On September 13, 2026, Regular Labs simultaneously released updates for 24 Joomla extensions. Ten of these updates contain security fixes addressing nine vulnerabilities, including critical PHP code execution, several cross-site scripting vulnerabilities, and database information disclosure.
On September 14, 2026, JoomShaper released SP Page Builder 6.9.1, addressing a total of six security vulnerabilities. The most serious issue was an SQL injection vulnerability that could allow an authenticated user with permission to save articles or modules to retrieve sensitive data from the Joomla database.
On August 27, 2026, JoomShaper released Helix Ultimate 2.2.10. This update includes twelve security fixes addressing issues related to access control, media handling, Mega Menu, article saving, and output escaping.
In August 2026, a critical vulnerability was discovered in the popular Sourcerer extension from Regular Labs. The vulnerability allows an unauthenticated attacker to execute arbitrary PHP code on the server through unverified {source} blocks in the final HTML code of the page, leading to full site compromise.
Security and bugfix releases for Joomla versions 6.1.3 and 5.4.8 are now available.
The Fields component (com_fields) manual has been updated: the list of fields and information about them has been updated, screenshots have been added, and information about third-party extensions for this component has been updated.
On July 30, 2026, Akeeba Ltd released updates for their key products: Akeeba Backup for Joomla (10.3.7), Akeeba Solo (9.1.8), and Admin Tools for Joomla (7.9.0). The primary focus of these releases is security hardening.
On July 27, 2026, four critical vulnerabilities were discovered in the popular SP Page Builder (com_sppagebuilder) page builder component. These include an unauthenticated SQL injection allowing attackers to read the entire site database, and an open mail relay turning your site into a spam platform.
On July 22, 2026, Regular Labs developer (Peter van Westen) released a large-scale security update affecting more than 30 extensions simultaneously. Among them are popular extensions such as Advanced Module Manager, Articles Anywhere, Sourcerer, Cache Cleaner, Modals, Tooltips, GeoIP, and many others.
Anton Majoroff here. Few people could have failed to notice the increased hacker activity targeting Joomla websites since the spring of 2026. Why have websites suddenly become frequent targets, and how long will this continue? Is Joomla the only platform affected, or are others suffering as well? What should you do to prevent your website from being hacked again? Let’s take a closer look.
