On August 27, 2026, JoomShaper released Helix Ultimate 2.2.10. This update includes twelve security fixes addressing issues related to access control, media handling, Mega Menu, article saving, and output escaping.
In August 2026, a critical vulnerability was discovered in the popular Sourcerer extension from Regular Labs. The vulnerability allows an unauthenticated attacker to execute arbitrary PHP code on the server through unverified {source} blocks in the final HTML code of the page, leading to full site compromise.
Security and bugfix releases for Joomla versions 6.1.3 and 5.4.8 are now available.
The Fields component (com_fields) manual has been updated: the list of fields and information about them has been updated, screenshots have been added, and information about third-party extensions for this component has been updated.
On July 30, 2026, Akeeba Ltd released updates for their key products: Akeeba Backup for Joomla (10.3.7), Akeeba Solo (9.1.8), and Admin Tools for Joomla (7.9.0). The primary focus of these releases is security hardening.
On July 27, 2026, four critical vulnerabilities were discovered in the popular SP Page Builder (com_sppagebuilder) page builder component. These include an unauthenticated SQL injection allowing attackers to read the entire site database, and an open mail relay turning your site into a spam platform.
On July 22, 2026, Regular Labs developer (Peter van Westen) released a large-scale security update affecting more than 30 extensions simultaneously. Among them are popular extensions such as Advanced Module Manager, Articles Anywhere, Sourcerer, Cache Cleaner, Modals, Tooltips, GeoIP, and many others.
Anton Majoroff here. Few people could have failed to notice the increased hacker activity targeting Joomla websites since the spring of 2026. Why have websites suddenly become frequent targets, and how long will this continue? Is Joomla the only platform affected, or are others suffering as well? What should you do to prevent your website from being hacked again? Let’s take a closer look.
Important information for Joomla 3 site owners! On July 15, 2026, JoomShaper developers released long-awaited security patches for Helix Ultimate, Helix 3, and SP Page Builder, specifically for Joomla 3 sites.
Important information for all Joomla website owners! On July 8, 2026, a critical vulnerability was discovered in the popular Balbooa Forms (com_baforms) form builder component. The vulnerability allows an unauthenticated attacker to upload and execute PHP files on the server, leading to full site compromise.
