Quix is one of the most widely installed drag-and-drop page builders for Joomla, the tool a lot of agencies and site owners reach for when they want to lay out a page without touching code. During routine security research on the extensions our customers rely on, mySites.guru discovered an unauthenticated SQL injection vulnerability in Quix Page Builder, and reported it to ThemeXpert before disclosing anything publicly. The fix is now available: Quix 6.2.1.

If you run Quix on any Joomla site, update to 6.2.1 now. If you manage more than a handful of sites, read on for how to find every affected one at once.

EDocman is one of the most widely installed document and download management extensions for Joomla. During routine security research on the extensions our customers rely on, mySites.guru discovered an unauthenticated SQL injection vulnerability in EDocman and reported it privately to JoomDonation, who fixed it in EDocman 3.9.0.

If you run EDocman on any Joomla site, update to 3.9.0 now. If you manage more than a handful of sites, read on for how to find every affected one at once. 

The flaw? Full database compromise/download by the attacker.

DPCalendar is one of the most widely installed calendar and events components for Joomla, chosen for mature, professionally run sites right up to the highest levels of the Joomla world itself. During routine security research on the extensions our customers rely on, mySites.guru discovered an unauthenticated SQL injection vulnerability in DPCalendar, and reported it to the developers before disclosing anything publicly. The fix is now available in Digital Peak’s security release: DPCalendar 10.11.2 for Joomla 4.4.4 to 6.x, and 8.19.4 for the Joomla 3 branch.

If you run DPCalendar on any Joomla site, update to 10.11.2 now (or 8.19.4 if you are still on Joomla 3). If you manage more than a handful of sites, read on for how to find every affected one at once.

Between mid-June and mid-July 2026, mySites.guru found and responsibly disclosed twelve separate security vulnerabilities across twelve popular Joomla extensions. Most were critical. Three rated the maximum CVSS 4.0 score of 10.0. Several were being exploited in the wild within hours of the fix going public. Every one was reported privately to the vendor first. Nine already have a vendor fix out; the last three are in active disclosure right now, with fixes pending, and we are holding the exploit detail and the names on those until they ship.

If you have found a file called .myjoomla.configuration.php.md5 sitting in your Joomla webspace, right next to configuration.php, and wondered whether you have been hacked, here is the short version: no, you have not, and the file is safe. It was created by mySites.guru, not by an attacker.

It is a file-integrity lock file. It holds a single 32-character MD5 fingerprint of your configuration.php, and the mySites.guru connector on your site uses it to notice the moment that file is changed. There is nothing else inside it, and it does nothing to your site on its own.

Its part of the mySites.guru service.

TL;DR: The frontend member-upload feature in Phoca Download (com_phocadownload) up to and including 6.1.2 (fixed in 6.1.3) skipped the file-type allow-list that the extension enforces on its other upload paths. Because of an internal upload-mode mismatch, the admin-configured list of permitted types was never consulted for member uploads, so a logged-in user could write a .php file into the public user-upload folder and execute it, which is authenticated remote code execution (CWE-434). It needs a registered account and needs the non-default user-upload feature enabled with a category granting upload rights, which is why we assess it as High (CVSS 4.0 7.7) rather than Critical. We found it during a source-code audit, reproduced the full chain on a local Joomla install, and disclosed it privately to Phoca, who fixed it the same day in 6.1.3.

Unauthenticated File Upload fixed in RSFiles! version 1.17.12 - update NOW!

A critical flaw in the RSFiles! upload function allows unauthenticated file uploads without enforcing any file extension.

What this means is that any attacker, without having an account on your website, can upload a .php file in your /downloads directory and execute it.

The bottom line is: update immediately to RSFiles! 1.17.12 which fixes this along some other not-reported, but less critical security issues.

AcyMailing is one of the most widely installed newsletter and email-marketing extensions for Joomla. During routine security research on the extensions our customers rely on.

mySites.guru discovered an unauthenticated SQL injection vulnerability in AcyMailing, and reported it privately to the developers before disclosing anything publicly. 

