Daily briefing · July 9, 2026
VulnCheck Flags Active Exploitation of Critical Joomla RCE Before CISA; 29 Critical CVEs Published
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — attention1 seen before CISA
July 9, 2026 demands attention: VulnCheck recorded active exploitation of a CVSS 10.0 unauthenticated remote code execution flaw in the Balbooa Forms Joomla extension before any official CISA acknowledgment — a signal defenders cannot afford to ignore. The day produced 262 new vulnerabilities, including 29 critical-severity entries spanning AI frameworks, business intelligence platforms, WordPress plugins, and enterprise hypervisors. While no weaponized exploits (ready-made tools) were confirmed, the active exploitation signal and the density of file-upload and authentication-bypass flaws make this a day requiring immediate triage.
Today’s brief
- CVE-2026-56291 (Balbooa Forms/Joomla, CVSS 10.0) is actively exploited — VulnCheck flagged it before CISA; unauthenticated RCE is confirmed.
- AI/LLM frameworks are in the crosshairs: Langroid (CVE-2026-54769) and Ruflo (CVE-2026-59726) both carry CVSS 10.0 sandbox-escape-to-RCE flaws.
- WordPress ecosystem hit hard: three critical plugins (Blocksy Companion, miniOrange OTP Login, Super Forms) expose arbitrary file upload or authentication bypass to unauthenticated attackers.
- Brazil remains a high-value ransomware target — qilin, incransom, and Doommageddon claimed new Brazilian victims this period across multiple sectors.
Critical highlights
1
CVE-2026-56291◆ VulnCheckCVSS 10affects balbooa.com Balbooa Forms extension for Joomla An unauthenticated attacker can upload executable files to a Joomla site running Balbooa Forms and achieve full remote code execution — no credentials required. This is the highest-priority item of the day: VulnCheck observed active exploitation before CISA confirmation, meaning real-world attacks are already underway and patch deployment cannot wait.
2
Langroid's TableChatAgent and VectorStore components attempt Python sandbox isolation but fail to prevent escape, allowing LLM-generated tool calls to execute arbitrary code on the host. Any deployment of Langroid versions before 0.65.2 that uses these agents with full_eval=True is fully exposed to RCE from attacker-influenced LLM output — upgrade immediately.
4
Metabase instances backed by an H2 database — including the default sample database shipped with the product — deserialize arbitrary Java objects from native query results without validation, enabling authenticated users with native query permissions to achieve RCE. Any Metabase deployment prior to the patched versions (1.58.15, 1.59.12, 1.60.6.3, 1.61.1.4) that allows H2 native queries should be treated as critically exposed.
5
The Blocksy Companion WordPress plugin (up to 2.1.46) validates font file uploads using a substring match instead of a proper extension check, meaning an attacker can smuggle a webshell by embedding .woff2 or .ttf in the filename and achieving unauthenticated arbitrary file upload. Sites with this plugin active should update to a patched version and audit recently uploaded files.
6
CVE-2026-14245CVSS 9.8affects miniOrange OTP Login, Verification and SMS Notifications The miniOrange OTP Login plugin (up to 5.5.1) skips server-side verification of OTP completion entirely, relying only on a publicly obtainable form nonce — any unauthenticated visitor can bypass authentication and take over administrator accounts. This is a complete authentication control failure with trivial exploitability, making it an extremely attractive target for mass scanning.
7
Inrove Software's BiEticaret e-commerce platform (before v3.3.57) is vulnerable to SQL injection, enabling attackers to read, modify, or exfiltrate the underlying database. SQL injection at this severity level in an e-commerce context typically means customer PII and payment-related data are directly at risk.
8
Super Forms' unauthenticated AJAX handler for form submission (nopriv) lacks file type validation and can be reached with a session nonce freely obtainable by any visitor, enabling unauthenticated arbitrary file uploads on all WordPress sites running version 6.3.313 or earlier. This is a straightforward path to webshell deployment on exposed WordPress installations.
9
Xerte Online Tools allows an attacker to replace the antivirus binary path in server settings with a PHP interpreter, then upload PHP content that is subsequently executed as server-side code — a classic RCE via misconfiguration escalation. Any Xerte instance accessible to untrusted users or exposed to the internet should be patched and audited for tampered server settings.
10
This XAPI vulnerability (CVSS 9.4) affects the Role-Based Access Control layer of XenServer/XAPI, touching privilege boundaries for pool-admin and other roles. In virtualization environments, RBAC bypass can cascade into hypervisor-level compromise, affecting all hosted workloads — administrators should review the vendor advisory and apply available mitigations promptly.
