The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are exploiting vulnerabilities in the iCagenda and Balbooa Forms extensions for Joomla to achieve remote code execution through arbitrary file uploads.

The agency has categorized the flaws as a maximum priority, ordering federal agencies to apply available security updates and/or mitigations within three days, with the deadline set for today.

The first flaw, tracked as CVE-2026-48939, is an arbitrary file upload flaw impacting the iCagenda extension used for registering and scheduling events and creating calendars.

An attacker can exploit the vulnerability to upload arbitrary files to the web server, including PHP scripts, which can lead to data theft, web shell installation, and complete website compromise by achieving remote code execution (RCE).

“iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution,” CISA warns in its entry in the Known Exploited Vulnerabilities (KEV) catalog.

The second flaw added to KEV is CVE-2026-56291, an arbitrary file upload issue in the Balbooa Forms extension for Joomla.

Balbooa Forms is a drag-and-drop form builder for creating contact forms on Joomla sites, with file upload support.

According to CISA, this functionality can be used to upload dangerous file types, such as executable files, leading to RCE and full website takeover.

According to website management and security platform mySites.guru, both flaws were exploited in automated attacks before vendors released a patch.

For iCagenda, attacks were observed just a few hours before the release of version 4.0.8, which addressed CVE-2026-48939.

The management service says that the CVE-2026-56291 vulnerability in Balbooa Forms was exploited as a zero-day, leveraged in attacks since July 8, a day before the vendor released a fix for the issue.

Website administrators managing Joomla sites should check for the presence of iCagenda and Balbooa Forms and take action where needed to protect their assets.

The flaws are fixed in iCagenda version 4.0.8 and 3.9.15, released on June 15-16, and Balbooa Forms version 2.4.1, released on July 9.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

The Manhattan Aero might just be the streaming device you’re looking for. Especially if you want live TV without an aerial, as well as must-have streaming apps, 4K playback and user-friendly software.

The Manhattan Aero is a small streaming box packed with just about all of the essentials for UK viewers — more than 450 channels via Freely, as well as Netflix, Prime Video and all that good stuff. All you need is a Wi-Fi connection and a TV, and you’re good to go. But is it actually worth buying? Here are my thoughts after a few days testing it out for myself.

On this week’s episode of the Smart Home Insider podcast, we review an innovative light that runs via coaxial cable and answer a pile of listener questions.

Since the last episode, developers received the third developer beta of Apple’s 27-branded updates. Within the release notes of macOS 27, it was revealed Apple had seemingly decided on pricing for some of its AI-powered features.

To use Apple Intelligence with Apple Home, users will need to have at least the 2TB iCloud+ plan. This is also the plan that unlocks unlimited cameras for HomeKit Secure Video recording.

Otherwise, users will be able to view their cameras and use the old descriptions that relied solely on on-device AI recognition. The new AI natural language summaries are far more useable, but rely on Apple’s cloud servers to process which explains the added cost.

Both Govee and Channel Master have released new floodlight options. The Govee model supports Matter, 2.4GHz Wi-Fi, and has 3,000 lumens of output.

The Channel Master version is Apple Home exclusively, and we had one in the studio to test. We walk through its performance, impressive all-metal build quality, and why its coaxial power supply is so unique during the review.

The remainder of the episode was dedicated to answering listener questions that had been received since the last episode. We had six questions, some of them were questions about the podcast itself and others were smart home-related.

Eric had one of the more in-depth questions, asking what is the best budget-friendly indoor camera where Apple Home or Matter isn’t a strict requirement. We go through several options with various resolutions and features.

Sarah asked whether or not it is worth waiting for more Matter cameras to be released. In a similar vein as the last question, we try to go through the pros and cons of Matter cameras and the situations where you would need to seek them out.

Finally, our last big question was from Ben who inquired about how one would use Matter devices with multiple ecosystems. We go through why you’d want to, how to commission the devices on each ecosystem, and how it is changing with the latest version of Matter.

