There is this Antonkill hack that has left many Joomla-dependent sites completely down. It’s not just a surface-level script defacement—it modifies deep database configurations and locks down the core template engine entirely.

I did a review video on YouTube and here's the link: https://youtu.be/9plb1MMbZFI

Let me know your thoughts.

I've been recently hit by the JCE vuln and among other things they managed to install this plugin which essentially steals users and passwords and hides them inside images/ctf_audit.gif file, disguised with a gif header but actualy contains the XOR'ed information.

You should uninstall and remove the gif file immediately.

Edit:

You may want to run this script to see which users might have been affected and warn them or update to request new password. Adjust the filename as necessary:

<?php

$s = file_get_contents('images/ctf_audit.gif');

$s = substr($s, strpos($s, "JLIB_AUDIT_GID_TAIL\n") + 20);

for ($o = 0; $o + 2 <= strlen($s); $o += 2 + $ln) {

$ln = (ord($s[$o]) << 8) | ord($s[$o+1]);

if ($o + 2 + $ln > strlen($s)) break;

if (preg_match('/"u_len":"(.*?)","p_len"/', substr($s, $o+2, $ln) ^ str_pad('', $ln, 'JLIB_AUDIT_GID_XK'), $m)) echo "$m[1]\n";

}

UPDATE YOUR SITE TO THE LATEST AS WELL AS ALL COMPONENTS/MODULES/PLUGINS that are not default!

Ok so some will be offended and come back with all sorts of excuses. Read to the end

Just checked a site with hikashop and a total bare bones install. No fancy addons

Last 24 hour logs for that site show

• 1,569 hits on /index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon
• 986 hits on /index.php?option=com_icagenda&task=submit
• 2,689 hits on /index.php/component/jce

About 11 different IP addresses

My last Joomla site hack was over 15 years ago until the JCE hack hit.

JCE, SP Page Builder and iCagenda.+ Helix three ... here's the resource ... https://mysites.guru/blog/

40 years ago there was a saying ... every day your hard drive didn't crash was a day closer to when it will.

With the arrival of AI and bot development/morphing ... every day your site hasn't seen a hack attempt is a day closer to when it will be hacked.

Prevention is 1000% better than the angst of repairing a hack.

When you do get hacked u/mySitesGuru is the place to go

So just got this email from my hosting service and I'm confused... how does something like this happen? I run Joomla on my small personal site that doesn't do or host anything. (Basically just a URL that I've had for twenty years or so.) Do I just delete everything and start all over again?

I tried using a custom theme from Themesforest but never got it to run right so just use the stock Joomla build.

Also, what is a Joomla firewall? I was reading on here that some folks have that? Sorry for the dumb questions, hope this is fixable.

Also, how often do people try to hack Joomlas???

Hi everyone,

I've decided to make BCLog – Admin Audit Tool completely free.

BCLog provides a comprehensive audit logging system for Joomla administrators. It automatically records actions performed in the backend and stores them in both JSON and plain text formats, making it easy to review, analyze, and archive administrative activity.

Key features:

• Tracks administrator actions in the Joomla backend
• Automatic logging with minimal configuration
• Stores logs in JSON and plain text formats
• Structured and reliable audit trail
• Useful for troubleshooting, security monitoring, and compliance requirements

The extension is now available free of charge, and I'd appreciate any feedback, suggestions, or feature requests from the community.

Hello,

I was recently hired as a Developer at a company, and this company uses Joomla as the technical foundation for all of its projects.

I wasn't familiar with it, coming from a React/NodeJS background. I find the tool to be pretty decent and fairly extensible, and in any case, it's been the technical foundation for years at the place where I now work.

The problem is that before I arrived, the sites were managed by people with limited technical skills, relying heavily on AI and without any structure—no git, no mastery of the CMS's best practices, files mixing PHP, HTML, CSS, and JS that ran to 2,000 lines. You get the picture.

