Security
Hidden cron jobs can restore malware after Joomla cleanup
A mySites.guru investigation warns that Joomla sites can be reinfected by malicious cron jobs hidden outside the account-level schedules visible in hosting panels.
The published research describes cron-based persistence that can restore webshells after files and databases have been cleaned. Administrators should check their own account crontab, but a clean cPanel or Plesk schedule does not rule out jobs in system locations or another account’s spool.
The article also discusses CVE-2026-54420, described as a symlink-handling flaw in the LiteSpeed cPanel plugin. mySites.guru says the issue was added to CISA’s Known Exploited Vulnerabilities catalog for active exploitation. The write-up does not provide affected or fixed version numbers, a formal severity rating, or a named Joomla extension; it is not an extension-specific advisory.
- Review account-level cron jobs for unfamiliar commands, downloads or frequent file-copy operations.
- Ask the hosting provider or a system administrator to inspect system crontabs and cron directories when reinfection continues.
- Do not treat file cleanup alone as a complete remediation if server-level persistence may be present.
Originally reported by mySites.guru.