What happened<\/h2>\n
Theo CISA, CVE-2026-48908 v\u00e0 CVE-2026-56290 \u0111\u00e3 \u0111\u01b0\u1ee3c th\u00eam v\u00e0o KEV ng\u00e0y 7\/7\/2026 v\u00ec c\u00f3 d\u1ea5u hi\u1ec7u b\u1ecb khai th\u00e1c trong th\u1ef1c t\u1ebf. V\u1edbi JoomShaper SP Page Builder, l\u1ed7 h\u1ed5ng cho ph\u00e9p t\u1ea3i l\u00ean t\u1ec7p nguy hi\u1ec3m m\u00e0 kh\u00f4ng c\u1ea7n x\u00e1c th\u1ef1c \u0111\u1ea7y \u0111\u1ee7, m\u1edf \u0111\u01b0\u1eddng cho th\u1ef1c thi m\u00e3 t\u1eeb xa v\u00e0 t\u1ea1o t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb \u1ea9n. V\u1edbi PageBuilder CK, nh\u00e0 nghi\u00ean c\u1ee9u t\u1eeb mySites.guru m\u00f4 t\u1ea3 l\u1ed7i t\u1ea3i t\u1ec7p kh\u00f4ng c\u1ea7n \u0111\u0103ng nh\u1eadp, trong \u0111\u00f3 k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 ch\u1ecdn c\u1ea3 th\u01b0 m\u1ee5c \u0111\u00edch v\u00e0 t\u00ean t\u1ec7p, d\u1eabn t\u1edbi kh\u1ea3 n\u0103ng \u0111\u1eb7t web shell tr\u00ean m\u00e1y ch\u1ee7.<\/p>\n
The Hacker News ghi nh\u1eadn c\u1ea3 hai l\u1ed7 h\u1ed5ng \u0111\u1ec1u c\u00f3 \u0111i\u1ec3m CVSS 10.0 v\u00e0 n\u1eb1m trong nh\u00f3m \u0111i\u1ec3m y\u1ebfu \u0111ang b\u1ecb khai th\u00e1c c\u00f9ng th\u1eddi \u0111i\u1ec3m v\u1edbi m\u1ed9t s\u1ed1 l\u1ed7i Adobe ColdFusion v\u00e0 Langflow. \u0110i\u1ec3m \u0111\u00e1ng ch\u00fa \u00fd l\u00e0 \u0111\u00e2y kh\u00f4ng ph\u1ea3i c\u00e1c s\u1ea3n ph\u1ea9m h\u1ea1 t\u1ea7ng l\u00f5i nh\u01b0 h\u1ec7 \u0111i\u1ec1u h\u00e0nh hay VPN, m\u00e0 l\u00e0 ti\u1ec7n \u00edch m\u1edf r\u1ed9ng ph\u1ee5c v\u1ee5 qu\u1ea3n tr\u1ecb n\u1ed9i dung. \u0110i\u1ec1u \u0111\u00f3 khi\u1ebfn nhi\u1ec1u t\u1ed5 ch\u1ee9c d\u1ec5 b\u1ecf s\u00f3t trong danh m\u1ee5c t\u00e0i s\u1ea3n c\u1ea7n v\u00e1 kh\u1ea9n c\u1ea5p.<\/p>\n
V\u00ec sao ti\u1ec7n \u00edch x\u00e2y d\u1ef1ng trang tr\u1edf th\u00e0nh m\u1ee5c ti\u00eau h\u1ea5p d\u1eabn<\/h2>\n
C\u00e1c plugin ho\u1eb7c component x\u00e2y d\u1ef1ng trang th\u01b0\u1eddng c\u00f3 quy\u1ec1n thao t\u00e1c v\u1edbi n\u1ed9i dung, h\u00ecnh \u1ea3nh, bi\u1ec3u m\u1eabu v\u00e0 t\u1ec7p media. Khi m\u1ed9t endpoint t\u1ea3i t\u1ec7p thi\u1ebfu ki\u1ec3m so\u00e1t x\u00e1c th\u1ef1c, thi\u1ebfu danh s\u00e1ch ph\u1ea7n m\u1edf r\u1ed9ng \u0111\u01b0\u1ee3c ph\u00e9p ho\u1eb7c cho ph\u00e9p ch\u1ecdn th\u01b0 m\u1ee5c t\u00f9y \u00fd, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 bi\u1ebfn t\u00ednh n\u0103ng h\u1ee3p ph\u00e1p th\u00e0nh \u0111\u01b0\u1eddng \u0111\u01b0a m\u00e3 \u0111\u1ed9c l\u00ean website.<\/p>\n
