Skip to dossier
Archived issue · 07-17-2026
View latest issue
← fruition.net
verified 1w ago
The Perimeter · Issue 07-17-2026

KEV floodgate opens on Joomla + ColdFusion; PHP + Drupal ship security releases

CISA added four exploited vulnerabilities this week that hit the surfaces Fruition operates: Joomla page builders (Balbooa Forms, SP Page Builder, Joomlack) with unauthenticated file-upload-to-RCE, and Adobe ColdFusion path traversal. If any of these are in your estate — even on legacy tenant sites — treat this as a shortest-path breach vector this week. The supply-chain side saw a PrestaShop ps_facetedsearch PHP object injection scoring CVSS 10, a fresh Drupal contrib batch including SQLi in Location Selector and CSRF in Lingotek, and PHP 8.2/8.3/8.4 all shipping security releases the same day. Meanwhile Sonatype's Q2 numbers put npm at 96.6% of malicious package volume, and Unit 42 documented how LLM domain hallucinations are already being weaponized as a squatting vector. Recalculate: which of your Joomla, ColdFusion, and PrestaShop surfaces are internet-exposed, and whether your PHP fleet is patched by end of week.
Published
Friday, July 17, 2026
Entries
12
Cadence
Weekly · Sundays
Curator
Brad Anderson
Wire
cisa.gov New addition to the Known Exploited Vulnerabilities catalog ·
github.com GHSA: critical npm package compromise affecting CI pipelines ·
wordfence.com WordPress plugin vulnerability with active exploitation ·
drupal.org Highly critical core security advisory published ·
aws.amazon.com AWS security bulletin: IAM policy evaluation update ·
unit42.paloaltonetworks.com Threat actor expands toolkit targeting public-facing PHP apps ·
krebsonsecurity.com Breach disclosure with named victim and confirmed initial vector ·
snyk.io Composer dependency advisory affecting production framework versions ·
cisa.gov New addition to the Known Exploited Vulnerabilities catalog ·
github.com GHSA: critical npm package compromise affecting CI pipelines ·
wordfence.com WordPress plugin vulnerability with active exploitation ·
drupal.org Highly critical core security advisory published ·
aws.amazon.com AWS security bulletin: IAM policy evaluation update ·
unit42.paloaltonetworks.com Threat actor expands toolkit targeting public-facing PHP apps ·
krebsonsecurity.com Breach disclosure with named victim and confirmed initial vector ·
snyk.io Composer dependency advisory affecting production framework versions ·
01

Web Application

frameworks · browsers · authentication flows

no entries this week

02

Supply Chain

packages · build systems · dependency attacks

github.com 1w CVSS 6.5

MCP Atlassian SSRF fix bypassed via DNS rebinding on patched build

The published fix for CVE-2026-27826 in mcp-atlassian resolves the attacker-controlled X-Atlassian-{Jira,Confluence}-Url host once at middleware time, but the outbound request re-resolves DNS at connect time with no IP pinning. A rebinding host returns a public IP for validation and 169.254.169.254 or an internal address for the actual request — restoring unauthenticated SSRF to cloud metadata on the patched build.

CVE-2026-27826 mcp-atlassian
Fruition take

If you self-host mcp-atlassian for internal agent tooling, don't rely on the vendor patch. Block egress to link-local metadata endpoints at the network layer and require the MCP process to run under an IMDSv2-enforced role.

github.com 1w CVSS 5.9

sigstore-go multi-log threshold bypass via single compromised log

sigstore-go verifiers configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counted witnesses per-entry rather than per-log-authority. A single compromised transparency log could forge multiple entries and satisfy the multi-log threshold on its own, defeating the intended defense-in-depth. CVE-2026-49834. Cosign uses threshold 1 and is not affected.

CVE-2026-49834 sigstore-go
Fruition take

If any build pipeline uses sigstore-go for policy verification with multi-log thresholds, upgrade and re-run signature validation on artifacts published under the vulnerable version.

sonatype.com 1w

Sonatype Q2: npm now 96.6% of malicious package volume as Shai-Hulud worm spreads

Sonatype's Q2 2026 index reports 1.8M total malicious packages logged, with npm accounting for 96.6% of Q2 activity. Named campaigns include Shai-Hulud Miasma (worm-like malware), CanisterSprawl, Atomic Arch, malicious PyTorch Lightning releases, and dependency-confusion + maintainer-hijack chains. Trojan-class and repository-abuse activity are the defining pattern.

npm
Fruition take

For any Next.js or Astro build, require npm --ignore-scripts in CI and pin transitive deps via lockfile audits. If you're not already checking new dependencies against a threat feed, this quarter's Shai-Hulud numbers make that a Q3 roadmap item.

unit42.paloaltonetworks.com 2w

Unit 42: attackers register LLM-hallucinated package and domain names as a supply-chain vector

Unit 42 documents "phantom squatting" — attackers registering domains and package names that LLM coding assistants consistently hallucinate in generated code. When a developer runs the LLM output verbatim, the code fetches from or installs the attacker's namespace. The research includes reproducible prompts that consistently produce the same non-existent identifiers across major models.

Fruition take

If your team is using AI code assistants for scaffolding, add a lockfile-review gate that flags any newly-introduced package name against a known-good registry snapshot. LLM-suggested imports are now an active exploitation path, not a theoretical one.

03

Infrastructure

kubernetes · cloud · network · ingress

no entries this week

04

PHP & CMS

wordpress · drupal · plugins · php frameworks

github.com 1w CVSS 10.0
▲ headline

PrestaShop ps_facetedsearch: unauthenticated PHP object injection to RCE (CVSS 10)

The PrestaShop faceted-search module rebuilds slider filter values (price, weight) from the URL, stores them in a filter-block cache, and later deserializes with raw unserialize(). Any shop using a vulnerable ps_facetedsearch with a slider filter template is exploitable unauthenticated: gadget chain writes a PHP webshell into the module directory. CVE-2026-54159, CVSS 10.

