Act now:SP Page Builder CVE-2026-48908: Exploited Joomla RCE. Owners, agencies and hosts of Joomla sites that run JoomShaper's SP Page Builder below 6.6.2, and anyone who updated late and never checked for web shells or rogue Super Users.
Check exposure:iCagenda CVE-2026-48939: Exploited Joomla Upload-to-RCE. Owners of Joomla 6 sites (6.0.0 to 6.1.1) that ran iCagenda 4.0.7 or earlier at any point since June 15, 2026, and agencies managing fleets of Joomla sites.
Do you run any of these? LiteSpeed cPanel Plugin, Cisco Catalyst SD-WAN Manager. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-06-18.
npm: 5 critical advisories (electron, @vitest/browser, vite-plus, remotion, youtransfer). Check with npm audit (or: npm ls <package>).
Any Joomla site still on SP Page Builder 6.6.1 or older should be updated today and treated as compromised, because automated attacks have been planting web shells and admin accounts since June.
Must act: Owners, agencies and hosts of Joomla sites that run JoomShaper's SP Page Builder below 6.6.2, and anyone who updated late and never checked for web shells or rogue Super Users.
Can relax: Joomla sites without SP Page Builder, and sites that moved to 6.6.2 or later before exploitation began and have since confirmed no unknown admins or PHP files.
Check the SP Page Builder version on every Joomla site in the administrator's Extensions: Manage screen.
Update to the current SP Page Builder (6.10.0 as of Oct 21, 2026), at minimum 6.6.2; unpublishing the component does not close the hole.
Audit the Super Users group and delete administrator accounts your team did not create.
Only Joomla 6.0.0-6.1.1 sites running iCagenda before 4.0.8 were open to web shells; those sites need a web-shell hunt, while everyone else on iCagenda simply updates.
Must act: Owners of Joomla 6 sites (6.0.0 to 6.1.1) that ran iCagenda 4.0.7 or earlier at any point since June 15, 2026, and agencies managing fleets of Joomla sites.
Can relax: Sites that do not use iCagenda; Joomla 3, 4 and 5 sites, where core already blocked the malicious upload (update anyway for the guest-submission and later SQL injection fixes).
Check every Joomla site for iCagenda and note both the iCagenda and Joomla versions.
Update iCagenda to 4.0.13 or later (Joomla 4-6) or 3.9.16 or later (Joomla 3), and update Joomla 6 sites to the latest Joomla 6 release.
On Joomla 6 sites that ran iCagenda 4.0.7 or earlier after June 15, inspect images/icagenda/frontend/attachments/ for PHP files and treat any as a web shell.