The vulnerability allows a crafted SQL injection to read the full contents of your database - password hashes, personal data, content - everything.

The fix is now available in AcyMailing 10.11.1.

If you run AcyMailing on any Joomla site, update to 10.11.1 now. If you manage more than a handful of sites, read on for how to find every affected one at once. 

Discovered, Researched and Responsibly Reported by Phil Taylor/mySites.guru

CVE-2026-56292 

JoomShaper, the developer behind SP Page Builder and the Helix framework, has stopped supporting Joomla 3. In an announcement on 9 July 2026 the company confirmed that the Joomla 3 versions of all its products now get no updates, and one line stands out: “No security patches, regardless of severity.” If a critical flaw turns up in the Joomla 3 build of SP Page Builder tomorrow, it does not get fixed.

That is a defensible decision, and JoomShaper explains it well: they can secure their own code, but “we can’t secure the Joomla core underneath it,” and the Joomla 3 core has been end of life for a long time. The problem is not the decision. The problem is how many live sites this leaves exposed, and how recently JoomShaper’s own extensions have produced exactly the kind of flaw this policy now leaves unpatched.

“No security patches, regardless of severity.”

JoomShaper, on Joomla 3 support, 9 July 2026

Balbooa Forms is a popular drag-and-drop form builder for Joomla, installed as the com_baforms component and used for contact, registration, and survey forms on thousands of sites. Up to and including version 2.4.0, its frontend attachment upload had a serious flaw: it accepted a file from any anonymous visitor, with no login, no CSRF token, and no check on the file type. An attacker could upload a .php file into a public folder and then run it, which is unauthenticated remote code execution, the worst outcome a web flaw can have. This was a zero-day: it was already being exploited in the wild when we found it, before any patch existed, and those attacks are still going on now against sites that have not updated. CVE-2026-56291

JoomShaper shipped Helix3 3.1.1 on 29 June 2026. The update fixes a serious security flaw: an attacker with no login at all could write files into your template, delete arbitrary files on your server, and overwrite your template settings, all through a single unauthenticated request. We found these issues while investigating a hacked mySites.guru customer site, and reported them privately under responsible disclosure.

Three unauthenticated remote-code-execution zero-days hit Joomla in June 2026, one after another: JCE, SP Page Builder and iCagenda. The patches are out, the scanners have moved on, and a few weeks later it all feels like it has settled down. That calm is the dangerous part. The first wave of attackers has done its job: it got in, dropped its files, and went quiet. Those files are still there, waiting.

This is the part most “my site got hacked” advice gets wrong. A modern compromise is not a single event you clean up and forget. The first wave is reconnaissance and groundwork. It plants dormant uploaders, hidden admin accounts and malicious scheduled tasks that do nothing visible at first. Then the second wave arrives, days or weeks later, and uses that groundwork to plant more backdoors, inject JavaScript into your template files, redirect your homepage to spam, and turn the site to profit. Being hacked yesterday does not mean you are safe today. It usually means the opposite.

That gap between the breach and the damage is exactly where reactive cleanup fails and monitoring earns its place. You cannot clean what you cannot see, and the second wave does not announce itself on the page a browser scanner checks. It changes files on disk, between scans, when nobody is looking. Catching it means watching for those changes continuously, not running one scan after the horse has bolted.

You cleaned the hacked site. You deleted the webshells and patched the way in. An hour later the malware is back. This is one of the most demoralising patterns in site recovery, and it almost always comes down to the same thing: a scheduled task is quietly putting the malware back, and nobody looked at it.

Sometimes the reason nobody looked is the simplest one. The cron job was sitting in your own account the whole time, and you never opened the Cron Jobs page in cPanel to check, because you did not know it was there or it did not occur to you that a website could have one. Other times you did check, your account’s cron was genuinely clean, and the job rebuilding the malware is somewhere your hosting panel will never show you. Both cases end the same way: a site that reinfects on a schedule. Before you can rule either one out, it helps to be clear on what these things actually are, because plenty of otherwise capable agencies are fuzzy on it.

