u/mySitesGuru

JCH Optimize is a page speed extension for Joomla: it combines and minifies CSS and JavaScript, rewrites HTML, optimises images and serves a page cache. This morning its developer, Samuel Marshall, released JCH Optimize 9.4.0 and called it “a security and maintenance release”. The changelog rates six of the fixes HIGH, including a cross-site scripting issue, an unauthenticated Page Cache endpoint and administrator tasks that ran without a security token.

Every version before 9.4.0 is affected, in both the Free and Pro editions. No CVE has been published and the release credits no finder. If a Joomla site you manage runs JCH Optimize, update it to 9.4.0 today.

READ THE WARNING IN THE BLOG POST IF YOU USE REDIS!

Until 29 September 2026, a Joomla extension developer had no way to tell a site’s administrator that an update fixed a security problem. The update manager listed a security release exactly like a release that changed a button colour, and the only signal was whatever the changelog said, if anyone opened it. Joomla 5.4.9 and 6.1.4, released on 29 September 2026, changed that. Your update XML can now include a <security> element, and Joomla turns it into a “Security release level” badge in the update manager and a warning on the administrator’s Home Dashboard.

The Joomla project released the Joomla 6.2 Release Candidate on 29 September 2026 and plans the stable release for on or about 13 October 2026. The release candidate is for testing only, so keep it off client sites.

For anyone looking after a portfolio of client sites, 6.2 should be a straightforward update to apply. The server requirements are the same as 6.1, the official upgrade notes list no backward compatibility breaks, and the new features are mostly in the editor, content preview and mail. We also fully expect 6.2.0 to be a security release, which means it needs to reach your sites within days of 13 October. The real question is which of your sites can take it, and the answer depends more on PHP versions and Joomla 5.4 stragglers than on anything in 6.2.

On 1 October 2026 Phoca released Phoca Cart 6.1.9, a security release for the Joomla e-commerce extension. The announcement names the flaw in one line: “Authorisation bypass through user-controlled key (IDOR) in Order View”, with more detail promised in a CVE record that has not appeared yet.

We read the 6.1.9 package to work out what that means for a shop. It means anyone could download the digital products your other customers paid for, without an account. If your shop sells downloads, anyone could have taken your stock for free.

A lot of Joomla sites running AcyMailing will not tell you there is anything to update, though. A Joomla developer pointed out on 30 September that a site on 10.11.1 reports itself up to date, and another found that the update sites were gone from every AcyMailing site they looked after. We traced it to a design choice in AcyMailing’s installer, and to the button almost every Joomla guide tells you to press when updates stop appearing.

You clean up a Joomla hack the right way. Patch the extension that let the attacker in, delete the webshells, force every password to reset, force every session out. A week later the site is hacked again, through a route that makes no sense, because the hole is patched and every password is new.

A Joomla API Token is not a password, so a password reset never touches it. If the attacker created one before you cleaned up, it authenticates against /api/ exactly as it did the day it was issued, and it keeps working until someone specifically revokes it. Joomla has no page listing every token on a site and no button that clears them all, so on a site with more than a handful of users, revoking one specifically almost never happens.

Every Joomla site since 4.0 ships with a second application sitting beside the website and the administrator: the Joomla API, which Joomla’s own screens call Web Services. It lives at /api/, it is switched on by default, and on a fresh Joomla 6.1 install it is eighteen enabled plugins exposing articles, users, configuration, extensions, media and more to anyone who can authenticate. Most Joomla sites have no use for it at all, and still take on the security risk of an interface their owners never asked for.

This guide covers switching the Joomla API off completely, step by step with screenshots from a Joomla 6.1.3 site, and then the harder part: what stops working when you do. The biggest casualty is Joomla’s own Automated Core Updates, which since 5.4 depend on the API to work at all. After that come the nuclear option of deleting the api folder, and the .htaccess, nginx and Cloudflare rules that block /api/ before PHP ever sees the request.

Six CVEs published today by the Joomla CNA cover three Joomla extensions from OrdaSoft: Real Estate Manager, Vehicle Manager and Book Library. Each extension has the same pair of flaws. The worse of the two is an SQL injection on the public listing pages that needs no login and scores CVSS 4.0 9.3 Critical, and the other is a reflected cross-site scripting flaw at 5.3 Medium.

