Gridbox 2.20.4.2 fixes two critical SQL flaws
Balbooa has released Gridbox 2.20.4.2 to address two critical vulnerabilities that could be exploited without a Joomla login.
Security
Security releases, vulnerabilities and hardening for Joomla.
DJ-HelpfulArticles 1.3 fixes stored XSS flaw
DJ-Extensions has fixed a High-severity stored cross-site scripting flaw in its Joomla article-rating extension, DJ-HelpfulArticles, with version 1.3.
Vik extensions receive fixes for CSRF and stored XSS
E4J has released security updates for three Joomla extensions, addressing a CSRF weakness and stored cross-site scripting in Vik Booking, Vik Rent Car and Vik…
Phoca Download fixes CSRF flaw only on Joomla 6 line
Phoca Download 6.1.6 fixes a low-severity CSRF vulnerability affecting front-end file actions, but the patch is limited to the Joomla 6 release line.
StageIt updates fix CSRF and PHP injection risks
Joomla staging extension StageIt has received security updates addressing CSRF flaws and a settings-file issue that could enable PHP execution.
Phoca Gallery flaw exposes Joomla sites to stored XSS
Phoca Gallery versions 4.5.0 through 6.1.5 contain a stored cross-site scripting flaw that can execute code from crafted image EXIF data when a photo’s…
PHP advises disabling session upload progress
PHP has advised administrators to disable session upload progress as a precaution against CVE-2026-115560, an unlikely remote-code-execution vector awaiting a…
Critical PHP fixes will affect Joomla hosting environments
PHP is due to publish two critical security fixes on 21 October 2026, and Joomla administrators will depend on their hosting providers to receive them.
Critical YOOtheme Pro 5 update scheduled for 21 October
YOOtheme has warned that every site running YOOtheme Pro 5 needs a critical security update scheduled for 21 October 2026.
Impersonation scam targets Joomla site owners
mySites.guru has documented an active impersonation campaign in which attackers pose as Joomla developer Fotis Evangelou to request privileged site access and…
Gridbox 2.20.4.0 fixes Joomla security flaws
Balbooa has released Gridbox 2.20.4.0 for Joomla, fixing a high-severity CSRF vulnerability in language installation and a separate image path validation…
JCH Optimize 9.4.1 fixes six high-severity Joomla flaws
JCH Optimize versions before 9.4.0 are affected by six high-rated security issues, including XSS and an unauthenticated page-cache endpoint; administrators…