Loading story…
Attacks targeting Joomla! vulnerability CVE-2023-23752 increased sharply after the flaw was disclosed and patched, with MBSD-SOC first observing exploitation attempts on February 18 and reporting a further rise through March. The bug is an improper access control issue in Joomla! webservice endpoints that affects versions 4.0.0 through 4.2.7, allowing unauthorized API access and exposure of sensitive information; researchers warned that successful exploitation could lead to site compromise.
MBSD-SOC said attack volume climbed notably after March 8 as proof-of-concept exploit code became publicly available, with most observed traffic originating from the United States and increased activity also seen from Japan and Singapore. The Joomla! Project rated the issue Critical and released fixes in version 4.2.8; defenders were advised to upgrade affected systems and change passwords in the global configuration because exposed credentials and configuration data could aid follow-on compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
A Ruby proof-of-concept exploit for CVE-2023-23752 was released by noraj (Alexandre ZANNI) for ACCEIS. The PoC demonstrated unauthenticated access to Joomla!'s users and application configuration API endpoints, exposing user data and sensitive configuration including database credentials.
MBSD-SOC reported that attacks targeting CVE-2023-23752 rose notably after March 8, 2023, continuing the trend from the prior month.
MBSD-SOC reported increased attacks during March 2023 targeting CVE-2023-23752, with the United States remaining the largest source and attack traffic from Japan and Singapore increasing.
MBSD-SOC observed attacks targeting CVE-2023-23752 beginning on February 18, 2023. The attacks included unauthorized requests to the Joomla! endpoint /api/index.php/v1/config/application?public=true.
Joomla! released the security update fixing CVE-2023-23752 in version 4.2.8, and the CVE record for the critical vulnerability was published. The issue affects Joomla! CMS versions 4.0.0 through 4.2.7.
Joomla! issued an advance announcement of an urgent security update for CVE-2023-23752, an improper access control flaw in webservice endpoints.
MBSD-SOC reported newly observed attacks during February 2023 targeting CVE-2023-23752 and warned that activity could increase because proof-of-concept code was already public.
The CVE record for CVE-2023-23752 was updated, with the entry continuing to credit Zewei Zhang of NSFOCUS TIANJI Lab as the finder.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcembsd.jp
Open sourceexploit-db.com
Open sourcembsd.jp
Open sourcejoomla.org
Open sourcejoomla.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FortiGuard Labs reported ongoing in-the-wild exploitation of **CVE-2026-48908**, a critical `CVSS 10.0` unauthenticated remote code execution flaw in the JoomShaper **SP Page Builder** extension for Joomla. The bug stems from an unrestricted file upload in the `asset.uploadCustomIcon` functionality that lets attackers upload and execute arbitrary PHP files, enabling full server compromise. Public proof-of-concept exploit code is available, and the vulnerability was added to CISA’s Known Exploited Vulnerabilities catalog after active abuse was confirmed. FortiGuard said exploitation has remained elevated, with **1,210 blocked attempts in 24 hours** and **15,626 over 7 days**, indicating sustained automated scanning of Internet-facing Joomla servers. The highest attack volumes were observed against organizations in **Poland, Turkey, Australia, and the United States**, with **Telecommunications/Carrier** and **Technology** among the most targeted sectors. Defenders were urged to upgrade to **SP Page Builder 6.6.2 or later**, restrict public access to Joomla administrative interfaces, block PHP execution in upload directories, and investigate for **web shells**, suspicious files, unauthorized administrator accounts, and other persistence because patching alone does not remove an existing compromise.
Jul 19, 2026
A critical flaw in Joomla! tracked as **`CVE-2015-8562`** allowed unauthenticated attackers to achieve remote code execution by sending crafted HTTP headers, including **`User-Agent`**, to vulnerable sites. The bug affected Joomla! versions **`1.5.0` through `3.4.5`** and was fixed in **`3.4.6`**. Researchers reported that exploitation was already occurring in the wild before the patch was released, with attackers abusing Joomla!'s session handling to write malicious serialized data into the backend MySQL session store and trigger code execution on a follow-up request. The exploit chain relied on multiple conditions: Joomla! stored session data in MySQL text fields, MySQL could silently truncate input containing 4-byte UTF-8 characters under configurations such as **`utf8_general_ci`**, and PHP session decoding behavior associated with **`CVE-2015-6835`** could turn the truncated data into attacker-controlled objects. The injected object chain then reached Joomla! components including **`JDatabaseDriverMysqli`** and **`SimplePie`**, ultimately invoking dangerous code paths such as **`assert()`**. Recommended mitigations included upgrading Joomla! and PHP, applying distribution patches, using **`utf8mb4`** where appropriate, and enabling stricter MySQL SQL modes to prevent silent truncation.
Aug 15, 2026
Brazil's CTIR Gov warned that **CVE-2026-48907** in the Joomla Content Editor (**JCE**) component is being actively exploited, with incident response and forensic work on compromised institutional websites uncovering new indicators of compromise tied to **webshell deployment, unauthorized remote access, and persistence**. The alert says outdated or unpatched JCE installations are at risk and links the activity to an ongoing campaign previously tracked in earlier notices. The agency urged organizations to immediately apply vendor fixes, keep **Joomla** and **JCE** fully updated, and load the newly published IOCs and malicious file hashes into monitoring tools. It also recommended retrospective threat hunting, checking for unauthorized **PHP** files in upload and temporary directories, and reviewing historical web access logs for signs of exploitation and follow-on access.
Aug 15, 2026