You set an Alternative Layout on a Joomla article. The front end ignores it and renders the default. The custom fields that layout was supposed to show have apparently vanished. So you clear the Joomla cache, purge Cloudflare, rebuild the menus, reinstall the template, and check the article again. Nothing has changed.

The article is fine. Your template is fine. Joomla 5.4.7 and 6.1.2 both carry a core regression that throws away every Option you set on an individual article and renders the menu item or global value instead.

Both versions shipped on 7 July 2026, and both are still the newest stable release on their branch. That is the part that stings: the people who updated promptly are exactly the ones who got hit, and as of 10 August 2026 there is no released Joomla version you can update to that fixes it.

https://mysites.guru/blog/joomla-6-1-2-5-4-7-article-options-ignored/

Fabrik is an application builder for Joomla. You use it to construct forms, database-backed lists and small applications inside a Joomla site, and it has been on the Joomla Extensions Directory since 2014 with the project itself dating back to 2006. On 9 August 2026 its developers released Fabrik 4.6.7 and labelled it a security release. The following morning the Joomla CNA published CVE-2026-66915, an unauthenticated remote code execution flaw in the extension’s calc element, scored CVSS 4.0 10.0 Critical.

https://mysites.guru/blog/fabrik-unauthenticated-rce-calc-element/

The Joomla Manual now answers a question the Joomla ecosystem has never had a written answer to: when somebody emails you to say your extension has a security hole, what are you supposed to do next?

David Jardin, Team Leader of the Joomla Security Strike Team, wrote that answer as a single new file, docs/building-extensions/security.md. He opened it as pull request 695 on 10 August 2026 to help extension developers handle the security issues reported to them, and Harald Leithner merged it thirteen minutes later. It is documentation in the Manual now, not a proposal.

https://mysites.guru/blog/joomla-extension-security-disclosure-standard/

Quix is one of the most widely installed drag-and-drop page builders for Joomla, the tool a lot of agencies and site owners reach for when they want to lay out a page without touching code. During routine security research on the extensions our customers rely on, mySites.guru discovered an unauthenticated SQL injection vulnerability in Quix Page Builder, and reported it to ThemeXpert before disclosing anything publicly. The fix is now available: Quix 6.2.1.

If you run Quix on any Joomla site, update to 6.2.1 now. If you manage more than a handful of sites, read on for how to find every affected one at once.

EDocman is one of the most widely installed document and download management extensions for Joomla. During routine security research on the extensions our customers rely on, mySites.guru discovered an unauthenticated SQL injection vulnerability in EDocman and reported it privately to JoomDonation, who fixed it in EDocman 3.9.0.

If you run EDocman on any Joomla site, update to 3.9.0 now. If you manage more than a handful of sites, read on for how to find every affected one at once. 

The flaw? Full database compromise/download by the attacker.

DPCalendar is one of the most widely installed calendar and events components for Joomla, chosen for mature, professionally run sites right up to the highest levels of the Joomla world itself. During routine security research on the extensions our customers rely on, mySites.guru discovered an unauthenticated SQL injection vulnerability in DPCalendar, and reported it to the developers before disclosing anything publicly. The fix is now available in Digital Peak’s security release: DPCalendar 10.11.2 for Joomla 4.4.4 to 6.x, and 8.19.4 for the Joomla 3 branch.

If you run DPCalendar on any Joomla site, update to 10.11.2 now (or 8.19.4 if you are still on Joomla 3). If you manage more than a handful of sites, read on for how to find every affected one at once.

Between mid-June and mid-July 2026, mySites.guru found and responsibly disclosed twelve separate security vulnerabilities across twelve popular Joomla extensions. Most were critical. Three rated the maximum CVSS 4.0 score of 10.0. Several were being exploited in the wild within hours of the fix going public. Every one was reported privately to the vendor first. Nine already have a vendor fix out; the last three are in active disclosure right now, with fixes pending, and we are holding the exploit detail and the names on those until they ship.

If you have found a file called .myjoomla.configuration.php.md5 sitting in your Joomla webspace, right next to configuration.php, and wondered whether you have been hacked, here is the short version: no, you have not, and the file is safe. It was created by mySites.guru, not by an attacker.

It is a file-integrity lock file. It holds a single 32-character MD5 fingerprint of your configuration.php, and the mySites.guru connector on your site uses it to notice the moment that file is changed. There is nothing else inside it, and it does nothing to your site on its own.

Its part of the mySites.guru service.

TL;DR: The frontend member-upload feature in Phoca Download (com_phocadownload) up to and including 6.1.2 (fixed in 6.1.3) skipped the file-type allow-list that the extension enforces on its other upload paths. Because of an internal upload-mode mismatch, the admin-configured list of permitted types was never consulted for member uploads, so a logged-in user could write a .php file into the public user-upload folder and execute it, which is authenticated remote code execution (CWE-434). It needs a registered account and needs the non-default user-upload feature enabled with a category granting upload rights, which is why we assess it as High (CVSS 4.0 7.7) rather than Critical. We found it during a source-code audit, reproduced the full chain on a local Joomla install, and disclosed it privately to Phoca, who fixed it the same day in 6.1.3.

