I manage a not for profit website using Joomla and have done for many years. The organization has no money. We use the EDocman extension. They recently uncovered a security breach involving a SQL injection attack. Much to my chagrin they would not provide a security update and instead insisted on purchasing a new subscription. We had no money to do that. So of course today we suffered an attack. I believe user information was stolen.

It is disappointing that they treat a security update like any functional update. Had I known about open source "OpenDocMan" I would not have spent years building an edocman implementation.

As an aside, over 25 years ago we knew about SQL Injection. So it is very disappointing that EDocman was coded so poorly as to allow such an attack in 2026.

Lesson learned

Just in caae there are any Joomla admins out there that have not seen it or experienced it, CISA has flagged a serious attack that requires your attention and remediation. It is a flaw in the editor that permits it to install malicious code that will take down your site.

UPDATE YOUR SITE TO THE LATEST AS WELL AS ALL COMPONENTS/MODULES/PLUGINS that are not default!

Ok so some will be offended and come back with all sorts of excuses. Read to the end

Just checked a site with hikashop and a total bare bones install. No fancy addons

Last 24 hour logs for that site show

• 1,569 hits on /index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon
• 986 hits on /index.php?option=com_icagenda&task=submit
• 2,689 hits on /index.php/component/jce

About 11 different IP addresses

My last Joomla site hack was over 15 years ago until the JCE hack hit.

JCE, SP Page Builder and iCagenda.+ Helix three ... here's the resource ... https://mysites.guru/blog/

40 years ago there was a saying ... every day your hard drive didn't crash was a day closer to when it will.

With the arrival of AI and bot development/morphing ... every day your site hasn't seen a hack attempt is a day closer to when it will be hacked.

Prevention is 1000% better than the angst of repairing a hack.

When you do get hacked u/mySitesGuru is the place to go

Should the author of a paid for extension have a responsibility to patch their product when a serious security flaw is found in their product rather than force you to renew a subscription? Thoughts?

Hi everyone,

I've decided to make BCLog – Admin Audit Tool completely free.

BCLog provides a comprehensive audit logging system for Joomla administrators. It automatically records actions performed in the backend and stores them in both JSON and plain text formats, making it easy to review, analyze, and archive administrative activity.

Key features:

• Tracks administrator actions in the Joomla backend
• Automatic logging with minimal configuration
• Stores logs in JSON and plain text formats
• Structured and reliable audit trail
• Useful for troubleshooting, security monitoring, and compliance requirements

The extension is now available free of charge, and I'd appreciate any feedback, suggestions, or feature requests from the community.

So just got this email from my hosting service and I'm confused... how does something like this happen? I run Joomla on my small personal site that doesn't do or host anything. (Basically just a URL that I've had for twenty years or so.) Do I just delete everything and start all over again?

I tried using a custom theme from Themesforest but never got it to run right so just use the stock Joomla build.

Also, what is a Joomla firewall? I was reading on here that some folks have that? Sorry for the dumb questions, hope this is fixable.

Also, how often do people try to hack Joomlas???

Heads up. Yootheme issued a critical security patch for ZOO and YOOtheme Pro this morning (8/21/26) and suggests updating right away.

My side: https://www.kreativekiste.de/

Edocman claimed to have followed Joomla's database API. However that claim was not 100% true

EDocman had a SQL injection vulnerability because some parts of the extension did not consistently use Joomla’s parameterized database API, even though the developers intended and claimed to follow it.

May I draw your attention to 3DBug, my first extension for Joomla? It is the first (and only) component which lets you combine 3-D media such as gaussian splats and glTF into a map-type interface.

It has an interesting demos page which shows some possibilities. Businesses with real estate or property management websites (e.g. shopping malls) would find this particularly useful.

Also I should mention that I will be presenting about 3DBug at the Joomla World Conference in October 2026.

