The Lyceum: Cyber Intelligence Daily — Jul 13, 2026

Today is a deadline day. CISA's clock on two maximum-severity Joomla flaws — both actively exploited, both rated 10.0 — expires today, and Australia's signals agency has confirmed what that urgency implies: someone is systematically dropping backdoors on unpatched content-management systems across the internet. Layered on top, Progress has told ShareFile customers to physically shut down internet-facing servers rather than wait for a patch, and a phishing crew accidentally left a live Microsoft 365 credential-theft operation exposed on a public server. The connecting thread is speed — defenders are being handed emergency timelines while attackers keep winning on the same soft targets: neglected plugins, exposed file servers, and identity systems that can be bypassed without ever cracking a password.

• CVE-2026-48939 — iCagenda for Joomla: actively exploited, in CISA KEV (remediation due today). Unauthenticated arbitrary file upload leading to remote code execution.
• CVE-2026-56291 — Balbooa Forms for Joomla: actively exploited, in CISA KEV (due today). Unauthenticated file upload to full server compromise.
• CVE-2026-56290 — Joomlack Page Builder: actively exploited, in CISA KEV, public exploit on Exploit-DB. Improper access control enabling RCE.
• CVE-2026-4769 — WAGO System I/O Field controllers: advisory public, no NVD score yet. Undocumented diagnostic interface grants unauthenticated remote full system compromise during boot.
• CVE-2026-11332 — ansible-core: patch tracking via Red Hat, no NVD score yet. Malicious role author can inject git config flags via src field for code execution on anyone running ansible-galaxy role install.
• CVE-2026-57828 — Phoca Downloads for Joomla: critical, authenticated file upload to RCE, no confirmed in-the-wild exploitation yet.

If you run a Joomla website with the iCagenda events calendar or Balbooa Forms contact plugin, stop reading and go patch. CISA added both to its Known Exploited Vulnerabilities catalog — the government's list of flaws confirmed to be under active attack — with a federal remediation deadline of today, July 13. (Your Joomla Patch Window Closed at Midnight — Two CVSS 10.0 Flaws Are Being Expl)

Both carry a CVSS score of 10.0, the maximum. iCagenda (CVE-2026-48939) and Balbooa Forms (CVE-2026-56291) share the same attack: an unauthenticated attacker — no account, no password, no prior access — can upload a PHP file and execute code on your server just by visiting a URL. Working exploit code for the related Joomlack Page Builder flaw (CVE-2026-56290) is already public on Exploit-DB, which means the barrier to attack is effectively zero.

What changes if organizations don't move: Joomla still sits underneath business portals, nonprofit sites, and regional government pages, so one forgotten extension becomes a foothold for malware, credential theft, or ransomware staging. The observable signal to watch is whether this shifts from opportunistic webshell drops into broader intrusions. If you run either extension, update or isolate the site now, then hunt for suspicious PHP files in writable directories and unexpected admin accounts. (Your Joomla Patch Window Closed at Midnight — Two CVSS 10.0 Flaws Are Being Expl)

When a vendor says "shut it down" instead of "install this patch," that's the cybersecurity equivalent of your mechanic refusing to drive the car out of the garage. Progress Software has told ShareFile Storage Zone Controller customers to take internet-facing servers offline while it investigates a credible security threat. (Progress tells ShareFile customers to pull the plug)

ShareFile is the software companies use to move sensitive files — HR records, legal documents, financial data — which means a problem here becomes an exposure problem fast. There is no clean public fix in the material available, which makes the shutdown instruction the entire story for now. (Progress tells ShareFile customers to pull the plug)

What determines where this goes: if Progress names a CVE or publishes indicators of compromise, this jumps from precautionary to urgent overnight, and any controller that stayed online becomes the incident. The signal to watch is the follow-up disclosure — was this a narrow scare, or the opening of a broader ShareFile vulnerability? (Progress tells ShareFile customers to pull the plug)

An attacker running three simultaneous Microsoft 365 credential-theft campaigns left a Python web server running on a public port with directory listing switched on — the digital equivalent of leaving the safe open in the lobby. (A Hacker Left the Lights On: Three Live Microsoft 365 Phishing Operations Expose)

The exposed server revealed two attack methods, according to The Hacker News. The first used Evilginx, a tool that acts as a man-in-the-middle proxy (think of a fake ATM that copies your card while you use it) to steal not just passwords but the session tokens that keep you logged in — bypassing multi-factor authentication entirely. The second used device code phishing, tricking victims into authorizing attacker-controlled devices via a legitimate-looking code. One campaign alone logged 218 captured accounts across 12 countries, 94% of them corporate mailboxes. (A Hacker Left the Lights On: Three Live Microsoft 365 Phishing Operations Expose)

The operational failure is a gift: defenders got a look at phishing-kit structure, lure templates, and victim logs. The grimmer lesson — session-token theft means MFA alone no longer protects Microsoft 365. Watch for whether Microsoft pushes hardened Conditional Access guidance in response to how routine this Evilginx technique has become. (A Hacker Left the Lights On: Three Live Microsoft 365 Phishing Operations Expose)

Nihon Kotsu, Japan's largest taxi operator, confirmed that unauthorized access led to a malware infection that temporarily disrupted its dispatch and reservation systems, per the @hackmanac_cybernews channel. The incident was observed July 11; no threat actor has been named and no data-exposure scale disclosed. (Japan's Largest Taxi Operator Hit by Malware, Dispatch Systems Disrupted)

What makes this matter is the sector. Taxi dispatch is a real-time operational system, where a cyberattack translates directly into stranded passengers and lost revenue — an outage isn't an inconvenience, it's the impact. Japan has weathered a run of attacks on logistics and transportation over the past 18 months, and this fits the pattern. The signal to watch: a formal Nihon Kotsu disclosure clarifying whether this was ransomware or a more targeted intrusion. (Japan's Largest Taxi Operator Hit by Malware, Dispatch Systems Disrupted)

The German CERT@VDE advisory for CVE-2026-4769 describes a scenario worth pausing on for anyone managing factory floors, utilities, or building automation. WAGO's widely deployed System I/O Field series controllers activate an undocumented internal diagnostic capability during their startup sequence — and for a brief window during boot, an unauthenticated remote attacker can reach internal system processes and achieve full system compromise. No credentials, no prior access. These devices run process automation, energy management, and smart-building control, where a compromised controller isn't a data breach but a potential physical-world event. Surfaced via @cvenotify at 08:23 UTC, with no English-language security press coverage at time of writing. Source: CERT@VDE Advisory VDE-2026-031 — German/English advisory. No English-language coverage confirmed at time of publication.

Today: a Joomla plugin surrendering root to anyone who visits a web page, a file server so dangerous its own vendor says unplug it, and a phishing crew that stole 218 corporate mailboxes and then forgot to close its own front door. The most quietly ominous item, though, is a trigonometry function that can now tell an attacker whether you're on Windows before it decides what to do to you — no bug, no patch, no consent, just the way Math.tanh rounds. Stay patched, stay paranoid, and reboot your Office apps.

Forward this to the friend who still has an old Joomla site "that nobody uses anymore" — they need to hear it before CISA's clock runs out.