If a Joomla site you manage runs any of the three, it needs updating today. Real Estate Manager is fixed in 6.7.9 and Vehicle Manager in 6.5.8. Book Library’s record is less clear about its fix, which the section on versions below explains.

UP, the Universal Plugin, is a Joomla content plugin that reads {up ...} shortcodes out of article text and acts on them while the page renders. About 160 actions ship with it. Most are harmless: embed a video or a map, make a table responsive, list articles by tag. A handful do far more, running PHP, querying the database, reading files, and fetching code from GitHub. Its maintainer released UP 6.1.0 on 26 September 2026, and it fixes a set of flaws we found in 6.0.29 and reported privately in August.

The worst of them needed nothing but a web browser. UP answers requests on Joomla’s anonymous AJAX endpoint, and in 6.0.29 one of those requests returned any file the server could read, configuration.php and the database password inside it included.

CVE-2026-94130 is an unauthenticated SQL injection in YouTube Gallery, JoomlaBoat’s video gallery extension for Joomla. The Joomla CNA published it on 26 September 2026 and scored it 9.3 Critical. Every version from 1.0.0 to 5.7.2 is affected, and the fix is 5.7.3.

No login is needed. The flaw sits in the public video search and in the router that maps friendly video URLs to database rows, so anyone who can load a page with a gallery on it can reach it. Update to 5.7.3. If you are on one of the old 4.x builds, there is no 4.x patch: 5.7.3 is the fix for you too.

Sven Bluege released Event Gallery 6.5.0 for Joomla on 26 September 2026, and it is a security release. Before 6.5.0, a page on another website could make a logged-in editor upload images into a gallery event and replace existing ones, a crafted link could run script in an editor’s session, and the identifiers of carts and orders in the image shop could be worked out from the time they were created.

Acyba released AcyMailing 11.1.0 for Joomla and WordPress on 24 September 2026, and it is a security release. Two lines in the AcyMailing changelog say so, if you know where to look. Our reading of the code diff between 11.0.5 and 11.1.0 puts both fixes at the serious end: one let anyone able to email a monitored mailbox write a file of any type, PHP included, into the web root, and the other let a subscriber delete files outside the upload folder, configuration.php included.

There is no CVE. There is no blog post, no advisory and no announcement. The two fixes are one-line entries filed under Bug fixes, between a List-Unsubscribe header fix and a translation fix, and the only sign that they concern the Enterprise edition is a small coloured dot at the end of each line whose meaning appears only when you hover over it.

EasyStore is JoomShaper’s ecommerce extension for Joomla: products, cart, checkout, orders and coupons. JoomShaper released EasyStore 3.0.0 on 10 September 2026, and within hours of it going out we had found seven security flaws in it during a code audit for mySites.guru customers. We reported them privately that day. EasyStore 3.0.1, released on 23 September, fixes all seven.

The one that matters most to a shop owner needs no login. EasyStore’s guest checkout could be asked for any guest customer’s saved shipping address by email address, and it answered: name, street address, city, postcode, country and phone number, to anyone.

Balbooa shipped Gridbox 2.20.3.1 on 21 September 2026. It fixes a time-based blind SQL injection in the blog author parameter, which lives on the public front end of any Gridbox blog and needs no login. An attacker can read your database one answer at a time, which is slow but reaches everything in it.

Every version below 2.20.3.1 is affected, which is nearly every Gridbox site in the mySites.guru database. There is no CVE and no CVSS score yet, and the vendor filed it as “security hardening”. Update to 2.20.3.1 now. If you are still below 2.20.2, you have a bigger problem than this one, covered in our two earlier Gridbox posts.

OrdaSoft’s OS Gallery, a gallery extension for Joomla, has four new vulnerabilities published today by the Joomla CNA, and between them they cover the two attacker starting points that matter most in any CMS extension: an unauthenticated route straight into the database, and two separate routes from an ordinary gallery-manager account to running code on the server. If you manage a Joomla site with OS Gallery installed on any version up to 6.2.6, it needs updating regardless of who logs in or how the gallery is used.

The four split into two groups: one needs no login at all, and three need an account holding a specific permission on the gallery component. Which group a flaw falls into changes how urgently it matters to you.

read more: https://mysites.guru/blog/os-gallery-sql-injection-rce-disclosure/