### What changed today
CISA KEV drives today's priority list: two Joomla page-builder upload vulnerabilities now need active-exploitation handling. A Gitea exploitation update also moves self-hosted source-control checks above routine patch review, while four advisory-led items need owner routing for collaboration, identity, deployment, and Linux platform teams.
### Findings 01-02: Joomla page-builder KEV upload flaws
Findings 01 and 02 cover JoomShaper SP Page Builder CVE-2026-48908 and Joomlack Page Builder CVE-2026-56290. Both are unrestricted upload issues now listed by CISA KEV, so exposed Joomla sites should be treated as hunt-and-patch work rather than routine patch backlog. Inventory affected extensions, patch or disable them, and review upload directories, recent POST requests, and unexpected PHP files for webshell activity.
### Finding 03: Gitea CVE-2026-20896 exploitation update
Finding 03 covers Gitea CVE-2026-20896. Unlike the Joomla items, this is not a CISA KEV entry; today's material change is active-exploitation reporting after earlier coverage. Gitea owners should verify 1.26.3, 1.26.4, or the relevant mitigation state, then review repository access, secret exposure, proxy trusted-header handling, and suspicious account activity.
### Findings 04-07: advisory-led owner routing
Findings 04-07 cover EGroupware CVE-2026-27823, Better Auth CVE-2026-53512, Goploy CVE-2026-53552, and RHEL perl-HTTP-Daemon CVE-2026-8450. These items are advisory-led rather than KEV-confirmed in today's priority list, but each has a concrete owner: collaboration platforms, application identity, deployment control planes, and Linux package owners.
EGroupware CVE-2026-27823 is a file read/write path that can move toward remote code execution if exposed collaboration systems are left vulnerable. Better Auth CVE-2026-53512 affects OAuth refresh-token handling; application identity teams should upgrade to better-auth 1.6.11, migrate the OAuth provider where feasible, and revoke suspicious refresh tokens if logs suggest replay or session abuse.
Goploy CVE-2026-53552 is a deployment-control-plane issue involving cross-namespace IDOR that can affect deployment remote rewrites. Deployment platform owners should restrict manager roles, patch when a fixed release is available, and audit deploy remote changes for signs of abuse. RHEL perl-HTTP-Daemon CVE-2026-8450 is the Linux-platform item; Linux owners should identify systems using perl-HTTP-Daemon and apply vendor updates.
### Recommended actions
1. Route Findings 01-02 to web-platform owners for immediate Joomla extension inventory, patching or temporary disablement, and upload-path review.
2. Route Finding 03 to source-control owners for Gitea version, mitigation, proxy-header, repository-access, and secret-exposure checks.
3. Route Finding 04 to collaboration-platform owners for EGroupware patching, self-registration review, and setup-password integrity checks.
4. Route Finding 05 to application identity owners for Better Auth upgrade and refresh-token review.
5. Route Finding 06 to deployment-platform owners for Goploy role restrictions, patch tracking, and deploy remote-change audit.
6. Route Finding 07 to Linux package owners for RHEL perl-HTTP-Daemon exposure checks and vendor updates.
### Sources
- [CISA KEV CVE-2026-48908](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?vulnId=CVE-2026-48908)
- [CISA KEV CVE-2026-56290](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?vulnId=CVE-2026-56290)
- [SecurityWeek Gitea exploitation report](https://www.securityweek.com/critical-gitea-flaw-under-active-exploitation-researchers-warn/)
- [GitHub advisory GHSA-h9qx-v5xp-ph8p](https://github.com/advisories/GHSA-h9qx-v5xp-ph8p)
- [GitHub advisory GHSA-pw9m-5jxm-xr6h](https://github.com/advisories/GHSA-pw9m-5jxm-xr6h)
- [GitHub advisory GHSA-26rh-24rg-j3vv](https://github.com/advisories/GHSA-26rh-24rg-j3vv)
- [CERT-Bund WID-SEC-2026-2218](https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2218)