Loading vulnerability…
CVE-2026-65883 is an unauthenticated PHP object injection vulnerability in the Aimy Captcha-Less Form Guard Joomla plugin affecting versions 18.0 through 20.0. The vulnerable code path is in the plugin’s form-validation handling, where the attacker-controlled clfgd field is base64-decoded, deobfuscated with a repeating-key XOR routine, and then passed to PHP unserialize() without signature validation, integrity protection, or class restrictions. Because the plugin renders the corresponding token on public forms and the token format is forgeable, an attacker can submit a crafted serialized payload through a forged clfgd value. On Joomla versions 3.9 through 5.2.1, the object injection can be chained through a Joomla core gadget chain involving FormattedtextLogger to achieve remote code execution as the web server user. Even where that specific gadget chain is unavailable, the flaw remains a PHP object injection issue and also permits complete bypass of the plugin’s captcha-based anti-spam protection.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository is a small standalone Python exploit for CVE-2026-65883 affecting Aimy Captcha-Less Form Guard <= 20.0 on Joomla. Structure is minimal: README.md documents the vulnerability and usage, requirements.txt lists requests/urllib3, and cve_2026_65883.py is the main exploit implementation. The Python script is not part of a larger exploitation framework. Core capability: unauthenticated web RCE. The exploit targets Joomla pages that expose the vulnerable hidden clfgd field. It requests likely form endpoints, parses HTML to extract the base64 ciphertext and known plaintext components (captcha field ID and honeypot/trap field), then reconstructs enough of the repeating-key XOR keystream to encrypt a malicious serialized PHP object. The payload is a Joomla gadget chain centered on Joomla\CMS\Log\Logger\FormattedtextLogger, designed to trigger during object destruction and write a PHP webshell to disk. The shell executes arbitrary commands from HTTP parameter c and includes the AIMY-SHELL marker for verification. The script supports both single-target and mass-scanning modes, uses threading for concurrent scans, and includes detection, exploitation, and optional cleanup logic. Based on the visible code and README, it probes multiple common Joomla paths, attempts exploitation automatically, reports shell URL and command output, and is operational rather than a mere detector. The exploit depends on the target exposing a vulnerable form and allowing the Joomla/PHP process to write the shell file into a web-accessible location.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated PHP object injection/deserialization vulnerability in Aimy Captcha-Less Form Guard that can lead to captcha bypass on all affected versions and remote code execution when chained with a suitable gadget, including Joomla core gadget chains on Joomla 3.9 through 5.2.1.
A remote code execution vulnerability in the Aimy Captcha-Less Form Guard plugin for Joomla caused by PHP object injection via a forged clfgd field, affecting versions 18.0 through 20.0.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.