CISA Warns of Actively Exploited RCE Flaws in Joomla Extensions

**CISA added two critical arbitrary file upload vulnerabilities in Joomla extensions (iCagenda and Balbooa Forms) to its Known Exploited Vulnerabilities list, warning that attackers are actively exploiting these flaws to upload webshells and achieve remote code execution on affected web servers; the report outlines exploitation steps, affected environments, detection indicators (unexpected PHP uploads, log patterns, outbound connections), and remediation actions including patching, auditing uploads, and restricting upload functionality.**