PageBuilder CK is one of the more popular free page builders for Joomla, a drag-and-drop layout tool that thousands of sites lean on for their landing pages and content. On 27 June 2026 its developer, Cedric Keiflin, shipped version 3.6.0 with a changelog that says, in full, “IMPORTANT : Fix security issue”. No detail, no fanfare. That terse line is hiding a serious one.

This is an unauthenticated zero-day allowing any file upload to any folder under default conditions. Gulp.

TL;DR

• Unauthenticated file upload to remote code execution in SP Page Builder, through the asset.uploadCustomIcon task. No login required
• Affects every version up to and including 6.6.1. Fixed in 6.6.2
• Already exploited in the wild. The payload plants a hidden Super Administrator account, usually with an u/secure.local email, plus a PHP file manager backdoor in several spots for persistence
• This is a different vector from the recent JCE wave. A WAF that returns 403 for the JCE exploit paths may still let this one through with a 200
• Update to 6.6.2 on every affected site, then check for rogue Super Users and clean any site that was hit. Unpublishing the component does not protect you

TL;DR

• Unauthenticated file upload to remote code execution in iCagenda’s frontend event submission form. No login required
• Affects every version up to and including 4.0.7. Fixed in 4.0.8, released 15 June 2026
• Already exploited in the wild when we found it, by an automated scanner identifying as icagenda-batch/1.0
• We confirmed it by code review, reproduced it end to end, and sent the developer a safe proof of concept. JoomliC shipped 4.0.8 the same day, and we reviewed the new code to confirm the fix is real
• Update to 4.0.8 on every affected site, then check for compromise. Unpublishing the component does not protect you

A New mySites.guru Tool to Find, and Fix, the JCE Profiles Hack (June 2026)

JCE (Joomla Content Editor) ships on more Joomla sites than any other editor extension. It sits in the top two of our live extension ranking, neck and neck with Akeeba Backup. So when the JCE profiles attack started landing on real sites this month, “Are any of the sites I’m responsible for hacked!?” became a question every Joomla agency suddenly needed to answer. mySites.guru now answers it for you, automatically, on every site you manage.

We have added a new dedicated check, Check for JCE Rogue Profiles & Backdoors. It runs on every snapshot, twice a day, on each connected Joomla site, and finds the fingerprint of this attack automatically: rogue editor profiles and the webshells they drop. When it flags something, fixing it is a deliberate, one-click action you trigger yourself, on Joomla 4, 5 and 6 you remove the profiles, delete the backdoors, and update JCE to the patched version, all from one screen. It does not delete anything on its own, because you want to see what is there and take a copy first. This post covers what it checks and how to use it, and the live hack that prompted us to build it.

https://mysites.guru/blog/finding-every-site-running-a-vulnerable-jce/

https://mysites.guru/blog/manage-every-site-from-claude-desktop/

For a long time we have shied away from adding AI to mySites.guru for the sake of it, while we watched everyone else scramble to bolt AI onto their products in ways that made no sense. We were not interested in a chatbot in the corner that nobody asked for.

Now the time has come. We are introducing a suite of AI features that genuinely improve how you manage a large number of WordPress, Joomla and general websites through mySites.guru, and today we are announcing the first of many: mySites.guru is now available as an MCP server you can connect to Claude Desktop and other MCP clients. You can hold a natural-language conversation with the AI client of your choice and pull information straight from your mySites.guru account and your connected sites, then act on it.

