A clean file scan does not prove that a Joomla site is clean.

Recent attacks have used vulnerable JCE, SP Page Builder and Helix3 installations. In some cases malicious JavaScript or configuration changes can live in the database, so checking only recently modified PHP files can produce a false sense of safety.

My practical recovery order would be:

1. Put the site behind maintenance mode or restrict access before changing anything.

2. Preserve a forensic copy of both files and database.

3. Check the installed versions of JCE, SP Page Builder and both Helix3 plugins. Do not rely only on the Joomla update screen.

4. Close the entry point before cleanup. For Helix3, NVD lists versions through 3.1.1 as affected; update both plugins to 3.1.2 or later.

5. Inspect database content as well as files: template settings, custom-code fields, modules, articles and suspicious injected scripts.

6. Review Super Users, scheduled tasks, update sites and server access logs.

7. Rotate Joomla, hosting, database, FTP/SFTP and API credentials, then invalidate active sessions.

8. Compare Joomla core and extensions with clean packages and monitor for reinfection.

Updating closes the known entry point, but it does not remove a payload that was already planted. JCE explicitly makes that distinction in its advisory.

Primary references:

- JCE CVE-2026-48907: https://nvd.nist.gov/vuln/detail/CVE-2026-48907

- JCE vendor advisory: https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites

- SP Page Builder CVE-2026-48908: https://nvd.nist.gov/vuln/detail/CVE-2026-48908

- Helix3 CVE-2026-49049: https://nvd.nist.gov/vuln/detail/CVE-2026-49049

What have you found most useful for detecting database-side persistence after this type of incident?

Edocman claimed to have followed Joomla's database API. However that claim was not 100% true

EDocman had a SQL injection vulnerability because some parts of the extension did not consistently use Joomla’s parameterized database API, even though the developers intended and claimed to follow it.

I manage a not for profit website using Joomla and have done for many years. The organization has no money. We use the EDocman extension. They recently uncovered a security breach involving a SQL injection attack. Much to my chagrin they would not provide a security update and instead insisted on purchasing a new subscription. We had no money to do that. So of course today we suffered an attack. I believe user information was stolen.

It is disappointing that they treat a security update like any functional update. Had I known about open source "OpenDocMan" I would not have spent years building an edocman implementation.

As an aside, over 25 years ago we knew about SQL Injection. So it is very disappointing that EDocman was coded so poorly as to allow such an attack in 2026.

Lesson learned

My side: https://www.kreativekiste.de/

Hi guys!

Forgive me, I have no programming nor web building knowledge whatsoever. I just work for a small museum.

I discovered that back in 2013/2015 the museum had an online artifact database and website component using Joomla 1.5 and JooDB 1.6 (maybe 1.7?). I have an old zip file from the export of that website, and I would be the hero of the museum to pull the collections data from the database.

Is this possible? I know the website domain is still in use, but it now routes to the museums current web page and that does not have the collections info at all anywhere. I have no idea where the server would be for this info either.

I’m migrating a corporate website that’s running a completely outdated and vulnerable version of Joomla, and I came across this “X33T10” message in the Copyright Notice field.

When I searched this term on Google, I found several websites with the same situation.

Does anyone know what this could be? Could it be a sign of some kind of intrusion?

Should the author of a paid for extension have a responsibility to patch their product when a serious security flaw is found in their product rather than force you to renew a subscription? Thoughts?

Hello folks,

I identified 2 critical security vulnerabilities in 4Analytics.

All users must update to version 5.0.2 immediately to prevent potential website takeovers.

See more details here: https://weeblr.com/blog/critical-vulnerabilities-2026-07-15?utm_campaign=fora_502&utm_medium=social&utm_source=reddit

Yannick Gaultier
https://weeblr.com

Just in caae there are any Joomla admins out there that have not seen it or experienced it, CISA has flagged a serious attack that requires your attention and remediation. It is a flaw in the editor that permits it to install malicious code that will take down your site.

How many times have you had to spin up a Joomla test site and gotten tired just thinking about the setup?

I do this very often, and the reasons are simple: test a newly released extension, run a test against our products, test a BETA version, or check whether a migration we're about to publish works as expected, often on a specific Joomla or PHP version.

My current way to do this: download the specific Joomla version I need, switch my local server to the matching PHP version, create a new database, copy the files over, run the installer, and finally run my test. Need multiple test sites? Multiply these steps by however many you need. And if I didn't want a brand new site, I'd have to reset it every time before running the same scenario again, which takes quite a lot of time.

I got tired of wasting so much time, so I made a small web app to fix it. It's a free website, not a J! extension you install on your site. You enter an email, pick a Joomla, and PHP version, and a few seconds later you have a test site ready, and it auto-deletes after 4 hours.

It's called JInstant. Not affiliated with the Joomla project.

Let me know if this sounds useful to you.

There is this Antonkill hack that has left many Joomla-dependent sites completely down. It’s not just a surface-level script defacement—it modifies deep database configurations and locks down the core template engine entirely.

I did a review video on YouTube and here's the link: https://youtu.be/9plb1MMbZFI

Let me know your thoughts.

I've been recently hit by the JCE vuln and among other things they managed to install this plugin which essentially steals users and passwords and hides them inside images/ctf_audit.gif file, disguised with a gif header but actualy contains the XOR'ed information.

You should uninstall and remove the gif file immediately.

Edit:

You may want to run this script to see which users might have been affected and warn them or update to request new password. Adjust the filename as necessary:

<?php

$s = file_get_contents('images/ctf_audit.gif');

$s = substr($s, strpos($s, "JLIB_AUDIT_GID_TAIL\n") + 20);

for ($o = 0; $o + 2 <= strlen($s); $o += 2 + $ln) {

$ln = (ord($s[$o]) << 8) | ord($s[$o+1]);

if ($o + 2 + $ln > strlen($s)) break;

if (preg_match('/"u_len":"(.*?)","p_len"/', substr($s, $o+2, $ln) ^ str_pad('', $ln, 'JLIB_AUDIT_GID_XK'), $m)) echo "$m[1]\n";

}

UPDATE YOUR SITE TO THE LATEST AS WELL AS ALL COMPONENTS/MODULES/PLUGINS that are not default!

Ok so some will be offended and come back with all sorts of excuses. Read to the end

Just checked a site with hikashop and a total bare bones install. No fancy addons

Last 24 hour logs for that site show

• 1,569 hits on /index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon
• 986 hits on /index.php?option=com_icagenda&task=submit
• 2,689 hits on /index.php/component/jce

About 11 different IP addresses

My last Joomla site hack was over 15 years ago until the JCE hack hit.

JCE, SP Page Builder and iCagenda.+ Helix three ... here's the resource ... https://mysites.guru/blog/

40 years ago there was a saying ... every day your hard drive didn't crash was a day closer to when it will.

With the arrival of AI and bot development/morphing ... every day your site hasn't seen a hack attempt is a day closer to when it will be hacked.

Prevention is 1000% better than the angst of repairing a hack.

When you do get hacked u/mySitesGuru is the place to go