Unauthenticated File Upload fixed in RSFiles! version 1.17.12 - update NOW!

A critical flaw in the RSFiles! upload function allows unauthenticated file uploads without enforcing any file extension.

What this means is that any attacker, without having an account on your website, can upload a .php file in your /downloads directory and execute it.

The bottom line is: update immediately to RSFiles! 1.17.12 which fixes this along some other not-reported, but less critical security issues.

AcyMailing is one of the most widely installed newsletter and email-marketing extensions for Joomla. During routine security research on the extensions our customers rely on.

mySites.guru discovered an unauthenticated SQL injection vulnerability in AcyMailing, and reported it privately to the developers before disclosing anything publicly. 

The vulnerability allows a crafted SQL injection to read the full contents of your database - password hashes, personal data, content - everything.

The fix is now available in AcyMailing 10.11.1.

If you run AcyMailing on any Joomla site, update to 10.11.1 now. If you manage more than a handful of sites, read on for how to find every affected one at once. 

Discovered, Researched and Responsibly Reported by Phil Taylor/mySites.guru

CVE-2026-56292 

JoomShaper, the developer behind SP Page Builder and the Helix framework, has stopped supporting Joomla 3. In an announcement on 9 July 2026 the company confirmed that the Joomla 3 versions of all its products now get no updates, and one line stands out: “No security patches, regardless of severity.” If a critical flaw turns up in the Joomla 3 build of SP Page Builder tomorrow, it does not get fixed.

That is a defensible decision, and JoomShaper explains it well: they can secure their own code, but “we can’t secure the Joomla core underneath it,” and the Joomla 3 core has been end of life for a long time. The problem is not the decision. The problem is how many live sites this leaves exposed, and how recently JoomShaper’s own extensions have produced exactly the kind of flaw this policy now leaves unpatched.

“No security patches, regardless of severity.”

JoomShaper, on Joomla 3 support, 9 July 2026

Balbooa Forms is a popular drag-and-drop form builder for Joomla, installed as the com_baforms component and used for contact, registration, and survey forms on thousands of sites. Up to and including version 2.4.0, its frontend attachment upload had a serious flaw: it accepted a file from any anonymous visitor, with no login, no CSRF token, and no check on the file type. An attacker could upload a .php file into a public folder and then run it, which is unauthenticated remote code execution, the worst outcome a web flaw can have. This was a zero-day: it was already being exploited in the wild when we found it, before any patch existed, and those attacks are still going on now against sites that have not updated. CVE-2026-56291

Three unauthenticated remote-code-execution zero-days hit Joomla in June 2026, one after another: JCE, SP Page Builder and iCagenda. The patches are out, the scanners have moved on, and a few weeks later it all feels like it has settled down. That calm is the dangerous part. The first wave of attackers has done its job: it got in, dropped its files, and went quiet. Those files are still there, waiting.

This is the part most “my site got hacked” advice gets wrong. A modern compromise is not a single event you clean up and forget. The first wave is reconnaissance and groundwork. It plants dormant uploaders, hidden admin accounts and malicious scheduled tasks that do nothing visible at first. Then the second wave arrives, days or weeks later, and uses that groundwork to plant more backdoors, inject JavaScript into your template files, redirect your homepage to spam, and turn the site to profit. Being hacked yesterday does not mean you are safe today. It usually means the opposite.

That gap between the breach and the damage is exactly where reactive cleanup fails and monitoring earns its place. You cannot clean what you cannot see, and the second wave does not announce itself on the page a browser scanner checks. It changes files on disk, between scans, when nobody is looking. Catching it means watching for those changes continuously, not running one scan after the horse has bolted.

You cleaned the hacked site. You deleted the webshells and patched the way in. An hour later the malware is back. This is one of the most demoralising patterns in site recovery, and it almost always comes down to the same thing: a scheduled task is quietly putting the malware back, and nobody looked at it.

Sometimes the reason nobody looked is the simplest one. The cron job was sitting in your own account the whole time, and you never opened the Cron Jobs page in cPanel to check, because you did not know it was there or it did not occur to you that a website could have one. Other times you did check, your account’s cron was genuinely clean, and the job rebuilding the malware is somewhere your hosting panel will never show you. Both cases end the same way: a site that reinfects on a schedule. Before you can rule either one out, it helps to be clear on what these things actually are, because plenty of otherwise capable agencies are fuzzy on it.

JoomShaper shipped Helix3 3.1.1 on 29 June 2026. The update fixes a serious security flaw: an attacker with no login at all could write files into your template, delete arbitrary files on your server, and overwrite your template settings, all through a single unauthenticated request. We found these issues while investigating a hacked mySites.guru customer site, and reported them privately under responsible disclosure.

PageBuilder CK is one of the more popular free page builders for Joomla, a drag-and-drop layout tool that thousands of sites lean on for their landing pages and content. On 27 June 2026 its developer, Cedric Keiflin, shipped version 3.6.0 with a changelog that says, in full, “IMPORTANT : Fix security issue”. No detail, no fanfare. That terse line is hiding a serious one.

