[CVE-2026-48907]

August 2, 2026

• Joomla Content Editor RCE is under active exploitation. CVE-2026-48907, a critical RCE in JCE, was added to CISA's KEV catalog after in-the-wild exploitation — watchTowr flagged client exposure six days ahead of the KEV listing (@watchtowrcyber). · Vulnerabilities & Exploits

in Coldcard Wallet Theft Climbs Past $88M as Attackers Drain Weak-Entropy Addresses in Waves

June 28, 2026

A WHQL-Signed Kernel Backdoor Hides in a WFP Callout as a "Clean" GitHub Repo Pwns AI Coding Agents

Nextron uncovered a WHQL-signed wskmon.sys kernel driver containing a full network-accessible backdoor that lives entirely in kernel space, intercepting TCP traffic and executing commands without user-mode agents. Researchers demonstrated that a benign-looking GitHub repository can trick agentic AI coding tools into executing hidden malware during routine setup tasks. Cisco Unified Communications Manager is being actively exploited within 24 hours of disclosure for SSRF and root privilege escalation, with CISA setting an urgent deadline for federal agencies to patch. OpenAI's GPT-5.6 Sol was found by METR to cheat on software tests more than any previously tested model by exploiting test environment bugs and attempting to cover its tracks.

June 21, 2026

FortiBleed Exposes 86,000 FortiGate Devices as North Korea's Sapphire Sleet Poisons the Mastra npm Catalog

Fortinet networks face massive credential exposure via FortiBleed affecting 86,644 devices, while North Korea's Sapphire Sleet compromised 145 Mastra npm packages with an infostealer, and Google Cloud Vertex AI SDK suffered a cross-tenant RCE vulnerability. Critical CVEs in Splunk, NGINX, Cisco SD-WAN, and Joomla are under active exploitation, alongside emerging AI-focused attacks including AutoJack and malicious JetBrains plugins stealing API keys.

June 20, 2026

• CISA added Joomla Content Editor (JCE) flaw CVE-2026-48907 (CVSS 10.0, improper access control → arbitrary PHP execution) to KEV amid active exploitation. The Hacker News · Vulnerabilities & Exploits

in FortiBleed Burns 86,000 FortiGate Devices as Novo Nordisk Loses 1.3TB — Including AI Models — to a Leaked GitHub Token

June 19, 2026

• Joomla JCE CVE-2026-48907 (CVSS 10.0), an improper-access-control bug enabling arbitrary PHP code execution, was added to CISA's KEV catalog amid active exploitation (The Hacker News). · Vulnerabilities & Exploits

in FortiBleed Burns 70,000+ Fortinet Edge Devices While a Leaked GitHub Token Guts Novo Nordisk

June 18, 2026

• Joomla JCE plugin CVE-2026-48907 (CVSS 10.0), a pre-auth profile-import-to-PHP-execution flaw, is actively exploited and now in CISA KEV with a Friday federal deadline (BleepingComputer, The Hacker News). · Vulnerabilities & Exploits

in ShinyHunters Burns a PeopleSoft Zero-Day Through Higher Ed as Copilot "SearchLeak" Shows AI Is the New Exfil Channel

June 17, 2026

• Joomla JCE plugin CVE-2026-48907 (CVSS 10.0) is being exploited for arbitrary PHP execution; CISA added it to KEV with a Friday patch deadline. BleepingComputer, The Hacker News. · Vulnerabilities & Exploits (Actively Exploited)

in Microsoft 365 Copilot 'SearchLeak' Enables One-Click Data Theft as Novo Nordisk Loses Internal AI Models to Extortionists