Daily briefing · July 20, 2026
Calm CVE Day Masks 10 Critical Flaws Across Joomla, xrdp, and Supply Chain
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — calm
July 20, 2026 brought no actively exploited vulnerabilities and no confirmed weaponized exploits, keeping the day's verdict at calm — but the volume of critical-severity disclosures demands attention. Ten high-priority CVEs were published, spanning unauthenticated RCE in Joomla extensions, a confirmed npm supply-chain compromise, and privilege escalation paths in dotCMS and FreeScout. With 28 critical entries among 262 new CVEs, defenders should treat this as a window to patch before any of these flaws are armored by threat actors.
Today’s brief
- Two Joomla extensions (DJ-Classifieds and jDownloads) carry CVSS 10.0 unauthenticated file-upload-to-RCE flaws — expose nothing to the internet until patched.
- A confirmed supply-chain attack poisoned 18 versions of @beproduct/nestjs-auth on npm; any pipeline that pulled those versions may have had tokens harvested.
- xrdp's VNC-any mode heap overflow and Piwigo's PHP 8 installer injection round out a busy day for self-hosted open-source stacks.
- Brazil faces a ransomware surge: lockbit5, nova, qilin, and Doommageddon all claimed Brazilian victims recently across healthcare, tech, and education sectors.
Critical highlights
1
DJ-Classifieds for Joomla allows completely unauthenticated file uploads that lead directly to remote code execution — any public-facing Joomla site running this extension should be considered fully compromised until updated or removed.
2
jDownloads for Joomla carries the same CVSS 10.0 unauthenticated file-upload-to-RCE profile as CVE-2026-61424; the two Joomla flaws published the same day suggest a coordinated audit finding and both warrant immediate remediation.
3
Between May 11 and 22:56 UTC, 18 malicious versions of @beproduct/nestjs-auth (0.1.2–0.1.19) were pushed to npm via a compromised publish token; the postinstall hook targeted npm tokens and GitHub personal access tokens from developer machines, making any CI/CD pipeline that consumed those versions a potential credential-theft victim.
4
Network-AI's agent sandbox allowlist can be trivially bypassed because glob-matched rules are passed directly to /bin/sh -c, letting a compromised agent escape the intended control boundary — a critical gap in any multi-agent orchestration environment prior to version 5.9.1.
5
Crypt::Password through 0.28 uses Perl's built-in rand() for password salts, making all generated hashes cryptographically weak and potentially brute-forceable; any application storing passwords with this module should be considered at risk and salts should be regenerated.
6
xrdp versions 0.10.6 and earlier suffer a heap buffer overflow in VNC-any mode when processing crafted RFB color map messages from a malicious VNC server, a path to potential code execution on the xrdp host that should be patched before any internet-facing deployment.
7
Piwigo's installer accepts unsanitized POST parameters and writes them into PHP config files; on PHP 8+ the addslashes() safeguard is dead (get_magic_quotes_gpc() was removed), opening a direct PHP code injection path for any attacker who can reach an unfinished or re-exposed installer.
8
Red Hat OpenShift's Konnectivity proxy-server for hosted control planes started the agent-facing listener without certificate validation, allowing an unauthenticated remote attacker to join the routing pool and potentially proxy traffic inside the cluster — a serious lateral movement risk in multi-tenant environments.
9
FreeScout's public account-setup endpoint selects and overwrites any user account by invite hash alone, with no authentication required; an attacker who enumerates a valid hash can silently take over any invited account, including administrative ones.
10
A low-privileged dotCMS backend user can self-assign the CMS Administrator role through the ToolGroupResource and RoleAjax endpoints, then achieve RCE by uploading a crafted OSGi bundle — a complete privilege-escalation-to-code-execution chain affecting dotCMS 21.02 through 26.06.22-03.
Ransomware today
Ransomware activity targeting Brazil has been notably intense in recent days. LockBit5 alone claimed victims across technology (technicare.com.br, kenta.com.br), business services (guarnera.com.br, gruposelpe.com.br), manufacturing (grupoferrosider.com.br, limpebras.com.br), and education (uniplaclages.edu.br). Beyond LockBit5, groups including Doommageddon (Reni Farmácias Associadas, healthcare), unsafe (CCR Solutions, business services), qilin (PP+K), and nova (Jota Joias Premium, FMZ Tecnologia em Sistemas) have all registered Brazilian victims recently, confirming that multiple independent ransomware operations are actively targeting the country.