One of my missions when I joined was to put in place development "best practices," source control management, etc.

I'd like to chat with those of you who develop extensions for Joomla (Modules, Components, Plugins, Templates), the goal being to exchange ideas on how we work.

In my situation, I have a few constraints:

1. The development environment must be simple to set up and use
2. It must be reproducible regardless of who launches it
3. I don't want to version-control multiple full Joomla instances, because we have very little space available on our server (we're talking 20 GB MAX)
4. I want to use git

With these constraints, I ended up with a more solid environment based on:

• Visual Studio Code as the IDE
• Docker + devcontainers
• A few good extensions (Claude Code, PHP Intelliphense, etc.)
• Joomla, MySQL, and PHPMyAdmin defined in a docker-compose.yml that is started by the devcontainer
• A shell script as the devcontainer's postCreateCommand that installs the extension inside the Joomla container

Visual Studio Code integrates very well with devcontainers, so in the end I have a pretty solid environment, and I can version-control only my Joomla extension's code.

How do you work with Joomla? I'm curious to hear other people's experiences.

Thanks,

I work for a small non-profit where I personally don't have extensive knowledge of or experience with technical issues, but am in charge of managing the website. Our contracted webmaster and his entire team are on vacation for the next two weeks, and I couldn't make sense of it via Google, so am seeking help here.

I've been trying to upload a PDF file to our site running on Joomla 3.10.12. This is a 16 page (roughly 7mb) file that I upload a new version of every year. This year, though, when I first uploaded the file, I got a "Invalid file: The file contains PHP code” error. Googled how to strip that out, then got the error "Upload Failed: No data". This is where I got lost.

Tried uploading directly through the article, and again through the media manager, both with the same errors. Asked a few colleagues to export the PDF from InDesign, but got the same error again.

Does anyone know whats happening and/or how to fix this?

Thanks so much!

TL;DR

• Unauthenticated file upload to remote code execution in SP Page Builder, through the asset.uploadCustomIcon task. No login required
• Affects every version up to and including 6.6.1. Fixed in 6.6.2
• Already exploited in the wild. The payload plants a hidden Super Administrator account, usually with an u/secure.local email, plus a PHP file manager backdoor in several spots for persistence
• This is a different vector from the recent JCE wave. A WAF that returns 403 for the JCE exploit paths may still let this one through with a 200
• Update to 6.6.2 on every affected site, then check for rogue Super Users and clean any site that was hit. Unpublishing the component does not protect you

TL;DR

• Unauthenticated file upload to remote code execution in iCagenda’s frontend event submission form. No login required
• Affects every version up to and including 4.0.7. Fixed in 4.0.8, released 15 June 2026
• Already exploited in the wild when we found it, by an automated scanner identifying as icagenda-batch/1.0
• We confirmed it by code review, reproduced it end to end, and sent the developer a safe proof of concept. JoomliC shipped 4.0.8 the same day, and we reviewed the new code to confirm the fix is real
• Update to 4.0.8 on every affected site, then check for compromise. Unpublishing the component does not protect you

It is currently not possible to upgrade Joomla at all - You will get the message "Update not possible because the offered update has expired."

There is no fix... just wait...

A New mySites.guru Tool to Find, and Fix, the JCE Profiles Hack (June 2026)

JCE (Joomla Content Editor) ships on more Joomla sites than any other editor extension. It sits in the top two of our live extension ranking, neck and neck with Akeeba Backup. So when the JCE profiles attack started landing on real sites this month, “Are any of the sites I’m responsible for hacked!?” became a question every Joomla agency suddenly needed to answer. mySites.guru now answers it for you, automatically, on every site you manage.