CVE-2026-54159 PrestaShop ps_facetedsearch
Fruition take

If you run or host any PrestaShop storefront with faceted search enabled, patch this week and grep access logs for anomalous query strings hitting category URLs with serialized payloads.

drupal.org 1w

Drupal contrib batch: SQLi in Location Selector, CSRF in Lingotek, XSS in UI Patterns and Siteimprove

Drupal Security published nine contrib advisories July 8. Highest-severity is Location Selector (CVE-2026-15081, 19/25) — SQL injection via a Views filter that accepts user input. Also patched: Ray Enterprise/Lingotek Translation CSRF on state-changing admin routes (CVE-2026-15080), UI Patterns SDC XSS (CVE-2026-15084), and Siteimprove Analytics XSS. Three modules were marked unsupported with unpatched issues.

CVE-2026-15081 CVE-2026-15080 CVE-2026-15084 +1 more Drupal Location Selector Ray Enterprise Translation UI Patterns Siteimprove Analytics
Fruition take

Run drush pm:security across client sites and pay attention to the unsupported modules (Commerce guest registration, Clean RESTful, Raw Formatter) — those need to come off the platform, not just wait for a patch.

php.net 2w

PHP 8.2.32, 8.3.32, and 8.4.23 released as security updates

The PHP project shipped simultaneous security releases across all three supported branches on July 2. All PHP 8.2, 8.3, and 8.4 users are directed to upgrade. Fruition's WordPress and Drupal fleet runs on this branch tree; the ChangeLog lists CVE-tracked fixes in core.

PHP 8.2 PHP 8.3 PHP 8.4
Fruition take

Bump PHP base images this sprint. If you pin minor versions in your Dockerfiles for k8s workloads, this is a one-line change that closes several core-level bugs on every hosted site at once.

05

Identity & Auth

oauth · saml · iam · session attacks

github.com 1w CVSS 9.3

Authorizer /authorize leaks OAuth tokens via unvalidated redirect_uri

Authorizer's /authorize endpoint accepts arbitrary redirect_uri values without checking against AllowedOrigins. With response_type=token or id_token, the server 302s access_token, id_token, and refresh_token as query parameters to the attacker's URL. The client_id is discoverable via the public /graphql meta query. A v2.0.1 partial fix covered other handlers but missed /authorize. CVE-2026-54072, CVSS 9.3.

CVE-2026-54072 Authorizer
Fruition take

If any client portal wraps Authorizer as its IdP, patch and audit AllowedOrigins. This is the OAuth textbook flaw — treat any issued tokens in logs from unknown redirect hosts as compromised.

06

Threat Intel

active exploitation · breaches · ransomware

nvd.nist.gov 1w KEV
▲ headline

CISA adds Joomla trio to KEV: Balbooa Forms, SP Page Builder, Joomlack — all unauthenticated file upload to RCE

CISA added three Joomla extensions to KEV within days of each other: Balbooa Forms (CVE-2026-56291), JoomShaper SP Page Builder (CVE-2026-48908), and Joomlack Page Builder (CVE-2026-56290). All three are unauthenticated arbitrary file upload flaws leading to PHP code execution. BOD 26-04 requires federal remediation; exploitation is confirmed in the wild.

CVE-2026-56291 CVE-2026-48908 CVE-2026-56290 Balbooa Forms JoomShaper SP Page Builder Joomlack Page Builder Joomla
Fruition take

Inventory every Joomla site you host or inherited. If any of these extensions are installed and internet-reachable, pull them offline or WAF-block the upload endpoints today — these are pre-auth RCEs already being exploited.

darkreading.com 1w

Solo attacker chained AI workflows and stolen creds to breach AWS in 72 hours

Dark Reading reports a large Amazon customer was breached and extorted by a single attacker over three days. The chain combined exploitation of AI agent workflows, exposed cloud misconfigurations, and stolen credentials — no zero-days, no team. The incident highlights how agent tool permissions and IAM sprawl now compress the time from initial access to full environment control.

AWS
Fruition take

Audit any AI agent's IAM role for star-scoped actions and cross-account trust. If an agent has permissions your on-call engineer wouldn't get in a normal ticket, that's your blast radius.

nvd.nist.gov 1w KEV

Adobe ColdFusion path traversal added to KEV

CISA added CVE-2026-48282, an Adobe ColdFusion path traversal enabling arbitrary code execution as the running user, to the KEV catalog. Exploitation is confirmed and BOD 26-04 timelines apply. Adobe has published fixes; unpatched ColdFusion instances remain a routine initial-access vector for state and criminal actors.

CVE-2026-48282 Adobe ColdFusion
Fruition take

If any legacy client workload still runs ColdFusion, verify the July hotfixes are applied and restrict admin endpoints to VPN. ColdFusion KEV entries have a strong track record of same-week mass scanning.

nvd.nist.gov 1w KEV

Langflow authorization bypass added to KEV — attackers execute other users' flows

CVE-2026-55255 in Langflow lets an authenticated attacker execute any flow belonging to another user by specifying the victim's flow ID in the request — a classic IDOR. CISA added it to KEV on July 7 with confirmed exploitation. Any team running Langflow-hosted agent infrastructure is exposed to cross-tenant flow execution and data access.

CVE-2026-55255 Langflow
Fruition take

If any client PoC uses Langflow for agent orchestration, patch immediately and rotate any credentials the flows have access to. Assume other flows were run.