V\u1edbi c\u00e1c website doanh nghi\u1ec7p nh\u1ecf, agency ho\u1eb7c t\u1ed5 ch\u1ee9c v\u1eadn h\u00e0nh nhi\u1ec1u trang Joomla, c\u00f9ng m\u1ed9t component c\u00f3 th\u1ec3 xu\u1ea5t hi\u1ec7n tr\u00ean h\u00e0ng ch\u1ee5c website. M\u1ed9t l\u1ed7i ch\u01b0a v\u00e1 v\u00ec th\u1ebf kh\u00f4ng c\u00f2n l\u00e0 v\u1ea5n \u0111\u1ec1 c\u1ee7a m\u1ed9t website ri\u00eang l\u1ebb, m\u00e0 tr\u1edf th\u00e0nh r\u1ee7i ro chu\u1ed7i v\u1eadn h\u00e0nh: ch\u1ec9 c\u1ea7n m\u1ed9t b\u1ea3n c\u00e0i c\u0169 b\u1ecb qu\u00e9t th\u1ea5y, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 chi\u1ebfm quy\u1ec1n, c\u00e0i backdoor, t\u1ea1o t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb gi\u1ea3 ho\u1eb7c d\u00f9ng m\u00e1y ch\u1ee7 \u0111\u1ec3 ph\u00e1t t\u00e1n n\u1ed9i dung \u0111\u1ed9c h\u1ea1i.<\/p>\n
![\"Trung](\"https:\/\/vncybers.vn\/wp-content\/uploads\/2026\/07\/cern-datacenter-inline-1200.jpg\")
<\/p>\n
B\u00e0i h\u1ecdc qu\u1ea3n tr\u1ecb t\u1eeb c\u1ea3nh b\u00e1o KEV<\/h2>\n
\u0110i\u1ec3m quan tr\u1ecdng nh\u1ea5t c\u1ee7a KEV l\u00e0 y\u1ebfu t\u1ed1 th\u1ef1c chi\u1ebfn. M\u1ed9t l\u1ed7 h\u1ed5ng khi \u0111\u00e3 xu\u1ea5t hi\u1ec7n trong danh m\u1ee5c n\u00e0y kh\u00f4ng n\u00ean \u0111\u01b0\u1ee3c x\u1eed l\u00fd nh\u01b0 c\u1ea3nh b\u00e1o l\u00fd thuy\u1ebft. CISA y\u00eau c\u1ea7u c\u00e1c c\u01a1 quan li\u00ean bang M\u1ef9 \u01b0u ti\u00ean kh\u1eafc ph\u1ee5c c\u00e1c l\u1ed7 h\u1ed5ng KEV tr\u00ean t\u00e0i s\u1ea3n l\u1ed9 Internet, \u0111\u1ed3ng th\u1eddi ki\u1ec3m tra d\u1ea5u hi\u1ec7u h\u1ec7 th\u1ed1ng \u0111\u00e3 b\u1ecb x\u00e2m nh\u1eadp tr\u01b0\u1edbc khi b\u1ea3n v\u00e1 \u0111\u01b0\u1ee3c \u00e1p d\u1ee5ng. \u0110\u00e2y c\u0169ng l\u00e0 c\u00e1ch ti\u1ebfp c\u1eadn ph\u00f9 h\u1ee3p cho doanh nghi\u1ec7p ngo\u00e0i khu v\u1ef1c c\u00f4ng.<\/p>\n
V\u1edbi Joomla, nh\u00f3m qu\u1ea3n tr\u1ecb n\u00ean ki\u1ec3m k\u00ea to\u00e0n b\u1ed9 website c\u00f3 c\u00e0i SP Page Builder ho\u1eb7c PageBuilder CK, x\u00e1c \u0111\u1ecbnh phi\u00ean b\u1ea3n \u0111ang ch\u1ea1y v\u00e0 c\u1eadp nh\u1eadt l\u00ean b\u1ea3n \u0111\u00e3 v\u00e1. SP Page Builder \u0111\u01b0\u1ee3c khuy\u1ebfn ngh\u1ecb n\u00e2ng l\u00ean 6.6.2 ho\u1eb7c m\u1edbi h\u01a1n; PageBuilder CK c\u1ea7n n\u00e2ng l\u00ean 3.6.0 cho d\u00f2ng hi\u1ec7n t\u1ea1i ho\u1eb7c b\u1ea3n v\u00e1 t\u01b0\u01a1ng \u1ee9ng v\u1edbi m\u00f4i tr\u01b0\u1eddng Joomla c\u0169. Sau khi c\u1eadp nh\u1eadt, vi\u1ec7c r\u00e0 so\u00e1t t\u00e0i kho\u1ea3n Super User l\u1ea1, t\u1ec7p PHP b\u1ea5t th\u01b0\u1eddng trong th\u01b0 m\u1ee5c media, images, templates v\u00e0 administrator l\u00e0 b\u01b0\u1edbc kh\u00f4ng th\u1ec3 b\u1ecf qua.<\/p>\n
