8, EPSS 0.56): upgrade to 4.6.6; disable Formula Calculator if delayed.
  • CVE-2026-54782 (CoreWCF, CVSS 10.0): upgrade to 1.8.1 or 1.9.1.
  • CVE-2026-50746 (Ubiquiti UniFi, CVSS 10.0): apply all UniFi firmware updates.
  • CVE-2026-48282 / CVE-2026-48316 (Adobe ColdFusion): actively exploited; patch or isolate immediately.
  • CVE-2026-55255 (Langflow): actively exploited; patch immediately.
  • CVE-2026-8037 (Progress Kemp LoadMaster): actively exploited; patch or isolate.
  • CVE-2026-46817 (Oracle E-Business Suite): actively exploited; patch immediately.

EUROPEAN ADVISORIES

BSI published multiple UPDATE advisories on 2026-07-10, all for previously reported items. No new (NEU) BSI advisories were published in the last 24 hours.

BSI updated advisories for GNU libc (WID-SEC-2026-1190, kritisch) covering file manipulation, denial of service, and unspecified attacks by unauthenticated remote attackers. Organizations running glibc-based Linux distributions should ensure distribution vendor patches are applied.

BSI published a consolidated batch of updates across more than 20 Linux Kernel advisories (hoch), spanning denial of service, privilege escalation, code execution, and memory corruption. Notable named vulnerabilities include Dirty Frag (WID-SEC-2026-1430) and Fragnesia (WID-SEC-2026-1530), both enabling local privilege escalation to administrator/root. Apply current distribution kernel updates.

BSI updated the Python advisory (WID-SEC-2022-0253, kritisch) covering arbitrary code execution. CVE-2026-15308 (Python html.parser DoS) was reported yesterday; upgrade to Python 3.15.0 or 3.16.0.

BSI updated the Flowise advisory (WID-SEC-2025-2048, kritisch): see CVE-2026-41264 in Critical Vulnerabilities above.

All other BSI updates in this batch are for previously reported Linux Kernel items with no material change.

ACTIVE THREATS AND CAMPAIGNS

NEW — The Gentlemen Ransomware Unit 42 published research on 2026-07-10 detailing The Gentlemen ransomware operation. The group operates an affiliate model and has grown rapidly. Full technical indicators and TTPs are available in the Unit 42 report. SOC teams should review the published IOCs and update detection rules accordingly. No specific European targeting has been confirmed, but the affiliate model broadens potential victim geography.

NEW — WP-SHELLSTORM WordPress Mass Backdooring Operation An exposed attacker-controlled server revealed an operation targeting over 1.4 million WordPress sites. The operation uses automated tooling to identify and backdoor vulnerable WordPress installations at scale. Activity logs and target lists were exposed for approximately three weeks. Organizations running WordPress should audit for unauthorized plugin installations, unexpected PHP files in the web root, and anomalous admin account creation.

NEW — Progress ShareFile Storage Zone Controllers — Credible External Threat Progress Software has directed all ShareFile customers using on-premises Storage Zone Controllers to shut down those Windows servers immediately, citing a credible external security threat. Affected accounts have been temporarily disabled by Progress. No CVE has been published at time of writing. Organizations using ShareFile on-premises should comply with the shutdown directive and monitor for indicators of compromise on affected servers and adjacent network segments.

STATUS CHANGE — Gitea Docker Image Authentication Bypass (Active Exploitation Confirmed) Attackers are actively exploiting a critical authentication bypass in the official Gitea Docker image, allowing impersonation of any user including administrators. Organizations running Gitea via Docker should verify their image version, apply available updates, and audit admin account activity and repository access logs immediately.

ONGOING — Helix vishing group targeting SharePoint environments: brief helpdesk staff; enforce Conditional Access blocking device code flow; monitor SharePoint audit logs. ONGOING — Forg365 AiTM PhaaS targeting Microsoft 365: enforce phishing-resistant MFA; review Conditional Access policies. ONGOING — GodDamn ransomware with PoisonX kernel driver: monitor for anomalous kernel driver loads; verify Secure Boot and Driver Signature Enforcement. ONGOING — GigaWiper destructive Windows backdoor: review endpoint telemetry for disk I/O anomalies and kernel driver loads. ONGOING — Injective Labs npm supply chain compromise: audit npm dependencies; review developer workstations for stealer indicators. ONGOING — Silver Fox / MODBEACON RAT using gRPC C2: review proxy logs for anomalous gRPC traffic patterns.

SECURITY NEWS AND CONTEXT

Progress ShareFile has directed customers to shut down on-premises Storage Zone Controller servers over a credible external security threat; no CVE has been assigned yet, and the situation is developing.

SANS ISC researchers identified a phishing technique using HTML comment stuffing to evade AI-based detection engines, representing a low-cost evasion method likely to spread across commodity phishing kits.

A former ransomware negotiator was sentenced to 70 months in prison for conspiring with BlackCat operators; separately, a Ryuk ransomware member pleaded guilty and faces up to 15 years, reflecting continued law enforcement pressure on ransomware ecosystems.

Heise Security reports that proposed German intelligence law reforms would repurpose the BSI as a supplier of offensive cyber capabilities for the BND and Verfassungsschutz, a significant policy development with implications for Germany’s national cybersecurity posture.

RECOMMENDED ACTIONS

  1. Patch or remove Balbooa Forms and iCagenda Joomla extensions immediately (CVE-2026-56291, CVE-2026-48939); CISA deadline 2026-07-13. Audit web roots for uploaded PHP files.
  2. Upgrade Flowise beyond 3.0.13 (CVE-2026-41264); restrict API key access and isolate from internet. Public Metasploit module makes exploitation trivial.
  3. Shut down ShareFile Storage Zone Controller servers per Progress Software directive; monitor affected servers and adjacent segments for compromise indicators.
  4. Update IntelliJ IDEA to 2026.1.4 or 2026.2 (CVE-2026-59792) and TeamCity to 2026.1.2 (CVE-2026-59793); warn developers against opening untrusted projects.
  5. Upgrade filebrowser to 2.63.6 (CVE-2026-54088, EPSS 0.53); restrict network access to File Browser instances.
  6. Audit Gitea Docker deployments for the active authentication bypass; apply available image updates and review admin account and repository access logs.
  7. Apply BSI-updated glibc patches and current Linux kernel updates; prioritize systems affected by Dirty Frag and Fragnesia local privilege escalation vulnerabilities.
  8. Review Unit 42 Gentlemen ransomware IOCs and update detection rules; audit WordPress installations for WP-SHELLSTORM backdoor indicators.
  9. Enforce phishing-resistant MFA and out-of-band verification for identity enrollment requests targeting Microsoft 365 (Helix vishing, Forg365 AiTM).
  10. Continue remediation of previously reported items: Metabase CVE-2026-59827/59826, YesWiki CVE-2026-52778, ColdFusion CVE-2026-48282/48316, Langflow CVE-2026-55255, Kemp LoadMaster CVE-2026-8037, Oracle EBS CVE-2026-46817, CoreWCF CVE-2026-54782, UniFi CVE-2026-50746.