Joomla Zero-Day RCE, ShareFile Emergency Shutdown, RedHook ADB Abuse

Two Joomla extensions under active zero-day exploitation dominate the day. Balbooa Forms (CVE-2026-56291) and iCagenda (CVE-2026-48939) both carry CVSS 10.0 ratings for unauthenticated arbitrary file upload leading to remote code execution, both were exploited before patches shipped, and CISA added both to its Known Exploited Vulnerabilities catalog with a three-day federal remediation deadline. Unauthenticated RCE on a major CMS is a mass-exploitation target, and the KEV listing makes every unpatched instance a compliance problem as well as an exposure. Two CVSS 10 Joomla Extensions Under Active Zero-Day Exploitation, Added to CISA KEV

Progress Software forced a shutdown of ShareFile Storage Zone Controllers over a credible external threat, with no patches and no compromise confirmation yet. The March flaws that chain to unauthenticated RCE are the leading hypothesis, and until patches land, every controller is a liability. Progress Software Forces ShareFile Storage Zone Controller Shutdown Over Credible Threat

The RedHook Android RAT variant abuses wireless ADB to reach shell privileges without root, which makes unexpected developer options activity a detection signal worth logging. CISA's post-mortem of its own GitHub leak is the useful artifact: an 844 MB exposure sat public for six months, and the lessons on continuous secrets scanning, clean reporting channels, and credential rotation readiness apply to any organization.

Watchlist: audit Joomla deployments for both extensions, isolate Storage Zone Controllers until patched, and monitor Android fleets for wireless debugging activation without user intent.