Active Exploitation of Two Joomla Extensions and Emerging Ransomware Automation

CISA has confirmed active exploitation of two Joomla extensions, iCagenda and Balbooa Forms, both vulnerable to unauthenticated PHP code execution. The vulnerabilities, tracked as CVE-2026-48939 and CVE-2026-56291, allow attackers to run code without credentials, creating immediate legal and operational risks for UK small businesses running Joomla websites. Australia’s cybersecurity agency flagged these as part of a coordinated campaign targeting CMS platforms. For businesses holding customer data, this represents a potential GDPR personal data breach with mandatory ICO notification requirements within 72 hours of awareness. Meanwhile, emerging threat intelligence describes JADEPUFFER, a ransomware strain reportedly using AI agents to automate reconnaissance, target selection, and extortion communication. While confidence in JADEPUFFER intelligence remains moderate, it illustrates a concerning directional shift: ransomware operations becoming increasingly automated and economical to deploy against smaller targets previously considered too labour-intensive to attack. This episode provides actionable guidance for checking Joomla installations, reviewing hosting logs, engaging web agencies with specific questions, understanding GDPR breach notification obligations, and subscribing to the NCSC Early Warning Service.

Chapters

• Intro Corrine introduces the episode and flags confirmed active exploitation of two Joomla extensions as the lead story requiring immediate attention from UK small businesses.
• Joomla Under Active Attack CISA has added two Joomla extensions to its Known Exploited Vulnerabilities catalogue: iCagenda (CVE-2026-48939) and Balbooa Forms (CVE-2026-56291). Both allow unauthenticated PHP code execution, meaning attackers require no credentials. Australia’s cybersecurity agency flagged a coordinated CMS exploitation campaign. Joomla powers over one percent of all websites globally, and automated scanners probe indiscriminately. Successful exploitation enables data exfiltration, persistent backdoors, lateral movement, or ransomware deployment. For sites collecting customer data, this constitutes a potential GDPR personal data breach requiring ICO notification within 72 hours of awareness.
• CTA Corrine requests audience support through follows, ratings, reviews, and sharing with other small business owners.
• JADEPUFFER: AI-Powered Ransomware Threat intelligence reports describe JADEPUFFER, a ransomware strain allegedly using AI agents to automate reconnaissance, target selection, and extortion communication. Confidence in this intelligence is moderate and should not drive panic or unvetted procurement. The significance lies in the directional shift: ransomware automation reduces manual effort, making small businesses economically viable targets at scale. Historical economics favoured high-value targets; automation changes that calculation by enabling attackers to process thousands of smaller targets simultaneously for aggregate returns.
• What Small Businesses Should Do Now Immediate actions include checking Joomla installations for iCagenda and Balbooa Forms, updating or removing them today, reviewing hosting logs for anomalous activity over the past 30 days, contacting web agencies with specific questions about CVE-2026-48939 and CVE-2026-56291 patching, understanding GDPR breach notification obligations before an incident occurs, and subscribing to the NCSC Early Warning Service. These actions align with Cyber Essentials Plus patch management requirements and provide audit-ready control evidence.
• Outro Corrine emphasises the urgency of addressing the Joomla vulnerabilities today, acknowledges JADEPUFFER as worth monitoring without immediate action beyond fundamentals, and reinforces the 20-minute practical task of checking and patching Joomla extensions.

Links

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.ncsc.gov.uk/section/keep-up-to-date/threat-reports
• https://ico.org.uk/for-organisations/report-a-breach/
• https://www.ncsc.gov.uk/cyberessentials/overview