erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: July 9, 2026

1 editorial brief and 3 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: Balbooa Forms CVE-2026-56291: Exploited Joomla Upload RCE. Anyone who runs or maintains Joomla sites with the Balbooa Forms extension (com_baforms), including agencies looking after many client sites.
  • Composer (PHP): 3 critical advisories (yeswiki/yeswiki). Check with composer audit.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2026-56291

Balbooa Forms CVE-2026-56291: Exploited Joomla Upload RCE

Only Joomla sites running Balbooa Forms are at risk, but for them this is an emergency: an unauthenticated web-shell upload exploited before the patch, followed by more pre-auth bugs, so update to 2.4.3.4 or later and hunt for shells.

Must act: Anyone who runs or maintains Joomla sites with the Balbooa Forms extension (com_baforms), including agencies looking after many client sites.

Can relax: Sites that do not use Joomla, and Joomla sites without Balbooa Forms installed.

  1. Inventory every Joomla site and check whether Balbooa Forms (com_baforms) is installed and at which version.
  2. Update Balbooa Forms to 2.4.3.4 or later; 2.4.1 fixes only this CVE and leaves later pre-auth bugs open.
  3. If you cannot update today, unpublish public forms that accept file attachments or disable the extension.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 3

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Composer (PHP) 3

Check: composer audit