Initially, client websites running Joomla 4 or 3 were infected, with folders containing backdoor files creating new users. Joomla 5 websites initially only had users created; I searched the same folders as the Joomla 4 sites, and the Joomla 5 sites did not have any .htaccess files that change file permissions, nor were there any files with random names and the .php extension. However, this morning, websites using the latest Joomla 5 updates, updated with the latest versions of GridBox and Forms, were again compromised, and new users were created.
Now my question for the Balbooa team is: are the latest versions really secure? I know that everything online is subject to intrusion, but were the ports that allowed access to user creation, file creation, and even code modification removed?
If files were created to maintain access, how will we know where these files are? Will we have to rebuild all the websites we've already created?
If we rebuild the websites, can we trust that the issue has been fixed and that websites with GridBox are secure, at least against this intrusion and the security flaw that was initially corrected?
I'm transferring all the content of a client's website, which was on Joomla 4, to Joomla 5. I'll test it; it will have the latest version of GridBox and Forms. If it's still compromised after a new installation of Joomla, GridBox, and Forms, I will inform them because the system remains insecure.
Replies are visible only to logged in members with an active subscription.