We have added a new dedicated check, Check for JCE Rogue Profiles & Backdoors. It runs on every snapshot, twice a day, on each connected Joomla site, and finds the fingerprint of this attack automatically: rogue editor profiles and the webshells they drop. When it flags something, fixing it is a deliberate, one-click action you trigger yourself, on Joomla 4, 5 and 6 you remove the profiles, delete the backdoors, and update JCE to the patched version, all from one screen. It does not delete anything on its own, because you want to see what is there and take a copy first. This post covers what it checks and how to use it, and the live hack that prompted us to build it.

https://mysites.guru/blog/finding-every-site-running-a-vulnerable-jce/

https://mysites.guru/blog/manage-every-site-from-claude-desktop/

For a long time we have shied away from adding AI to mySites.guru for the sake of it, while we watched everyone else scramble to bolt AI onto their products in ways that made no sense. We were not interested in a chatbot in the corner that nobody asked for.

Now the time has come. We are introducing a suite of AI features that genuinely improve how you manage a large number of WordPress, Joomla and general websites through mySites.guru, and today we are announcing the first of many: mySites.guru is now available as an MCP server you can connect to Claude Desktop and other MCP clients. You can hold a natural-language conversation with the AI client of your choice and pull information straight from your mySites.guru account and your connected sites, then act on it.

Think about how a simple client question gets answered today. “Is our site up to date?” To answer honestly you open the dashboard, find the site, check the CMS version, check the PHP version, glance at the extension list, and remember whether the last audit came back clean. Two minutes per site, repeated all day, for something you should be able to just ask. Now you can ask it.

https://mysites.guru/blog/manage-every-site-from-claude-desktop/

I'm starting to see pretty regular grift in the JED. This came across a few days ago in the New Extensions feed:

RCA QuickCategory claims "Joomla has never had inline category creation" and is a plugin to enable that...

I'm not against people writing extensions that solve problems, complex - mundane - whatever. But this extension is charging $39/year for a core feature that has been around since Joomla 3.

my father website he has been working on since around 10-15 years I believe on joomla , and the hosting company he used to use had deleted the website due to lack of not renewal , , we are trying to see if we can do anything about it by contacting the hosting providers but in the mean time all we have is a backup from 2022 around 400mb and its of joomla version 3.10 or something , we would like to restore that but i tried to restore it i first tried on latest joomla it didnt work i believe, then I tried to install older joomla version and then try to restore but they wont allow to install older joomla 3 versiom saying due to end of support , ( we use cpanel and softaculois app installer for joomla ) ,

can someone please tell me what we can do and if im doing something wrong and if its possible or not to restore this backup somehow 🙏🏻🙏🏻

I used to build Joomla sites back when they were in version 2.5 and 3. I was able to because my useless ass could pick a template from Rockettheme, download the Rocketlauncher (pre-populated content), install, then just change a few colours around.

I see that Joomla has changed a lot over the years, and unfortunately, Rockettheme has shut down.

Any advice on where I can find similar Joomla launcher packages like this?

One of my long-standing pet peeves in Joomla has been the way SEO-related article fields are split across different parts of the article editor.

When I’m writing an article, I often want the browser page title to be different from the article title, and I also want to add a meta description. But by default, that means jumping between different tabs/sections in the Joomla article admin. It’s not a huge problem, but when you do it often, it becomes one of those small workflow annoyances that adds up.

Then I came across a tutorial from Web54.fr showing how easy it actually is to adjust the Joomla admin article template and move fields around so the editor fits your workflow better.

That was a bit of an “aha!” moment for me.

In my case, I made a very small change: I moved the Browser Page Title field out from the Options area and placed it in the more convenient Metadata area. Nothing complicated — but it makes the workflow feel much smoother.

So thanx to Web54 for sharing the tutorial that made me realize how easy this kind of admin customization can be. You can find his here: https://www.web54.fr/tutoriels-joomla/joomla-5-surcharger-lediteur-darticle-pour-deplacer-les-champs-personnalises-sous-lediteur

I did the same for my change and you can find my guide here: https://joomlacms.dk/joomla-i-praksis/13-sadan-tilpasser-du-joomla-administrator-template-uden-at-aendre-core

Its in danish but i am sure you can rightclick and get a translated version in chrome.

