Daily briefing · July 20, 2026
Calm CVE Day Masks 10 Critical Flaws Across Joomla, xrdp, and Supply Chain
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — calm
July 20, 2026 brought no actively exploited vulnerabilities and no confirmed weaponized exploits, keeping the day's verdict at calm — but the volume of critical-severity disclosures demands attention. Ten high-priority CVEs were published, spanning unauthenticated RCE in Joomla extensions, a confirmed npm supply-chain compromise, and privilege escalation paths in dotCMS and FreeScout. With 28 critical entries among 262 new CVEs, defenders should treat this as a window to patch before any of these flaws are armored by threat actors.
Today’s brief
- Two Joomla extensions (DJ-Classifieds and jDownloads) carry CVSS 10.0 unauthenticated file-upload-to-RCE flaws — expose nothing to the internet until patched.
- A confirmed supply-chain attack poisoned 18 versions of @beproduct/nestjs-auth on npm; any pipeline that pulled those versions may have had tokens harvested.
- xrdp's VNC-any mode heap overflow and Piwigo's PHP 8 installer injection round out a busy day for self-hosted open-source stacks.
- Brazil faces a ransomware surge: lockbit5, nova, qilin, and Doommageddon all claimed Brazilian victims recently across healthcare, tech, and education sectors.
Critical highlights
1
DJ-Classifieds for Joomla allows completely unauthenticated file uploads that lead directly to remote code execution — any public-facing Joomla site running this extension should be considered fully compromised until updated or removed.
2
jDownloads for Joomla carries the same CVSS 10.0 unauthenticated file-upload-to-RCE profile as CVE-2026-61424; the two Joomla flaws published the same day suggest a coordinated audit finding and both warrant immediate remediation.
3
Between May 11 and 22:56 UTC, 18 malicious versions of @beproduct/nestjs-auth (0.1.2–0.1.19) were pushed to npm via a compromised publish token; the postinstall hook targeted npm tokens and GitHub personal access tokens from developer machines, making any CI/CD pipeline that consumed those versions a potential credential-theft victim.
4
Network-AI's agent sandbox allowlist can be trivially bypassed because glob-matched rules are passed directly to /bin/sh -c, letting a compromised agent escape the intended control boundary — a critical gap in any multi-agent orchestration environment prior to version 5.9.1.
5
Crypt::Password through 0.28 uses Perl's built-in rand() for password salts, making all generated hashes cryptographically weak and potentially brute-forceable; any application storing passwords with this module should be considered at risk and salts should be regenerated.
6
xrdp versions 0.10.6 and earlier suffer a heap buffer overflow in VNC-any mode when processing crafted RFB color map messages from a malicious VNC server, a path to potential code execution on the xrdp host that should be patched before any internet-facing deployment.
7
Piwigo's installer accepts unsanitized POST parameters and writes them into PHP config files; on PHP 8+ the addslashes() safeguard is dead (get_magic_quotes_gpc() was removed), opening a direct PHP code injection path for any attacker who can reach an unfinished or re-exposed installer.
8
Red Hat OpenShift's Konnectivity proxy-server for hosted control planes started the agent-facing listener without certificate validation, allowing an unauthenticated remote attacker to join the routing pool and potentially proxy traffic inside the cluster — a serious lateral movement risk in multi-tenant environments.
9
FreeScout's public account-setup endpoint selects and overwrites any user account by invite hash alone, with no authentication required; an attacker who enumerates a valid hash can silently take over any invited account, including administrative ones.
10
A low-privileged dotCMS backend user can self-assign the CMS Administrator role through the ToolGroupResource and RoleAjax endpoints, then achieve RCE by uploading a crafted OSGi bundle — a complete privilege-escalation-to-code-execution chain affecting dotCMS 21.02 through 26.06.22-03.
Ransomware today
Ransomware activity targeting Brazil has been notably intense in recent days. LockBit5 alone claimed victims across technology (technicare.com.br, kenta.com.br), business services (guarnera.com.br, gruposelpe.com.br), manufacturing (grupoferrosider.com.br, limpebras.com.br), and education (uniplaclages.edu.br). Beyond LockBit5, groups including Doommageddon (Reni Farmácias Associadas, healthcare), unsafe (CCR Solutions, business services), qilin (PP+K), and nova (Jota Joias Premium, FMZ Tecnologia em Sistemas) have all registered Brazilian victims recently, confirming that multiple independent ransomware operations are actively targeting the country.