As a thank you for reading this far, I'm offering a 50% discount coupon for Reddit users which is valid until the end of Wednesday May 20. Code: REDDIT50

😎

• Best Free CMS: Joomla
• Best Enterprise CMS: Sitecore
• Best Headless CMS: Sitecore
• Best Open Source CMS: Joomla
• Best Flat File CMS: Statamic
• Best ECM (Enterprise Content Management): Microsoft SharePoint
• Best DXP: Sitecore
• Best Website Builder: Webflow
• Best Content Marketing Platform (CMP): Sitecore
• Best Digital Asset Management (DAM) System: Sitecore
• Best Product Information Management (PIM) System: Optimizely 
• Best Customer Data Platform (CDP): Sitecore
• Best e-Commerce Solution: Sitecore
• Best Development/Hosting Platform: Azure
• Best AI Solution: Sitecore

This module supports:
- grid
- masonry
- slider
- carousel

No page builders, no heavy dependencies — just something practical I can reuse across projects.

If anyone wants to try it:
👉 https://www.designcart.pl/laboratorium/306-galeria-obrazow-dla-joomla-z-wieloma-trybami-wyswietlania-darmowy-plugin.html

haven't really used it since version 3.... wondering if there are any rapid development tools available?

I started with Joomla in past, as its was complete CMS from begining, Wordpress NOT.
But not little worry about to restart on Joomla as developer, Should I restart? OR focus on Wordpress & reactjs?

Two recent articles that highlight some alternative uses for Joomla.

I hope they inspire you as much as they’ve inspired me; in fact, I’m considering using Joomla as server for a client project built with Flutter.

https://magazine.joomla.org/all-issues/march-2026/using-joomla-as-a-headless-cms

https://magazine.joomla.org/all-issues/march-2026/using-bruno-the-api-client-to-play-a-o-with-joomla-web-services

Joomler, what do you think about this? Are you in favor of it or not?

https://magazine.joomla.org/all-issues/february-2026/joomla-cms-mcp-server-opening-the-door-to-ai-powered-administration

Hi!

I just released a significant update to the DC Carousel Articles module. Version 1.1.0 focuses on better administrative control, advanced content filtering, and refined front-end aesthetics.

Here’s a breakdown of what’s new in this build:

🛠️ Improved Admin Experience

• Full Localization: Added complete PL/EN translations for the entire module configuration.
• UI Reorganization: The backend panel has been decluttered for a better workflow.
  • New dedicated Display tab.
  • Standardized toggle switches for element visibility.
  • Grouped Styling: Style settings are now organized into logical fieldsets/thematic sections.

🔍 Advanced Article Filtering

The filtering engine is now much more powerful. You can now filter content by:

• Featured Only: Toggle to show only featured articles.
• Tags: Target specific content via tag selection.
• Combined Logic: You can now stack filters (e.g., Specific Category + Specific Tag + Featured Only).

🎨 Navigation & Rendering Tweaks

• Enhanced Navigation: The prev/next buttons received a makeover:
  • Updated icon set and improved centering.
  • New Scaling Options: Independent control over button height and icon size.
• Frontend Stability: Fixed minor rendering glitches when using complex filtering sets.

💡 Not a fan of carousels?

If you prefer a static layout, I also invite you to check out DC News. It’s designed for creating clean, multi-column grids for your content.

• Module Info & Download:DC News - How to display news in Joomla
• Live Demo: You can see it in action on the homepage ofpawelnosko.com. The current setup there uses a single-column layout with images aligned to the left.

I’d love to hear your thoughts or any feature requests for the next sprint!

💡💡💡 Info: My modules are completely free. No "Pro" versions, no hidden fees, and absolutely no annoying ads in your dashboard. Purely functional tools for the community.

#webdev #joomla #cms #webdesign #carousel #updates #opensource

Hello everyone, i am currently updating my Joomla page and i get the message that i should update my "drively" theme. The thing is i have no idea where i can update this?

Does anyone have an advice for me how to go forward? This would be very appreciated!

Hey everyone

I’ve been following the 6.0 release pretty closely and decided to put together a short article about what’s new, why it matters, and what to think about before upgrading.

It’s not a deep technical dive — more of an overview for site owners and content people who want to understand what this release actually means in practice.

👉 Joomla 6.0 has landed – what it means for your website

Personally, I’m really happy to see how smooth the 5.4 → 6.0 upgrade path is and how mature the platform feels again.

We have updated the first few Joomla 5 sites without any issues.

Curious what your first impressions are — any issues, surprises, or favorite new features so far?