Ransomware today
Ransomware activity targeting Brazil remained elevated in recent days, with three new victims claimed: S.J. Louis was listed by the qilin group, tecnocurva.com.br (Technology sector) by incransom, and Francisco Imóveis (Consumer Services) by Doommageddon. Over the past 30 days, lockbit3, ransomhub, and lockbit5 have led overall victim counts, with all three groups showing significant activity against Brazilian organizations specifically.
S.J. Louis BRqilin
tecnocurva.com.br BRincransom · Technology
Francisco Imóveis BRDoommageddon · Consumer Services
lockbit3 39ransomhub 35lockbit5 26thegentlemen 208base 20arcusmedia 19
Active groups & APTs
Several threat actor groups are being tracked as currently active or recently updated, including againstthewest, apt73, the Iran-linked blackshadow, dragonforce, fulcrumsec, and coinbasecartel. While no confirmed new victims are attributed to these groups in this cycle, their active status warrants monitoring — particularly apt73, which has previously been linked to Brazilian targets.
Brazil focus
Brazil continues to absorb a disproportionate share of ransomware pressure, with eight organizations listed as recent victims across a broad range of sectors: S.J. Louis (qilin), Francisco Imóveis in Consumer Services (Doommageddon), tecnocurva.com.br in Technology (incransom), redeplastrs.com.br in Manufacturing (Blackfield), Service IT in Business Services (worldleaks), tambasa.com (incransom), carvalima.com.br in Business Services (incransom), and flazio.com in Technology (apt73). The concentration of incransom activity alone — claiming three Brazilian victims — highlights a group with a clear regional focus that defenders in Brazil should prioritize.
S.J. Louisqilin
Francisco ImóveisDoommageddon · Consumer Services
tecnocurva.com.brincransom · Technology
redeplastrs.com.brBlackfield · Manufacturing
Service ITworldleaks · Business Services
tambasa.comincransom
carvalima.com.brincransom · Business Services
flazio.comapt73 · Technology
Today’s recommendation: Immediately patch or disable the Balbooa Forms Joomla extension given confirmed active exploitation, and treat all CVSS 10.0 AI-framework flaws (Langroid, Ruflo) as emergency updates if those technologies are in use. For the WordPress plugin vulnerabilities, run a rapid inventory of installed plugin versions and prioritize miniOrange OTP Login and Super Forms given their unauthenticated attack paths.
With active exploitation already observed and a high density of unauthenticated attack vectors published today, now is the moment to validate which of these vulnerable technologies are actually reachable in your own environment — because attackers are already scanning for them.New vulnerabilities surface every day — does your defense keep up? Get a free initial review of your attack surface.Meet the Autonomous AI Pentest Agent →Previous briefings
August 6, 2026 — 10 Active Exploits, 1 Weaponized in a Day: Critical Alert Across WordPress, SharePoint, SonicWall, and MoreAugust 5, 2026 — Cisco SD-WAN, MarkLogic, and PraisonAI Lead a Batch of Critical CVEs on a Calm Exploitation DayAugust 4, 2026 — Quiet Day Masks 10 Critical CVEs: RCE, Auth Bypass, and Stack Overflows in FocusAugust 3, 2026 — Adobe Campaign Classic and WAPT Server Hit by Multiple CVSS 10.0 VulnerabilitiesAugust 2, 2026 — Bouncy Castle Mass Patch Day: Six Critical CVEs Drop Alongside SQL Injection and Auth Bypass FlawsAugust 1, 2026 — WordPress Auth Bypasses and FreeRDP Heap Flaws Top a Calm Vulnerability DayJuly 31, 2026 — Calm Day Hides Critical Flaws: Hard-coded Keys, File Uploads, and Code Injection Dominate July 31July 30, 2026 — 32 Critical CVEs, No Active Exploitation: Azure Cosmos DB and IBM Products Lead a Heavy Patch DayJuly 29, 2026 — Cisco FMC Under Active Exploit, Joomla Gridbox Cluster Hits Critical Mass with Four CVEsJuly 28, 2026 — Quiet Day Hides Critical Vulnerabilities: IBM WebSphere, Apache Axis2, and Joomla Top the ListJuly 27, 2026 — CVE-2026-16812: VeloCloud Orchestrator Under Active Exploitation as Critical Flaws Pile Up Across Enterprise and WordPress StacksJuly 26, 2026 — Quiet Vulnerability Day as Brazil Faces Ransomware Wave From Multiple GroupsJuly 25, 2026 — CVSS 10.0 in SiYuan and Auth Bypass in OpenRemote Lead a Calm Day for New ExploitsJuly 24, 2026 — Three CVSS 10.0 Microsoft Cloud Flaws Lead a Calm but Notable Patch Dayview full archive →