Reni Farmácias Associadas BRDoommageddon · Healthcare
CCR Solutions BRunsafe · Business Services
PP+K BRqilin
Jota Joias Premium BRnova · Consumer Services
technicare.com.br BRlockbit5 · Technology
FMZ Tecnologia em Sistemas BRnova · Technology
guarnera.com.br BRlockbit5 · Business Services
gruposelpe.com.br BRlockbit5 · Business Services
kenta.com.br BRlockbit5 · Technology
grupoferrosider.com.br BRlockbit5 · Manufacturing
limpebras.com.br BRlockbit5 · Manufacturing
uniplaclages.edu.br BRlockbit5 · Education
lockbit5 49lockbit3 39ransomhub 35thegentlemen 208base 20arcusmedia 19
Active groups & APTs
Several threat actors and APT groups have been flagged as recently active or updated in tracking systems. The Iran-linked group BlackShadow appears in monitoring feeds alongside coinbasecartel, kazu, kelvinsecurity, krybit, and apt73. No confirmed new victims have been attributed to these actors in the current period, but their presence in intelligence feeds suggests ongoing reconnaissance or preparation activity that defenders, particularly in sectors historically targeted by Iranian threat actors, should factor into their threat models.
Brazil focus
Brazil is facing one of its more concentrated ransomware pressure periods in recent memory, with at least eight Brazilian organizations newly listed as victims across healthcare, technology, business services, manufacturing, and education. LockBit5 is the dominant group in this wave and also leads the 30-day ranking with 49 Brazilian victims, followed by lockbit3 (39), ransomhub (35), thegentlemen (20), 8base (20), and arcusmedia (19). The breadth of sectors affected — from pharmacies and jewelry retailers to universities and industrial manufacturers — underscores that no vertical is out of scope for ransomware operators targeting Brazil.
Jota Joias Premiumnova · Consumer Services
CCR Solutionsunsafe · Business Services
Reni Farmácias AssociadasDoommageddon · Healthcare
PP+Kqilin
FMZ Tecnologia em Sistemasnova · Technology
guarnera.com.brlockbit5 · Business Services
gruposelpe.com.brlockbit5 · Business Services
kenta.com.brlockbit5 · Technology
Today’s recommendation: Prioritize patching the two CVSS 10.0 Joomla extension flaws (CVE-2026-61424 and CVE-2026-61900) and audit any CI/CD pipeline that may have consumed the poisoned @beproduct/nestjs-auth versions 0.1.2–0.1.19; also review xrdp deployments in VNC-any mode and dotCMS instances for the privilege-escalation-to-RCE chain before these vulnerabilities are weaponized.
With multiple unauthenticated RCE and privilege escalation paths published today alongside an active ransomware surge, now is the right moment to validate which of these assets are actually exposed in your environment before attackers do it for you.Knowing the flaw exists is half the job; the other half is knowing if it affects you. Start with a no-cost exposure test.Meet the Autonomous AI Pentest Agent →Previous briefings
September 20, 2026 — Dozens of Critical PoC Flaws Surface in Routers and Research Tools, But No Active Exploitation DetectedSeptember 19, 2026 — Calm Vulnerability Day Masks Serious Flaws in Routers, WordPress, and SuricataSeptember 18, 2026 — WordPress, IBM, and vm2 Flaws Anchor a High-Alert Day With 5 CVEs Already Under Active ExploitationSeptember 17, 2026 — Six CVSS 10.0 Azure Flaws Lead a Heavy Patch Day as Acronis Backup Plugin Faces Active ExploitationSeptember 16, 2026 — Cisco Infrastructure Flooded With CVSS 10 Flaws as VulnCheck Spots Active Exploitation Before CISASeptember 15, 2026 — Oracle Patch Tuesday Surge and Yonyou Active Exploitation Drive ATTENTION-Level AlertSeptember 14, 2026 — Cisco Secure Email Under Active Exploitation as 58 Critical CVEs SurfaceSeptember 13, 2026 — WordPress Plugin Flaw Leads Quiet Day With 8 Critical CVEs and No Active ExploitationSeptember 12, 2026 — WordPress Plugin Blitz: Nine Critical RCE and Takeover Flaws Disclosed on a Quiet Exploit DaySeptember 11, 2026 — GitLab Critical Zero-Day Under Active Exploitation Leads a Heavy Patch Day with 36 Critical CVEsSeptember 10, 2026 — Ten Critical CVEs Published on a Calm Threat Day as Brazil Faces Ransomware SurgeSeptember 9, 2026 — Three CVEs Already Exploited Before CISA Confirmation, Dual Check Point RCE and cPanel SQLi-to-Root Round Out a High-Alert DaySeptember 8, 2026 — Windows Under Active Exploit, ScreenConnect Zero-Day Detected Before CISA: September 8 Security BulletinSeptember 7, 2026 — 22 Critical CVEs Published on a Quiet Day, With Heavy Ransomware Pressure on Brazilview full archive →