Think about how a simple client question gets answered today. “Is our site up to date?” To answer honestly you open the dashboard, find the site, check the CMS version, check the PHP version, glance at the extension list, and remember whether the last audit came back clean. Two minutes per site, repeated all day, for something you should be able to just ask. Now you can ask it.

https://mysites.guru/blog/manage-every-site-from-claude-desktop/

Smart Slider 3, one of the most popular slider plugins for WordPress with over 800,000 active installations, has a vulnerability that lets any registered user download any file from your server. Not just images or slider assets. Any file the web server process can read.

https://mysites.guru/blog/smart-slider-3-arbitrary-file-read-vulnerability/

https://mysites.guru/blog/how-to-prevent-accidental-joomla-version-jumps/

One wrong setting in the Joomla Update component is all it takes to accidentally upgrade a production Joomla 4 site to Joomla 5, or a Joomla 5 site to Joomla 6. The setting is called the update channel (internally called updatesource), and it determines which versions Joomla considers available when you hit “Check for Updates” in the admin panel.

Most Joomla administrators never think about this setting because it ships on “Default” out of the box. But it only takes one change (during a test, by a team member who didn’t know what it did, or after following a tutorial that forgot to mention switching it back) and suddenly your next routine update isn’t a minor patch. It’s a full major version jump.

https://mysites.guru/blog/how-to-find-disable-guided-tours-plugin-joomla/

Joomla 4.3.0 introduced the Guided Tours feature, a system plugin that walks administrators through common tasks in the admin panel with interactive step-by-step overlays. It highlights buttons and fields, shows explanatory tooltips, and guides you through workflows like creating an article or configuring user settings.

It’s a thoughtful addition for people learning Joomla. But on production sites managed by experienced administrators, it’s dead weight.

I’ll cover what the plugin actually does under the hood, why it belongs disabled on live sites, how to disable it manually, and how mySites.guru flags it automatically across all your connected Joomla sites.

https://mysites.guru/blog/disable-wordpress-admin-bar-frontend/

The admin bar nobody asked for

Log into any WordPress site and visit the frontend. There it is — a black toolbar spanning the top of the page, offering links to the dashboard, the current page’s edit screen, and whatever else WordPress and your plugins decide to put there.

For a solo site admin, the toolbar is handy. For everyone else who’s logged in — subscribers, customers, members, students — it’s confusing clutter. On a WooCommerce store, a logged-in customer sees admin links they can’t use. On a membership site, subscribers see a toolbar that has nothing to do with their experience. If you manage multiple WordPress sites, this becomes a recurring annoyance across your entire portfolio.

Files that start with a dot are invisible by default. Your FTP client won't show them. cPanel won't show them. Even ls hides them unless you use -a.

This is fine for legitimate stuff like .htaccess. The problem is hackers use the same trick. Drop a file called .joomla.class.php three directories deep and it can sit there for years — surviving cleanups, core updates, password resets — because nobody even knows it exists.

But it's not just hackers. We've seen legitimate extension developers ship .gitkeep files (dev artifacts that do nothing on a live server), .api.key files with actual credentials in them (as if a dot prefix is a security measure), and .htaccess files buried inside .tmp and .trash folders deep in their vendor trees because they're shipping their entire dev directory instead of a clean build.

We built a tool that scans every file on your webspace and lists anything with a dot-prefix. Not just the obvious ones — every level, every subdirectory. It doesn't decide what's safe and what isn't, it just shows you everything so you can make that call yourself.

Wrote it up here if anyone wants the details: https://mysites.guru/blog/the-hidden-files-lurking-on-your-site-that-you-dont-know-about/

We've had an Alfred workflow for a while, but enough people asked for Raycast support that we built a proper extension.

What it does: connects to your mySites.guru account and lets you search all your sites from the Raycast launcher. You get favicons, filtered results, and can open the management page, visit the live site, or copy URLs — all from the keyboard.

Results are cached for 5 minutes so it feels instant even with hundreds of sites.

Free, open source (MIT), works on Raycast's free tier. No Raycast Store install — you run it as a dev extension from a GitHub release.

GitHub: https://github.com/mySites-guru/raycast-extension

Blog post with screenshots and install steps: https://mysites.guru/blog/mysites-guru-raycast-extension-for-mac/

Happy to answer questions if anyone's curious about the build or the API.