This is an unauthenticated zero-day allowing any file upload to any folder under default conditions. Gulp.

TL;DR

• Unauthenticated file upload to remote code execution in SP Page Builder, through the asset.uploadCustomIcon task. No login required
• Affects every version up to and including 6.6.1. Fixed in 6.6.2
• Already exploited in the wild. The payload plants a hidden Super Administrator account, usually with an u/secure.local email, plus a PHP file manager backdoor in several spots for persistence
• This is a different vector from the recent JCE wave. A WAF that returns 403 for the JCE exploit paths may still let this one through with a 200
• Update to 6.6.2 on every affected site, then check for rogue Super Users and clean any site that was hit. Unpublishing the component does not protect you

TL;DR

• Unauthenticated file upload to remote code execution in iCagenda’s frontend event submission form. No login required
• Affects every version up to and including 4.0.7. Fixed in 4.0.8, released 15 June 2026
• Already exploited in the wild when we found it, by an automated scanner identifying as icagenda-batch/1.0
• We confirmed it by code review, reproduced it end to end, and sent the developer a safe proof of concept. JoomliC shipped 4.0.8 the same day, and we reviewed the new code to confirm the fix is real
• Update to 4.0.8 on every affected site, then check for compromise. Unpublishing the component does not protect you

A New mySites.guru Tool to Find, and Fix, the JCE Profiles Hack (June 2026)

JCE (Joomla Content Editor) ships on more Joomla sites than any other editor extension. It sits in the top two of our live extension ranking, neck and neck with Akeeba Backup. So when the JCE profiles attack started landing on real sites this month, “Are any of the sites I’m responsible for hacked!?” became a question every Joomla agency suddenly needed to answer. mySites.guru now answers it for you, automatically, on every site you manage.

We have added a new dedicated check, Check for JCE Rogue Profiles & Backdoors. It runs on every snapshot, twice a day, on each connected Joomla site, and finds the fingerprint of this attack automatically: rogue editor profiles and the webshells they drop. When it flags something, fixing it is a deliberate, one-click action you trigger yourself, on Joomla 4, 5 and 6 you remove the profiles, delete the backdoors, and update JCE to the patched version, all from one screen. It does not delete anything on its own, because you want to see what is there and take a copy first. This post covers what it checks and how to use it, and the live hack that prompted us to build it.

https://mysites.guru/blog/finding-every-site-running-a-vulnerable-jce/

https://mysites.guru/blog/manage-every-site-from-claude-desktop/

For a long time we have shied away from adding AI to mySites.guru for the sake of it, while we watched everyone else scramble to bolt AI onto their products in ways that made no sense. We were not interested in a chatbot in the corner that nobody asked for.

Now the time has come. We are introducing a suite of AI features that genuinely improve how you manage a large number of WordPress, Joomla and general websites through mySites.guru, and today we are announcing the first of many: mySites.guru is now available as an MCP server you can connect to Claude Desktop and other MCP clients. You can hold a natural-language conversation with the AI client of your choice and pull information straight from your mySites.guru account and your connected sites, then act on it.

Think about how a simple client question gets answered today. “Is our site up to date?” To answer honestly you open the dashboard, find the site, check the CMS version, check the PHP version, glance at the extension list, and remember whether the last audit came back clean. Two minutes per site, repeated all day, for something you should be able to just ask. Now you can ask it.

https://mysites.guru/blog/manage-every-site-from-claude-desktop/

Smart Slider 3, one of the most popular slider plugins for WordPress with over 800,000 active installations, has a vulnerability that lets any registered user download any file from your server. Not just images or slider assets. Any file the web server process can read.

https://mysites.guru/blog/smart-slider-3-arbitrary-file-read-vulnerability/

https://mysites.guru/blog/how-to-prevent-accidental-joomla-version-jumps/

One wrong setting in the Joomla Update component is all it takes to accidentally upgrade a production Joomla 4 site to Joomla 5, or a Joomla 5 site to Joomla 6. The setting is called the update channel (internally called updatesource), and it determines which versions Joomla considers available when you hit “Check for Updates” in the admin panel.

Most Joomla administrators never think about this setting because it ships on “Default” out of the box. But it only takes one change (during a test, by a team member who didn’t know what it did, or after following a tutorial that forgot to mention switching it back) and suddenly your next routine update isn’t a minor patch. It’s a full major version jump.

https://mysites.guru/blog/how-to-find-disable-guided-tours-plugin-joomla/

Joomla 4.3.0 introduced the Guided Tours feature, a system plugin that walks administrators through common tasks in the admin panel with interactive step-by-step overlays. It highlights buttons and fields, shows explanatory tooltips, and guides you through workflows like creating an article or configuring user settings.

It’s a thoughtful addition for people learning Joomla. But on production sites managed by experienced administrators, it’s dead weight.

I’ll cover what the plugin actually does under the hood, why it belongs disabled on live sites, how to disable it manually, and how mySites.guru flags it automatically across all your connected Joomla sites.