News

Details: Written by: Bjørn Ove Bremnes; Parent Category: News; Category: News - Security News; Published: 02 October 2026

When a Joomla site may have been compromised, patching the software is necessary but does not by itself resolve the risk from credentials issued before the incident. This guide explains how to assess Joomla API token exposure, revoke and replace tokens safely, and respond to two verified Joomla webservice vulnerabilities without assuming that exploitation has been confirmed.

Details: Written by: Bjørn Ove Bremnes; Parent Category: News; Category: News - Security News; Published: 29 September 2026

Six confirmed Joomla extension vulnerabilities affect the Free editions of OrdaSoft Real Estate Manager, Vehicle Manager and Book Library. Site owners should update the first two extensions immediately and treat Book Library versions through 6.4.6 as vulnerable while waiting for an explicitly identified fixed release.

Details: Written by: Bjørn Ove Bremnes; Parent Category: News; Category: News - Security News; Published: 29 September 2026

Joomla administrators using Regular Labs Modules Anywhere or Tabs & Accordions should update to versions 10.0.0 and 3.2.0 respectively as a prudent security measure. However, two CVE identifiers initially associated with those releases are officially assigned to Event Gallery for Joomla, so administrators need to separate the update action from the unresolved CVE mapping.

Details: Written by: Bjørn Ove Bremnes; Parent Category: News; Category: News - Security News; Published: 29 September 2026

Administrators using the UP (Universal Plugin) for Joomla should urgently identify and update affected releases. Four verified vulnerabilities include unauthenticated arbitrary file access, SQL injection and remote code installation risks, with fixes available in UP 6.1.0 for Joomla 5.2–6.x and UP 5.2.1 for Joomla 3.10–5.1.