AI Security Briefing

What it is

Four newly KEV-listed CVEs (added Tuesday, remediation deadline July 10, 2026 for FCEB agencies): Adobe ColdFusion path-traversal RCE CVE-2026-48282 (CVSS 10.0), Joomlack "Page Builder CK" unauthenticated file-upload RCE CVE-2026-56290 (CVSS 10.0), JoomShaper SP Page Builder unrestricted-upload RCE CVE-2026-48908 (CVSS 10.0), and Langflow cross-tenant IDOR CVE-2026-55255 (CVSS 6.1). The summary has the shape; what follows is the exploitation detail, fixed versions, and hunt artifacts the page adds.

How it works

• CVE-2026-48908 was exploited as a zero-day via HTTP POST to the endpoint index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon, dropping a PHP file, after which a new Super User account appears — check for both.
• CVE-2026-56290: because the flaw lets the attacker choose the destination folder, planted PHP is not confined to upload dirs. The first confirmed web shell sat at /media/com_pagebuilderck/gfonts/bhup.php, an uploader shell keyed on a $_POST['_upl'] field.
• CVE-2026-55255 + CVE-2026-33017: a single operator ran auth recon → flow enumeration → the IDOR → a looped RCE. The IDOR let them execute another tenant's flow by supplying the victim's flow ID, harvesting LLM-provider and AWS keys; the RCE targeted the host and pulled a second-stage downloader (assessed botnet/cryptojacking).

Preconditions / Affected

Internet-exposed instances of each product. Langflow abuse requires an authenticated account to reach the IDOR, then chains the unauthenticated RCE. SP Page Builder and Page Builder CK abuse is fully unauthenticated.

What to do

• SP Page Builder: update to version 6.6.2 or later (CVE-2026-48908).
• Page Builder CK: update to version 3.6.0 (CVE-2026-56290).
• Apply Adobe ColdFusion and Langflow fixes; meet the July 10, 2026 deadline.
• Hunt for web shells: per mySites.guru, "look for stray PHP files under /media/com_pagebuilderck/ first and then more widely under /images, /media, /templates, and /administrator."
• IOCs: 103.207.14[.]220 (ColdFusion exploit attempt, geolocated India); 45.207.216[.]55 (Langflow operator, active June 22–25, 2026).
• Audit Joomla Super User accounts for unexpected additions; if Langflow was exposed, rotate stored LLM-provider and AWS keys.

Caveats

The final Langflow payload is unidentified — the chain is only "consistent with" botnet/cryptojacking. ColdFusion exploitation was an observed attempt within hours of disclosure, not a confirmed compromise. Langflow is a repeat target (six prior exploited CVEs listed, plus the JADEPUFFER agentic-ransomware case via CVE-2025-3248); patching one flaw does not close the platform's exposure.