mySites.guru (Joomla/WordPress fleet security)

https://mysites.guru/blog/

Joomla/WordPress fleet-management vendor whose research team discovers and reproduces third-party-extension file-upload-to-RCE zero-days ahead of CVE assignment; original disclosing party for the mid-2026 Joomla extension file-upload RCE wave (SP Page Builder, Page Builder CK, Balbooa Forms) and for CVE-2026-48939 (iCagenda, CISA-KEV 2026-07-10). ADDED as candidate 2026-07-10 (2009Z run), cited as published primary for the iCagenda entry; fetch via jina (`python3 tools/fetch_source.py jina https://mysites.guru/blog/<slug>/`). Promote to active after 3 contributing runs. | 2026-07-11 contributed primary content again (RSFiles! CVE-2026-57827 + Phoca Download CVE-2026-57828, two more members of the Joomla-extension CWE-434 file-upload wave); consistent dated technically-precise disclosures, candidate still awaiting activation. | 2026-07-26 weekly quality audit: promoted candidate → active on the documented lifecycle bar (cited by published entries from 5 distinct runs; the bar is 3). The promotion had never been executed because nothing counted contributing runs, the digest now emits sources.promotion_due (tools/run_summary.py). | 2026-07-28: jina reader returned navigation chrome only. No demotion, transport/anti-bot block, not content death. | 2026-08-11: reader returns the extension-vulnerability post listing but with no per-item publication dates, so in-window status cannot be established for any item; S1 and S3 hit this independently. Recency-uncertain listings are excluded rather than included speculatively; a dated feed path for this publisher is the open recipe question. | 2026-08-24 (0902Z quality audit) ROOT-CAUSE FIX: fetch_method was pinned to `jina` with rss_url null while the reader key pool is fully exhausted, so the ORIGINAL disclosing party for the recurring Joomla third-party-extension RCE stream was effectively unfetchable. Three audits (2026-07-26, 08-02, 08-24) recovered a miss from this stream. `https://mysites.guru/rss.xml` returns HTTP 200 with dated items over direct transport (verified 2026-08-24). Do NOT re-pin to jina.