AcyMailing for Joomla lets anyone email their way to RCE
The mailbox monitoring feature in AcyMailing Enterprise saves email attachments straight into the web root without checking their extension. Fixed in 11.1.0.
Tagged
Supply Chain
From The Wire
A Joomla plugin's GitHub auto-download skips TLS verification
The UP plugin for Joomla fetches action code from GitHub with certificate verification turned off, letting a network-positioned attacker swap in malicious PHP that Joomla then runs. Fixed in 5.2.1 and 6.1.0.
GitHub restored two hijacked Actions without fixing the tags
Two Actions poisoned in the May Mini Shai-Hulud attack came back online in September with the malicious tags untouched, so tag-pinned workflows ran the payload again.