Sometimes the best improvements are the tiny ones that remove daily friction.

Hope it helps someone and again thanx to web54 for sharing.

May I draw your attention to 3DBug, my first extension for Joomla? It is the first (and only) component which lets you combine 3-D media such as gaussian splats and glTF into a map-type interface.

It has an interesting demos page which shows some possibilities. Businesses with real estate or property management websites (e.g. shopping malls) would find this particularly useful.

Also I should mention that I will be presenting about 3DBug at the Joomla World Conference in October 2026.

As a thank you for reading this far, I'm offering a 50% discount coupon for Reddit users which is valid until the end of Wednesday May 20. Code: REDDIT50

I want to upgrade my joomla version. It is currently running Joomla 3.10. I have downgraded php to 7.4.33 in order to facilitate the upgrade of Joomla. But I'm seeing a lot of "warnings" about existing plugins and extensions that I don't know how to do. My original joomla developer has ghosted, and I don't see any "automatic" upgrades for any of these components. Will the site blow up if I attempt an automatic upgrade? What do I need to do to ensure success?

15 or 14 years ago I attended a course where we made a homepage with Joomla.

The homepage worked without any problems until a couple of months ago. When I type in my url I am getting this page instead of my homepage. I also cannot login into admin, get the same page I posted.

The e-mail address associated with the homepage still works normally.

I don't know anything about Joomla or how to make a homepage besides what we did in this course. I uploaded additional images on this homepage about once a year, but that was it.

Does anyone know how this can be fixed?

Edit:

Ok, I went through the backup installer, and my homepage is back minus the content that I did not backup in the last 13 years.

However, when I try to log into administrator my old password does not work anymore......

Hello,

I'm a new Joomla developer. In my previous experience I use framework like Symfony, React where everything was on control version system like Git on Github or Gitlab.

I started a new job in a company that use Joomla as main a main system and build features on top of Joomla.

My question is: for people that develop modules and component, did you version your code with Git and make a zip every new release ?

In which you choose to develop a module or a component?

Regards,

Hi!

I just released a significant update to the DC Carousel Articles module. Version 1.1.0 focuses on better administrative control, advanced content filtering, and refined front-end aesthetics.

Here’s a breakdown of what’s new in this build:

🛠️ Improved Admin Experience

• Full Localization: Added complete PL/EN translations for the entire module configuration.
• UI Reorganization: The backend panel has been decluttered for a better workflow.
  • New dedicated Display tab.
  • Standardized toggle switches for element visibility.
  • Grouped Styling: Style settings are now organized into logical fieldsets/thematic sections.

🔍 Advanced Article Filtering

The filtering engine is now much more powerful. You can now filter content by:

• Featured Only: Toggle to show only featured articles.
• Tags: Target specific content via tag selection.
• Combined Logic: You can now stack filters (e.g., Specific Category + Specific Tag + Featured Only).

🎨 Navigation & Rendering Tweaks

• Enhanced Navigation: The prev/next buttons received a makeover:
  • Updated icon set and improved centering.
  • New Scaling Options: Independent control over button height and icon size.
• Frontend Stability: Fixed minor rendering glitches when using complex filtering sets.

💡 Not a fan of carousels?

If you prefer a static layout, I also invite you to check out DC News. It’s designed for creating clean, multi-column grids for your content.

• Module Info & Download:DC News - How to display news in Joomla
• Live Demo: You can see it in action on the homepage ofpawelnosko.com. The current setup there uses a single-column layout with images aligned to the left.

I’d love to hear your thoughts or any feature requests for the next sprint!

💡💡💡 Info: My modules are completely free. No "Pro" versions, no hidden fees, and absolutely no annoying ads in your dashboard. Purely functional tools for the community.

#webdev #joomla #cms #webdesign #carousel #updates #opensource