Daily Cyber Digest: 2026-07-12
Five high-signal cyber developments from July 11-13, 2026: Joomla zero-days in CISA KEV, exposed Evilginx ops, a jscrambler npm infostealer, Pakistan police portal espionage, and unpatched AI-infra flaws.
Published
July 13, 2026Item Count
5 itemsTLP Protocol
TLP:clearBriefing Items
Rank #1 · vulnerability · high · medium confidence
The Hacker NewsJoomla iCagenda and Balbooa Forms flaws added to CISA KEV as zero-days
CISA added two maximum-severity Joomla extension flaws, CVE-2026-48939 (iCagenda) and CVE-2026-56291 (Balbooa Forms), to its KEV catalog after reports of zero-day exploitation enabling arbitrary file upload and RCE.
Joomla powers a large share of CMS deployments; unpatched KEV-listed flaws on internet-facing sites should be remediated immediately to prevent compromise.
#2 · identity · medium
The Hacker NewsExposed misconfigured server reveals three Evilginx phishing operations
A French security firm lifted an attacker's full toolkit from a publicly exposed Python web server, exposing three Evilginx phishing operations targeting Microsoft 365 credentials.
Adversary-in-the-middle phishing kits bypass MFA and feed directly into account takeover; defenders should monitor for session-token theft and enforce phishing-resistant authentication.
#3 · malware · high
The Hacker Newsjscrambler npm release compromised to drop Rust infostealer
The jscrambler 8.14.0 npm package was compromised; its preinstall hook dropped and executed a native Rust infostealer build for Windows, macOS, and Linux. Socket flagged the release minutes after publication.
Supply-chain compromises of developer dependencies execute on install and can harvest credentials and source code across engineering environments; pin and verify packages and disable install scripts where possible.
#4 · incident · high
The Hacker NewsBalochistan Police Portal weaponized in multi-group espionage
Researchers disclosed sustained cyber-espionage activity against Pakistani law enforcement in which compromised Balochistan Police Portal assets were weaponized by suspected China- and India-aligned threat actors between February 2024 and April 2026.
Compromise of police and citizen-data web applications enables surveillance, data theft, and downstream targeting of government and critical infrastructure.
#5 · research · medium
Help Net Security99.9% of fixable AI-infrastructure vulnerabilities left unpatched
Orca Security's 2026 State of AI Security Report found that 99.9% of fixable AI-infrastructure vulnerabilities remain unpatched, with excessive permissions frequently abused to build custom AI applications.
As enterprises operationalize AI, unpatched AI infrastructure and over-broad permissions expand the attack surface; prioritized remediation and least-privilege controls are needed.
Executive snapshot
The previous UTC day surfaced a concentrated wave of exploited and weaponized flaws alongside persistent supply-chain and espionage pressure. CISA-tracked Joomla zero-days, a leaked Evilginx phishing kit, a compromised npm package delivering an infostealer, and continued targeting of government web applications show attackers capitalizing on misconfiguration and trust boundaries. A research report underscored that AI infrastructure remains broadly unpatched.
Notable items
The items below cluster around three themes: (1) exploited web-application and CMS flaws demanding immediate patching, (2) supply-chain and credential-theft tradecraft against developers and identity providers, and (3) sustained nation-state espionage leveraging compromised government portals. Each is sourced to reporting published within the previous-day window.
Watchlist
- Patch or mitigate CVE-2026-48939 and CVE-2026-56291 on internet-facing Joomla deployments; treat KEV-listed flaws as urgent.
- Audit build and CI pipelines for unexpected
preinstall/postinstallhooks; consider disabling npm install scripts by default. - Enforce phishing-resistant (FIDO2) authentication and monitor for adversary-in-the-middle session-token theft against Microsoft 365.
- Review exposure of government and law-enforcement web applications, especially in high-tension regions, for signs of compromise.
- Prioritize remediation of AI-infrastructure vulnerabilities and tighten permissions for AI application build environments.