Kh\u00f4ng ch\u1ec9 v\u00e1, m\u00e0 ph\u1ea3i ki\u1ec3m so\u00e1t t\u00e0i s\u1ea3n<\/h2>\n
Nhi\u1ec1u s\u1ef1 c\u1ed1 website kh\u00f4ng b\u1eaft \u0111\u1ea7u t\u1eeb m\u1ed9t l\u1ed7 h\u1ed5ng ph\u1ee9c t\u1ea1p, m\u00e0 t\u1eeb m\u1ed9t component c\u0169 b\u1ecb qu\u00ean trong qu\u00e1 tr\u00ecnh v\u1eadn h\u00e0nh. V\u00ec v\u1eady, quy tr\u00ecnh qu\u1ea3n tr\u1ecb an to\u00e0n n\u00ean bao g\u1ed3m danh m\u1ee5c plugin\/component, ng\u01b0\u1eddi ch\u1ecbu tr\u00e1ch nhi\u1ec7m c\u1eadp nh\u1eadt, l\u1ecbch ki\u1ec3m tra \u0111\u1ecbnh k\u1ef3, c\u1ea3nh b\u00e1o khi extension h\u1ebft h\u1ea1n h\u1ed7 tr\u1ee3 v\u00e0 kh\u1ea3 n\u0103ng tri\u1ec3n khai b\u1ea3n v\u00e1 h\u00e0ng lo\u1ea1t khi c\u00f3 KEV m\u1edbi.<\/p>\n
Trong b\u1ed1i c\u1ea3nh bot t\u1ef1 \u0111\u1ed9ng c\u00f3 th\u1ec3 qu\u00e9t v\u00e0 khai th\u00e1c website ch\u1ec9 trong th\u1eddi gian ng\u1eafn sau khi th\u00f4ng tin k\u1ef9 thu\u1eadt \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1, t\u1ed1c \u0111\u1ed9 ph\u1ea3n \u1ee9ng l\u00e0 m\u1ed9t l\u1edbp ph\u00f2ng th\u1ee7 th\u1ef1c t\u1ebf. C\u1ea3nh b\u00e1o l\u1ea7n n\u00e0y cho th\u1ea5y nh\u1eefng n\u1ec1n t\u1ea3ng qu\u1ea3n tr\u1ecb n\u1ed9i dung ph\u1ed5 bi\u1ebfn v\u1eabn c\u1ea7n \u0111\u01b0\u1ee3c \u0111\u01b0a v\u00e0o c\u00f9ng m\u1ee9c \u01b0u ti\u00ean v\u1edbi m\u00e1y ch\u1ee7, VPN, email gateway v\u00e0 c\u00e1c d\u1ecbch v\u1ee5 l\u1ed9 Internet kh\u00e1c.<\/p>\n
Recommendations for Administrators<\/h2>\n
Qu\u1ea3n tr\u1ecb vi\u00ean n\u00ean \u01b0u ti\u00ean ki\u1ec3m k\u00ea website Joomla \u0111ang s\u1eed d\u1ee5ng JoomShaper SP Page Builder ho\u1eb7c PageBuilder CK, c\u1eadp nh\u1eadt ngay c\u00e1c phi\u00ean b\u1ea3n b\u1ecb \u1ea3nh h\u01b0\u1edfng, r\u00e0 so\u00e1t t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb m\u1edbi ph\u00e1t sinh v\u00e0 t\u00ecm t\u1ec7p PHP \u0111\u00e1ng ng\u1edd trong c\u00e1c th\u01b0 m\u1ee5c c\u00f3 th\u1ec3 ghi. V\u1edbi \u0111\u01a1n v\u1ecb v\u1eadn h\u00e0nh nhi\u1ec1u website kh\u00e1ch h\u00e0ng, n\u00ean d\u00f9ng c\u00f4ng c\u1ee5 qu\u1ea3n l\u00fd t\u1eadp trung \u0111\u1ec3 bi\u1ebft ch\u00ednh x\u00e1c website n\u00e0o \u0111ang ch\u1ea1y extension n\u00e0o, thay v\u00ec ph\u1ee5 thu\u1ed9c v\u00e0o ki\u1ec3m tra th\u1ee7 c\u00f4ng t\u1eebng trang.<\/p>\n
