Australia Alerts Organizations to Ongoing CMS Exploitation Attacks
2026-07-13T08:51:43Z•2379836bf3082666953e16d317919b80be6322216f17ab793f3f81f26f8a3cb5
Balbooa FormsCISA KEVCMS exploitationGitHubJoomlaProgress SoftwareRATsRyukShareFileU-BootWordPressZimbracryptominersiCagendaincident responseknown exploited vulnerabilitiesmalicious Go packagesransomwareransomware statisticssecure bootstealersstored XSSsupply-chain malwarewebshells
What happened
Feed highlights multiple active and high-impact threats: Australia warns of a global CMS-exploitation campaign (WordPress, Joomla and other sites) where attackers deploy webshells; CISA added iCagenda and Balbooa Forms flaws to its Known Exploited Vulnerabilities catalog; Binarly disclosed six critical U-Boot bootloader vulnerabilities that can undermine secure boot across many embedded devices; Zimbra released an urgent fix for a critical stored-XSS in its Classic Web Client (no CVE assigned yet); Progress urged ShareFile Storage Zone customers to disconnect internet-facing servers due to a “
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 2379836bf3082666953e16d317919b80be6322216f17ab793f3f81f26f8a3cb5
- Enrichment time
- 2026-07-13T08:51:43Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.