Loading story…
Brazil's CTIR Gov warned that CVE-2026-48907 in the Joomla Content Editor (JCE) component is being actively exploited, with incident response and forensic work on compromised institutional websites uncovering new indicators of compromise tied to webshell deployment, unauthorized remote access, and persistence. The alert says outdated or unpatched JCE installations are at risk and links the activity to an ongoing campaign previously tracked in earlier notices.
The agency urged organizations to immediately apply vendor fixes, keep Joomla and JCE fully updated, and load the newly published IOCs and malicious file hashes into monitoring tools. It also recommended retrospective threat hunting, checking for unauthorized PHP files in upload and temporary directories, and reviewing historical web access logs for signs of exploitation and follow-on access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
During incident response and forensic analysis on compromised institutional websites, CTIR Gov identified new indicators of compromise linked to webshell deployment, unauthorized remote access, and post-exploitation persistence in attacks exploiting CVE-2026-48907 in Joomla Content Editor (JCE). The alert also urged organizations to apply vendor fixes, update Joomla and JCE, and hunt for the listed malicious files and hashes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FortiGuard Labs reported ongoing in-the-wild exploitation of **CVE-2026-48908**, a critical `CVSS 10.0` unauthenticated remote code execution flaw in the JoomShaper **SP Page Builder** extension for Joomla. The bug stems from an unrestricted file upload in the `asset.uploadCustomIcon` functionality that lets attackers upload and execute arbitrary PHP files, enabling full server compromise. Public proof-of-concept exploit code is available, and the vulnerability was added to CISA’s Known Exploited Vulnerabilities catalog after active abuse was confirmed. FortiGuard said exploitation has remained elevated, with **1,210 blocked attempts in 24 hours** and **15,626 over 7 days**, indicating sustained automated scanning of Internet-facing Joomla servers. The highest attack volumes were observed against organizations in **Poland, Turkey, Australia, and the United States**, with **Telecommunications/Carrier** and **Technology** among the most targeted sectors. Defenders were urged to upgrade to **SP Page Builder 6.6.2 or later**, restrict public access to Joomla administrative interfaces, block PHP execution in upload directories, and investigate for **web shells**, suspicious files, unauthorized administrator accounts, and other persistence because patching alone does not remove an existing compromise.
Jul 19, 2026
CISA added **CVE-2026-48907** to its Known Exploited Vulnerabilities catalog after reports of active exploitation against the Widget Factory **Joomla Content Editor (JCE)** plugin. The maximum-severity improper access control flaw lets unauthenticated attackers create new editor profiles and then upload and execute PHP code, resulting in remote code execution on vulnerable Joomla sites. The KEV update raised the catalog total to 1,622 entries and set a federal remediation deadline of **2026-06-19** under **BOD 26-04**. Vendor and media reporting said the issue affects JCE versions **1.0.0 through 2.9.99.4**, with fixes released in **2.9.99.5** and later, including **JCE Pro 2.9.99.6**. The JCE team also issued a free patch for older sites and warned that public exploit code is available, attacks are automated, and sites without public registration can still be targeted. Security reporting noted that applying the update blocks the initial access path but does not remove any persistence, web shells, or malware that attackers may already have deployed on compromised servers.
Aug 8, 2026
Attacks targeting **Joomla!** vulnerability `CVE-2023-23752` increased sharply after the flaw was disclosed and patched, with MBSD-SOC first observing exploitation attempts on February 18 and reporting a further rise through March. The bug is an improper access control issue in Joomla! webservice endpoints that affects versions `4.0.0` through `4.2.7`, allowing unauthorized API access and exposure of sensitive information; researchers warned that successful exploitation could lead to site compromise. MBSD-SOC said attack volume climbed notably after March 8 as proof-of-concept exploit code became publicly available, with most observed traffic originating from the United States and increased activity also seen from Japan and Singapore. The Joomla! Project rated the issue **Critical** and released fixes in version `4.2.8`; defenders were advised to upgrade affected systems and change passwords in the global configuration because exposed credentials and configuration data could aid follow-on compromise.
Aug 15, 2026