V\u1ec1 d\u00e0i h\u1ea1n, m\u1ecdi extension c\u00f3 ch\u1ee9c n\u0103ng t\u1ea3i t\u1ec7p, ch\u1ec9nh giao di\u1ec7n, t\u1ea1o form ho\u1eb7c t\u01b0\u01a1ng t\u00e1c v\u1edbi API b\u00ean ngo\u00e0i c\u1ea7n \u0111\u01b0\u1ee3c xem l\u00e0 t\u00e0i s\u1ea3n c\u00f3 r\u1ee7i ro cao. Khi CISA ho\u1eb7c nh\u00e0 cung c\u1ea5p x\u00e1c nh\u1eadn khai th\u00e1c th\u1ef1c t\u1ebf, ph\u1ea3n \u1ee9ng \u0111\u00fang kh\u00f4ng ch\u1ec9 l\u00e0 c\u1eadp nh\u1eadt phi\u00ean b\u1ea3n, m\u00e0 c\u00f2n l\u00e0 \u0111i\u1ec1u tra xem h\u1ec7 th\u1ed1ng \u0111\u00e3 b\u1ecb l\u1ee3i d\u1ee5ng hay ch\u01b0a.<\/p>\n
VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb CISA, The Hacker News v\u00e0 mySites.guru<\/em><\/p>","protected":false},"excerpt":{"rendered":" CISA v\u1eeba \u0111\u01b0a hai l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong h\u1ec7 sinh th\u00e1i Joomla Page Builder v\u00e0o danh m\u1ee5c Known Exploited Vulnerabilities (KEV), sau khi c\u00f3 b\u1eb1ng ch\u1ee9ng khai th\u00e1c th\u1ef1c t\u1ebf. S\u1ef1 ki\u1ec7n n\u00e0y kh\u00f4ng ch\u1ec9 l\u00e0 m\u1ed9t c\u1ea3nh b\u00e1o v\u00e1 l\u1ed7i \u0111\u01a1n l\u1ebb, m\u00e0 c\u00f2n l\u00e0 l\u1eddi nh\u1eafc r\u00f5 r\u00e0ng v\u1ec1 r\u1ee7i ro c\u1ee7a […]<\/p>\n","protected":false},"author":2,"featured_media":1740,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[37,338,339,332,335,334,283,333,337,168,336,340,277],"class_list":["post-1741","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kien-thuc","tag-cisa","tag-cve-2026-48908","tag-cve-2026-56290","tag-joomla","tag-joomlack","tag-joomshaper","tag-kev-catalog","tag-page-builder","tag-pagebuilder-ck","tag-remote-code-execution","tag-sp-page-builder","tag-vulnerability-management","tag-web-shell"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1741","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1741"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1741\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1740"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1741"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1741"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1741"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}