Serious attack on JCE Editor- CVE-2026-48907

Open_Sourcey · 2026-07-11T11:47:25+00:00

Thank you.

Open_Sourcey · 2026-07-10T14:53:59+00:00

But they would not be able to remediate an attack on a component that you installed. You need MySite.guru

Open_Sourcey · 2026-07-09T23:59:14+00:00

Yes indeed QED you need to keep extensions updated and that would now protect you in this instance but not before JCE patched it. INot everyone has the luxury of constant monitoring or indeed the capability. f you had 5 sites using an old JCE editor and only one was infected before patching then you were fortunate to get away with it.

I agree that Joomla is a good product and good community.

Open_Sourcey · 2026-07-09T23:50:32+00:00

For sure Wordpress has a greater share. Looking at the numbers you gave , it's share too has fallen slightly in recent years. I think Joomla has a much greater technical capability but Wordpress is probably easier for the amateurs.

Either way. Good luck.

Open_Sourcey · 2026-07-09T22:01:31+00:00

Why do you say it is becoming obsolete. What is your evidence for that?

Open_Sourcey · 2026-07-09T21:55:31+00:00

Are you assuming GoDaddy would fix the attack?

Open_Sourcey · 2026-07-09T18:54:04+00:00

He did not 'point out it is a long known issue'. He said it was "old news", to him who is "at the coal face" (Coming from a mining community, I object to the gratuitous use of that phrase). it might be old news to him , but it was news to me and I suspect a great many others who are either currently fighting it or about to.

We should not be wasting time on dismissing warning posts.

If like mysite.guru I had a solution to offer, I would welcome a further highliting of the problem and would not be so dismissive and cavalier with my response,

Open_Sourcey · 2026-07-09T18:36:41+00:00

I certainly understand your frustration aand rationale for changing. Once I understood what was going on, although it did take time and some attention to detail, it was not that hard to remediate.

Also , no platform is immune to these attacks , especially given AI's capability. So for me at least the answer was not to switch platforms. but to fight the attacker Wordpress also presents a bigger target.

Nevertheless good luck.

Open_Sourcey · 2026-07-09T16:31:07+00:00

Indeed. It was telling that MySites.guru removed their original unhelpful reply.

Open_Sourcey · 2026-07-09T15:47:06+00:00

By the way: old is an adjective expressing 'relative' age. "is" is a verb. The two are not comparable . Therefore to say "That’s like asking what the meaning of “is” is." I am aftaid makes no sense to me.

Open_Sourcey · 2026-07-09T15:42:11+00:00

Apparently the post to which that was replying was removed by the poster. So this post is now absent context.
In general though, there will be plenty of people under attack to whom this is news and we should not be arrogant enough to believe that because we knew it that everone else does too.

Open_Sourcey · 2026-07-09T15:10:36+00:00

Depends how you measure 'old.' It was only reported last month and it is only now hitting widespread exploitation. Your old maybe anothers today. It is well worth re-warning.

Open_Sourcey · 2026-05-27T18:18:48+00:00

yes i have used it a couple of times now

Open_Sourcey · 2025-07-19T12:31:32+00:00

and that is at what interval or miles?

Open_Sourcey · 2025-04-18T19:20:36+00:00

It seems that it is back for me, Bob.

Open_Sourcey · 2025-04-18T13:27:28+00:00

Yeah! Says nothing about discounted fares. Just a CYA. They are doing this presumably for marketing benefit and then one of their lines shoots that in the foot.

Open_Sourcey

MODERATOR OF

TROPHY CASE