Links from the Smart Home Insider podcast

Those interested in sponsoring the show can reach out to us at [email protected]

Keep up with everything Apple in the weekly AppleInsider Podcast. Just say, “Hey, Siri,” to your HomePod mini and ask it, and our latest Smart Home Insider episode too. If you want an ad-free main AppleInsider Podcast experience, you can support the AppleInsider podcast by subscribing for $5 per month through Apple’s Podcasts app, or via Patreon if you prefer any other podcast player.

If you use Instagram, WhatsApp, or iMessage, you need to know what is happening on these platforms. Australia’s online safety regulator, eSafety, has published a new transparency report, and the findings are grim. 

As reported by The Guardian, the regulator found significant gaps in how the biggest tech companies are handling online sexual extortion and child sexual exploitation, even as the reports keep climbing.

Which apps are criminals actively using for sextortion?

Between July and December 2025, eSafety received over 2,000 sexual extortion complaints. Instagram and WhatsApp were named in more than 1,300 of them combined, making them the most cited platforms by a wide margin.

Men aged 18 to 24 filed the most complaints of any group, with roughly 800 reports. But the regulator noted that younger teens are increasingly in the crosshairs, and for users under 18, Apple’s iMessage and Snapchat were the services most often tied to these threats.

The messages victims receive are chilling. The regulator cited lines like “I have everything to ruin your life” and “only money can help you now to end this peacefully.”

Why aren’t the platforms stopping this?

The frustrating part is that the technology to catch this already exists. Language analysis can flag the well-worn coercion scripts these criminals reuse, and detection tools can monitor live streams and video calls. eSafety found most platforms are simply not using them. Microsoft was the only company that reported using both.

eSafety Commissioner Julie Inman Grant said offenders are exploiting weak detection systems and inconsistent safeguards to hop between services and escalate the harm.

University of Sydney academic Dr Joanne Gray argued the companies remain stuck in reactive mode. “They are taking it down when they find it or are made aware of it, but they are not doing enough to prevent it from being there in the first place,” she said.

It’s clear that these companies need to do better to protect our children. They need to treat them as people and not as revenue-generating assets. And since they are clearly failing to do so, stronger legislation is needed to hold them accountable and better protect children online.

TV Time, the popular TV and movie-tracking app whose pending shutdown has prompted more than 25,000 users to petition against its closure, is getting a reboot of sorts.

One of the app’s original founders, Antonio Pinto, says he’s creating a new TV show tracking app, Bingers, which will attempt to rebuild the best features of TV Time while also addressing the issues that bothered him over the years.

Bingers will offer TV Time’s existing users a potential lifeline soon after the original app disappears from the app stores. It also gives the existing social community another place to go to continue discussing TV episodes, something that not all TV show tracking apps offer. According to data from app intelligence provider Appfigures, TV Time has more than 26.4 million lifetime installs, many of those users potentially helping seed the new app’s community.

Pinto, who is based in Paris, sold his app, then called TVShow Time, to Whipclip (now Whip Media) in 2016, after the company promised it could grow the app’s user base significantly thanks to its Los Angeles ties. When he heard the app was being wound down as Whip Media shifted its focus to AI, Pinto said he felt sad.

“Sad because TV Time was part of my life for so many years. And sad because this community was like my other family. Reading the community reactions after each episode became a ritual for me, and for many others,” Pinto wrote in a blog post on the new Bingers website.

“I decided to build the new home where the TV Time community could go. I wanted to rebuild all TV Time[‘s] great features, but also fix everything that always bothered me,” he said.

Notably, the new Bingers app will address TV Time’s performance issues, which often caused the app to load slowly and made it expensive to run. Pinto claims high server costs led to the shutdown, noting that its premium subscription plan only covered about 10% of those expenses due to the size of its community.

Instead, Bingers has been architected it keep its server costs low, making it more sustainable, Pinto claims. It will also allow the app to respond faster when users mark an episode as watched, even when millions of others are connecting at the same time.

The developer tells TechCrunch that the new app will be available on the App Store and Google Play by the end of July 2026. Until then, the website is collecting sign-ups for a waitlist that will alert users when the new app is ready for launch.

