---
title: "Security digest: July 9, 2026"
url: https://erroneo.us/security/2026-07-09/
description: "July 9, 2026 vulnerability digest: 1 brief (Balbooa Forms CVE-2026-56291: Exploited Joomla…); 3 critical advisories (Composer (PHP)). What to patch and who…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-07-09
date_modified: 2026-09-29
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: July 9, 2026

1 editorial brief and 3 critical advisories.

## Take stock

- Check exposure: Balbooa Forms CVE-2026-56291: Exploited Joomla Upload RCE . Anyone who runs or maintains Joomla sites with the Balbooa Forms extension (com_baforms), including agencies looking after many client sites.
- Composer (PHP): 3 critical advisories ( yeswiki/yeswiki ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [Balbooa Forms CVE-2026-56291: Exploited Joomla Upload RCE](https://erroneo.us/security/briefs/balbooa-forms-joomla-file-upload-cve-2026-56291/index.md): Only Joomla sites running Balbooa Forms are at risk, but for them this is an emergency: an unauthenticated web-shell upload exploited before the patch, followed by more pre-auth bugs, so update to 2.4.3.4 or later and hunt for shells.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-52778](https://erroneo.us/security/cve/CVE-2026-52778/index.md) YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service — Composer (PHP) yeswiki/yeswiki < 4.6.6 → 4.6.6
- [CVE-2026-52777](https://erroneo.us/security/cve/CVE-2026-52777/index.md) YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize — Composer (PHP) yeswiki/yeswiki < 4.6.6 → 4.6.6
- [CVE-2026-52766](https://erroneo.us/security/cve/CVE-2026-52766/index.md) YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action — Composer (PHP) yeswiki/yeswiki < 4.6.6 → 4.6.6

---
Source page: https://erroneo.us/security/2026-07-09/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt