SecurityWeekIonut Arghire
Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root
Part of the CVE-2026-48907 story · since 16 Jun
- Tue 16 Jun, 20:50 UTC. CISA, first report. CISA adds critical Joomla editor flaw CVE-2026-48907 to KEV. Cites a CVE in CISA KEV.
- Tue 16 Jun, 21:37 UTC. CISA. CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited List. Cites a CVE in CISA KEV.
- Wed 17 Jun, 07:21 UTC. SecurityOnline, its first report on the story. WooCommerce stores hit by payment skimmer (CVE-2026-48907). Cites a CVE in CISA KEV.
- Wed 17 Jun, 07:50 UTC. SecurityWeek, its first report on the story. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV. This article, 4th of 6.
- Wed 17 Jun, 08:25 UTC. SecurityOnline. AdGuard blocks Joomla exploit and launches email tracking shield. Cites a CVE in CISA KEV.
- Wed 17 Jun, 15:40 UTC. Security Affairs, its first report on the story. CISA flags critical Joomla JCE bug enabling remote code execution. Cites a CVE in CISA KEV.
Threat actors are exploiting vulnerabilities in Joomla and the LiteSpeed cPanel plugin, leading to potential code execution and privilege escalation. A significant vulnerability tracked as CVE-2026-48907 in the Joomla Content Editor allows unauthorized file uploads, enabling attackers to execute arbitrary PHP code. Joomla has urged users to update to version 2.9.99.6 to mitigate this risk.
Similarly, the LiteSpeed cPanel plugin is vulnerable to CVE-2026-54420, which permits users with FTP access to escalate privileges to root on certain servers. The US Cybersecurity and Infrastructure Security Agency (CISA) has added both vulnerabilities to its Known Exploited Vulnerabilities catalog, urging prompt remediation for federal agencies.
How the story developed
6 articles from 4 outlets since 16 Jun. Quiet since 17 Jun. This was the 4th report, 11 hours after the first.
- Tue 16 Jun, 20:50 UTC. CISA, first report. CISA adds critical Joomla editor flaw CVE-2026-48907 to KEV. Cites a CVE in CISA KEV.
- Tue 16 Jun, 21:37 UTC. CISA. CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited List. Cites a CVE in CISA KEV.
- Wed 17 Jun, 07:21 UTC. SecurityOnline, its first report on the story. WooCommerce stores hit by payment skimmer (CVE-2026-48907). Cites a CVE in CISA KEV.
- Wed 17 Jun, 07:50 UTC. SecurityWeek, its first report on the story. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV. This article, 4th of 6.
- Wed 17 Jun, 08:25 UTC. SecurityOnline. AdGuard blocks Joomla exploit and launches email tracking shield. Cites a CVE in CISA KEV.
- Wed 17 Jun, 15:40 UTC. Security Affairs, its first report on the story. CISA flags critical Joomla JCE bug enabling remote code execution. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 6 articles as a listHide the list
- Tue 16 JunDay 02
- CISA adds critical Joomla editor flaw CVE-2026-48907 to KEV20:50 · CISA · official · First report · CISA alert · Known exploited CVE
- CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited List21:37 · CISA · official · Known exploited CVE
- Wed 17 JunDay 14
- WooCommerce stores hit by payment skimmer (CVE-2026-48907)07:21 · SecurityOnline · Known exploited CVE
- Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root07:50 · SecurityWeek · Known exploited CVE · This article, 4th of 6
- AdGuard blocks Joomla exploit and launches email tracking shield08:25 · SecurityOnline · Known exploited CVE
- CISA flags critical Joomla JCE bug enabling remote code execution15:40 · Security Affairs · Known exploited CVE