News - Security News
- Details
- Written by: Bjørn Ove Bremnes
- Parent Category: News
- Category: News - Security News
Balbooa Forms (com_baforms) versions before 2.4.1 are affected by CVE-2026-56291, an actively exploited unauthenticated file-upload vulnerability that can lead to remote code execution. Joomla administrators should identify exposed installations, update to 2.4.1 or later without delay, and review affected sites for signs of unauthorised uploads or code execution.
- Details
- Written by: Bjørn Ove Bremnes
- Parent Category: News
- Category: News - Security News
xmr-pay packages described for HikaShop and VirtueMart give Joomla shop operators a route to evaluate Monero as a payment option without treating the integration as a security disclosure. This practical guide focuses on planning, staging-site validation, operational controls and a cautious production rollout for stores that decide the payment method suits their business.
Read more: Accept Monero on Joomla with xmr-pay for HikaShop and VirtueMart
- Details
- Written by: Bjørn Ove Bremnes
- Parent Category: News
- Category: News - Security News
CVE-2026-56290 is a critical unauthenticated file-upload vulnerability in Page Builder CK for Joomla that can lead to remote code execution. Because CISA lists the issue as actively exploited, affected site owners should verify their extension version, apply the latest vendor-confirmed fix, and assess exposed sites for signs of compromise.
Read more: Critical Page Builder CK RCE: Patch and Check for Web Shells
- Details
- Written by: Bjørn Ove Bremnes
- Parent Category: News
- Category: News - Security News
A malicious-file alert from your hosting provider deserves prompt, methodical action—not a rushed deletion. This general Joomla incident-response guide explains how to verify the report, preserve evidence, clean safely, restore trusted files, and reduce the risk of reinfection.
Read more: What to Do When Your Host Reports a Malicious File on Your Joomla Site
