July 13, 2026 brings a concentrated cluster of actively exploited vulnerabilities that cut across self-hosted developer infrastructure, popular CMS plugins, mobile endpoints, and government networks. The common thread is straightforward: attackers are targeting gaps in authentication and input validation that defenders can close with patching, configuration hardening, and focused monitoring. Here is what your team needs to know today.

The most urgent item is the critical authentication bypass in the official Gitea Docker image, currently under active exploitation. The vulnerability allows an unauthenticated attacker to impersonate any user account, including administrators, and gain full control over self-hosted Git repositories. For organizations running Gitea in containerized environments, the blast radius is severe: source code theft, supply chain poisoning through malicious commits, secret harvesting from repository contents, and lateral movement using credentials or tokens stored in repos. If your organization runs Gitea via Docker, treat this as an emergency. Pull the patched image immediately, rotate all administrative credentials and API tokens, and audit recent repository activity and access logs for anomalous commits, new SSH key additions, or unexpected administrative actions. Do not expose Gitea instances directly to the internet without network-layer controls in place.

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities catalog, both involving unrestricted file upload flaws in Joomla ecosystem components. CVE-2026-48939 affects iCagenda, a Joomla event management extension, and CVE-2026-56291 affects Balbooa Forms, a Joomla form builder. Both vulnerabilities allow attackers to upload files with dangerous types, which in practice means web shells and other malicious payloads can be planted directly on the web server. Once a web shell is in place, an attacker has persistent, interactive access to the underlying host. CISA's KEV listing confirms these are not theoretical risks but are being weaponized in the wild right now. Organizations running Joomla sites should audit all installed extensions immediately, apply available patches for iCagenda and Balbooa Forms without delay, and scan web-accessible directories for recently created or modified PHP files that do not belong. Web application firewalls should be configured to block upload of executable file types to these components as a compensating control while patching is underway.

On the mobile front, a new variant of the RedHook Android malware has introduced a technically notable capability: it abuses Android's Wireless Debugging feature, also known as Wireless ADB, to obtain shell-level access to a compromised device without requiring a physical USB connection or a paired computer. This is significant because Wireless ADB is a legitimate developer tool that, when enabled, opens a network-accessible debugging interface. RedHook exploits this to execute commands at a privileged level, enabling data exfiltration, app manipulation, and persistence. Enterprise mobile device management policies should explicitly disable Wireless Debugging on all managed Android devices. Security teams should monitor for unexpected ADB-over-network traffic on internal segments and treat any device with Wireless Debugging enabled outside of a controlled development environment as a high-risk endpoint. Endpoint detection on Android fleets should be tuned to flag unusual use of debugging interfaces.

Finally, researchers have detailed a sustained espionage campaign targeting Pakistani law enforcement organizations, including the Balochistan Police portal, conducted by multiple threat actor groups with suspected ties to both China- and India-aligned interests. The campaign ran from at least February 2024 through April 2026, demonstrating long-term persistence inside law enforcement infrastructure. While this specific campaign targets government entities in South Asia, the tactics are instructive for any organization: compromised web portals serve as initial footholds, and multi-group targeting of the same victim infrastructure is increasingly common in espionage operations. Organizations managing sensitive law enforcement or government data should assume that public-facing portals are high-value targets and apply defense-in-depth accordingly.

Defensive priorities for today:

- Patch the Gitea Docker image immediately and rotate all repository credentials and tokens
- Apply patches for iCagenda (CVE-2026-48939) and Balbooa Forms (CVE-2026-56291) on all Joomla installations; scan for web shells now
- Disable Android Wireless Debugging on all managed devices via MDM policy and audit for existing exposure
- Review web server upload directories for unexpected executable files as a standing hygiene practice
- Cross-reference your asset inventory against CISA's full KEV catalog and ensure all listed vulnerabilities have remediation plans with defined deadlines
- For organizations with public-facing portals handling sensitive data, review access logs for signs of long-term low-and-slow intrusion activity consistent with espionage tradecraft

The convergence of supply chain risk through developer tooling, CMS plugin exploitation, and mobile privilege abuse in a single day's threat feed is a reminder that attack surface management must span code infrastructure, web applications, and endpoint devices simultaneously.

This briefing is informational and for situational awareness only; always consult official vendor advisories and CISA guidance for authoritative remediation instructions.