Of course, Bingers will also be able to import data from users’ TV Time archives, available through the app’s GDPR-compliant export tool before its removal from the app stores on July 15. By importing users’ archives, Pinto says Bingers will be able to recreate TV Time’s community comments as well.

The archive import is already up and running on the Bingers website, so your TV viewing history will already be available when the app launches on the app stores.

The Federal Aviation Administration (FAA) has cleared SpaceX to fly Starship prototypes again, after the company identified the probable cause of the failure of the rocket system’s booster stage during a flight in May.

SpaceX said over the weekend that the next flight of Starship could happen as soon as this Thursday, July 16. It would be the second-ever launch of the third version, or V3, of Starship. SpaceX also said that this Starship will carry the first third-generation Starlink satellites to space. Previously, Starship had only carried dummy versions of the larger, more powerful internet satellites.

This is SpaceX’s second test flight of its Starship system, and it’s first as a public company, testing the market’s appetite for the company’s “fly, fail, fix” approach to rocket development that often ends in fireballs — or, as CEO Elon Musk calls the explosions: “rapid unscheduled disassembly.” SpaceX completed its IPO and publicly listed on the Nasdaq Stock Exchange on June 12, making it one of the ten most valuable companies in the world and raising nearly $86 billion, a record.

SpaceX’s first test launch of the V3 Starship on May 22 was largely successful. The company’s Super Heavy booster lifted the 407-foot rocket into space before the upper stage section separated and deployed 20 satellite simulators along with two modified Starlinks that recorded footage of the Starship exterior.

The new third-generation booster was supposed to return to Earth and perform a simulated landing in the Gulf of Mexico. But its engines didn’t properly re-ignite, and it instead plummeted into the water below.

The problem happened at that moment of booster separation, according to SpaceX and the FAA. SpaceX said in a post published over the weekend that “slight differences in engine startup on the ship” caused the Booster to turn 90 degrees in the wrong direction. SpaceX said it has modified this engine startup sequence to allow the booster to “more reliably flip in the desired direction” and that the booster has been modified to “improve re-light reliability.”

The FAA said in a statement Monday that the most probable root causes of the Super Heavy booster failure were “heat effects on propulsion system components during the [rocket’s] ascent and erroneous engine alarm system settings.” SpaceX said in its post that it has made changes to Starship’s engine alarm and abort systems that should reduce the chance of a similar failure in the future.

While the first upper stage of Starship V3 was able to successfully deploy its test payload in May and simulate a landing in the Gulf — a milestone SpaceX had struggled to reach before — it also did so while losing one of the three Raptor engines that are meant to be used in the vacuum of space. SpaceX said over the weekend that it has made “[s]everal hardware and operational modifications” to prevent this from happening again.

This next Starship test flight will see the company launch the first of its V3 Starlink satellites to space, which are supposed to increase the satellite network’s capacity and user speeds. SpaceX is planning to deploy 20 of these new satellites during the launch. They are designed to connect with the larger Starlink constellation “via high-capacity lasers” and then burn up in the atmosphere roughly 20 minutes after they are deployed, according to SpaceX. Six of them will be equipped with cameras to photograph the exterior of Starship.

The V3 versions of both Starship and Starlink are crucial to SpaceX’s future. Starlink was the only profitable part of SpaceX’s business in the run-up to its IPO, and SpaceX needs Starship to become a fully reusable rocket system to even attempt its galaxy-brained plans for space-based data centers and interplanetary travel.

A dedicated outdoor TV? Surely that’s a luxury too far, and who could possibly want one? Turns out, I do.

I’ve long been a fan of watching outside, particularly sport.

Back in 2010 when ITV HD launched, I set up a friend’s inflatable projector screen and we watched the England vs USA World Cup game. It felt amazing, except for when ITV cut to a car advert, rather than showing the goal, but you can’t have everything.

Since then, improvements in technology have meant that projectors have got better, smaller, brighter and smarter. Come the Euro 2020 final (actually held in 2021), we had our garden full of friends, a projector screen attached to my office at the bottom of the garden, and the game at a massive size.