Turn on directory listing on a public web server and sooner or later somebody sees everything you were hoping to hide. That includes attackers. This week a French security firm walked straight through the front door of a live Microsoft 365 phishing operation because the person running it left python3 -m http.server 8080 sitting in his own bash history, directory browsing switched on, nothing password-protected. Good cybersecurity practice isn’t usually about exotic zero-days. Most days it’s about who forgot to lock a door, and this week three separate stories prove the door doesn’t care who you are.

The Phishing Kit That Phished Itself

Lexfo researchers found the exposed server almost by accident while tracking a Microsoft 365 credential-harvesting campaign. One careless command, still readable in shell history, handed them a full directory listing of the attacker’s toolkit. From there they pivoted into two more active Evilginx phishing operations run by the same crew.

Evilginx is a reverse-proxy phishing framework built specifically to defeat multi-factor authentication by capturing session tokens in real time. It’s genuinely dangerous in the wrong hands. And it still got taken apart by the same mistake that costs defenders their own servers every day: spinning up a quick tool, forgetting it’s exposed, and never checking what’s actually reachable from the outside.

The irony is worth sitting with for a second. The operator built a kit sophisticated enough to bypass MFA and lost it all to a debug server nobody remembered to shut off.

Old Software Still Eats Zero-Days For Breakfast

CISA added two Joomla extension flaws to its Known Exploited Vulnerabilities catalog this week, both scoring a perfect 10.0 on CVSS. CVE-2026-48939 and its companion bug hit the iCagenda booking extension and Balbooa’s form builder, and both were exploited as zero-days before patches existed. These aren’t niche add-ons either; Balbooa’s tools sit on a meaningful slice of small business Joomla sites, which means the blast radius is wide and mostly unmonitored.

A CMS plugin isn’t glamorous. It’s also exactly the kind of software that never gets a second look once it’s installed and working. Threat intelligence teams have been saying for years that attackers go where the attention isn’t, and a forms plugin nobody’s audited since 2022 is precisely that spot.

What connects the phishing server and the Joomla extensions is the same failure mode wearing two different outfits. One is a tool someone stood up and forgot about. The other is a tool someone installed and forgot about. Neither one got a second look until it was already being exploited.

Now They’re Scanning For Your AI Assistant Too

The SANS Internet Storm Center flagged scanning activity this week specifically probing for exposed MCP servers and AI assistant credentials. MCP, the Model Context Protocol, is how a lot of AI coding tools and agents talk to external systems, and plenty of teams stood these up fast without giving them the same scrutiny they’d give a database or an API gateway. Scanners have noticed. They always do.

None of this requires a new playbook. It requires actually running the old one against whatever you stood up last quarter.

• Inventory every internet-facing service you’ve spun up in the last six months, including “temporary” debug servers and MCP endpoints, and kill anything that isn’t documented and owned.
• Put a firewall rule and brute-force lockout in front of anything with a login, including AI agent credentials, service accounts, and admin panels for CMS plugins.
• Patch Joomla extensions and any third-party plugin the same day a KEV entry lands, not on the next maintenance window.
• Turn off directory listing and default debug modes by default, and check for them on a schedule, not just when someone stumbles across the problem.
• Build threat detection around anomalous outbound connections from AI tooling, since that’s the traffic pattern most teams have zero baseline for right now.

Defense in depth still means the same thing it always did: assume one layer fails and make sure the next one catches it. The layer that keeps failing across all three of these stories isn’t encryption or authentication. It’s basic exposure hygiene, the boring stuff that never makes it onto a roadmap because nobody thinks it’s their job to check.

Incident response teams love talking about sophisticated actors and novel malware. Most of the time the actual story is a server nobody remembered was running.

Sources

• Someone Is Scanning for Your MCP Servers and AI Assistant Credentials
• Organizations Warned of Exploited Joomla Extension Vulnerabilities
• Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365
• iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days