🌏 ACSC CMS 18 CVEs, 🕵️ GitHub Ghost Recon, 📋 Joomla KEV Additions

The defining story is the ACSC alert on a global CMS exploitation campaign. ACSC Warns of Global CMS Exploitation Campaign, 18 CVEs Across WordPress, Craft CMS, Joomla, and Others lists 18 CVEs under active exploitation across WordPress, Craft CMS, MaxSite, MetInfo, and Joomla, and confirms many Australian SMBs are affected. The campaign deploys webshells for persistent access, then moves to credential theft, further malware, and lateral movement. The breadth of the list means the target set is every unmanaged website, not one product class.

The same CMS wave shows up in CISA's catalog. CISA KEV: Two New Joomla Extension Entries Added July 10, iCagenda and Balbooa Forms added CVE-2026-48939 and CVE-2026-56291, both unrestricted file uploads enabling unauthenticated remote code execution, with 20 new KEV entries across all vendors in the last 30 days. The exploit class is identical to the broader campaign, so Joomla deployments should audit every third-party extension, not just the named ones.

Datadog's technical analysis of the GitHub ghost-account campaign adds operational detail: more than 50 dormant profiles activated in one-to-three-week bursts, vibe-coded user agents that mimic legitimate tools, and an identity dark matter pattern where exposed tokens are used from dozens of accounts at once. Individual requests return normal HTTP 200 responses, so detection has to live in audit log streaming and aggregate anomaly analysis rather than per-request rules.

Watchlist: apply all CMS and plugin updates, remove unused components, make web directories read-only, and enable GitHub audit log streaming with user-agent and ASN baselining.