July 13, 2026
- CISA added two maximum-severity (CVSS 10.0) Joomla extension flaws to KEV following zero-day exploitation. CVE-2026-48939 (iCagenda) and CVE-2026-56291 (Balbooa Forms) both allow unrestricted file upload leading to web shells; admins should update iCagenda to 4.0.8/3.9.15 and Balbooa Forms to 2.4.1 and hunt for rogue PHP files and admin accounts (The Hacker News, CISA). · Vulnerabilities & Exploits
in Russian Intelligence Turns IP Cameras and Routers Into a NATO Surveillance Grid