Reni Farmácias Associadas BRDoommageddon · Healthcare
CCR Solutions BRunsafe · Business Services
PP+K BRqilin
Jota Joias Premium BRnova · Consumer Services
technicare.com.br BRlockbit5 · Technology
FMZ Tecnologia em Sistemas BRnova · Technology
guarnera.com.br BRlockbit5 · Business Services
gruposelpe.com.br BRlockbit5 · Business Services
kenta.com.br BRlockbit5 · Technology
grupoferrosider.com.br BRlockbit5 · Manufacturing
limpebras.com.br BRlockbit5 · Manufacturing
uniplaclages.edu.br BRlockbit5 · Education
lockbit5 49lockbit3 39ransomhub 35thegentlemen 208base 20arcusmedia 19
Active groups & APTs
Several threat actors and APT groups have been flagged as recently active or updated in tracking systems. The Iran-linked group BlackShadow appears in monitoring feeds alongside coinbasecartel, kazu, kelvinsecurity, krybit, and apt73. No confirmed new victims have been attributed to these actors in the current period, but their presence in intelligence feeds suggests ongoing reconnaissance or preparation activity that defenders, particularly in sectors historically targeted by Iranian threat actors, should factor into their threat models.
Brazil focus
Brazil is facing one of its more concentrated ransomware pressure periods in recent memory, with at least eight Brazilian organizations newly listed as victims across healthcare, technology, business services, manufacturing, and education. LockBit5 is the dominant group in this wave and also leads the 30-day ranking with 49 Brazilian victims, followed by lockbit3 (39), ransomhub (35), thegentlemen (20), 8base (20), and arcusmedia (19). The breadth of sectors affected — from pharmacies and jewelry retailers to universities and industrial manufacturers — underscores that no vertical is out of scope for ransomware operators targeting Brazil.
Jota Joias Premiumnova · Consumer Services
CCR Solutionsunsafe · Business Services
Reni Farmácias AssociadasDoommageddon · Healthcare
PP+Kqilin
FMZ Tecnologia em Sistemasnova · Technology
guarnera.com.brlockbit5 · Business Services
gruposelpe.com.brlockbit5 · Business Services
kenta.com.brlockbit5 · Technology
Today’s recommendation: Prioritize patching the two CVSS 10.0 Joomla extension flaws (CVE-2026-61424 and CVE-2026-61900) and audit any CI/CD pipeline that may have consumed the poisoned @beproduct/nestjs-auth versions 0.1.2–0.1.19; also review xrdp deployments in VNC-any mode and dotCMS instances for the privilege-escalation-to-RCE chain before these vulnerabilities are weaponized.
With multiple unauthenticated RCE and privilege escalation paths published today alongside an active ransomware surge, now is the right moment to validate which of these assets are actually exposed in your environment before attackers do it for you.Knowing the flaw exists is half the job; the other half is knowing if it affects you. Start with a no-cost exposure test.Meet the Autonomous AI Pentest Agent →Previous briefings
August 6, 2026 — 10 Active Exploits, 1 Weaponized in a Day: Critical Alert Across WordPress, SharePoint, SonicWall, and MoreAugust 5, 2026 — Cisco SD-WAN, MarkLogic, and PraisonAI Lead a Batch of Critical CVEs on a Calm Exploitation DayAugust 4, 2026 — Quiet Day Masks 10 Critical CVEs: RCE, Auth Bypass, and Stack Overflows in FocusAugust 3, 2026 — Adobe Campaign Classic and WAPT Server Hit by Multiple CVSS 10.0 VulnerabilitiesAugust 2, 2026 — Bouncy Castle Mass Patch Day: Six Critical CVEs Drop Alongside SQL Injection and Auth Bypass FlawsAugust 1, 2026 — WordPress Auth Bypasses and FreeRDP Heap Flaws Top a Calm Vulnerability DayJuly 31, 2026 — Calm Day Hides Critical Flaws: Hard-coded Keys, File Uploads, and Code Injection Dominate July 31July 30, 2026 — 32 Critical CVEs, No Active Exploitation: Azure Cosmos DB and IBM Products Lead a Heavy Patch DayJuly 29, 2026 — Cisco FMC Under Active Exploit, Joomla Gridbox Cluster Hits Critical Mass with Four CVEsJuly 28, 2026 — Quiet Day Hides Critical Vulnerabilities: IBM WebSphere, Apache Axis2, and Joomla Top the ListJuly 27, 2026 — CVE-2026-16812: VeloCloud Orchestrator Under Active Exploitation as Critical Flaws Pile Up Across Enterprise and WordPress StacksJuly 26, 2026 — Quiet Vulnerability Day as Brazil Faces Ransomware Wave From Multiple GroupsJuly 25, 2026 — CVSS 10.0 in SiYuan and Auth Bypass in OpenRemote Lead a Calm Day for New ExploitsJuly 24, 2026 — Three CVSS 10.0 Microsoft Cloud Flaws Lead a Calm but Notable Patch Dayview full archive →