Joomla iCagenda/Balbooa CVE-2026-48939: RCE Zero-Day

Two Joomla extensions got hit as zero-days before either vendor had a CVE number to point to. iCagenda and Balbooa Forms. Both bugs pull a perfect 10.0 on CVSS, and CISA has now put them in the federa