Per CISA and reporting by The Hacker News, BleepingComputer, SecurityWeek and The Register, on 10 July 2026 CISA added two vulnerabilities in third-party Joomla extensions to its Known Exploited Vulnerabilities catalogue, both rated CVSS 10.0. CVE-2026-48939 affects the iCagenda events extension and CVE-2026-56291 affects the Balbooa Forms extension. Both permit arbitrary file uploads leading to remote PHP code execution and full site takeover. iCagenda has been exploited as a zero-day since 15 June 2026 in automated attack campaigns; Balbooa Forms was discovered by mySites.guru on 8 July 2026 after a real-world attack on a customer site. The FCEB remediation deadline was 13 July 2026. Fixes are available in iCagenda 4.0.8 and 3.9.15 and Balbooa Forms 2.4.1.

Because the core CMS is patched on a predictable cadence by a well-known upstream, while extensions are maintained by hundreds of independent developers of highly variable maturity, without a shared inventory, shared change log or shared telemetry on the buyer side. Extensions are trivially fingerprintable from public HTTP responses, an arbitrary file upload in an add-on drops a web shell that gives remote code execution and full site control, and extensions accumulate silently over years without a named functional owner. The two Joomla flaws in scope, in an events plugin and a forms plugin, illustrate the pattern exactly.

One, maintain a living, automatically generated inventory of every extension on every site with version, install date, maintainer, licence and functional owner. Two, apply a tiered patch SLA aligned to public exploitation status, with 24 hours for critical severity with known exploitation, 72 hours for critical without known exploitation, 7 days for high severity, and monthly for the remainder. Three, retire unused, deprecated and abandoned add-ons on a quarterly cadence. Four, place a Web Application Firewall in front of the estate for virtual patching. Five, run web shell detection, file integrity monitoring and behavioural monitoring on the CMS document root and outbound traffic. Six, contract a single accountable partner that owns all of the above with a named service manager and monthly evidence reports.

Because automated exploitation of newly disclosed web-facing vulnerabilities now begins within hours of public disclosure and, in the iCagenda case, before it. CISA gave FCEB agencies three days to remediate the two Joomla add-on flaws, from 10 July to 13 July 2026, reflecting that operational reality. For a mid-market operator running a public website on a shared CMS with third-party extensions, the mechanism that closes the patch window has to run without a ticket, a change board or a discretionary weekly release. That is a managed website maintenance capability, not a periodic project, and it is why a tiered SLA aligned to the exploitation posture is the operational default in 2026.

By asking ten concrete questions and treating absent, evasive or hand-waved answers as the signal. Can they show a current extension inventory generated in the last 24 hours? What is their maximum elapsed time from a new CISA KEV entry to a production patch? What is their written patch SLA by severity and exploitation status, and where is the compliance percentage published? What is the retirement policy for abandoned add-ons and how many were retired in the last 12 months? Which WAF is deployed, who tunes the rulesets, what rules are actively blocking exploitation? What web shell detection, file integrity and behavioural monitoring is in place and where do alerts route? What is the elapsed time from detection to first responder engaged? What is the change safety and rollback procedure? What is included in the monthly report? Who is the named service manager, and what contractual metric are they willing to move in the next 90 days?

Call IT Dev operates as a managed website maintenance and cybersecurity partner from Morocco with nearshore EU-time-zone delivery in English, French, Spanish, Arabic and German, aligned with CNDP Law 09-08 and GDPR data-protection obligations. The service covers the six-point playbook end-to-end: living inventory of every extension across the estate, tiered patch SLA aligned with CISA KEV and equivalent feeds, retirement of unused add-ons, WAF and virtual patching, web shell and behavioural detection on the CMS layer, and an incident response path with a named service manager. Where the extension surface itself needs to shrink, the same partner covers software development modernisation of high-risk components and technical support for the day-two operations of the resulting stack.