Loading story…
A critical flaw in Joomla! tracked as CVE-2015-8562 allowed unauthenticated attackers to achieve remote code execution by sending crafted HTTP headers, including User-Agent, to vulnerable sites. The bug affected Joomla! versions 1.5.0 through 3.4.5 and was fixed in 3.4.6. Researchers reported that exploitation was already occurring in the wild before the patch was released, with attackers abusing Joomla!'s session handling to write malicious serialized data into the backend MySQL session store and trigger code execution on a follow-up request.
The exploit chain relied on multiple conditions: Joomla! stored session data in MySQL text fields, MySQL could silently truncate input containing 4-byte UTF-8 characters under configurations such as utf8_general_ci, and PHP session decoding behavior associated with CVE-2015-6835 could turn the truncated data into attacker-controlled objects. The injected object chain then reached Joomla! components including JDatabaseDriverMysqli and SimplePie, ultimately invoking dangerous code paths such as assert(). Recommended mitigations included upgrading Joomla! and PHP, applying distribution patches, using utf8mb4 where appropriate, and enabling stricter MySQL SQL modes to prevent silent truncation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Joomla! released version 3.4.6 on December 14, 2015, patching the unauthenticated remote code execution vulnerability CVE-2015-8562 affecting versions 1.5.0 through 3.4.5.
Sucuri observed broad attacks exploiting the Joomla! flaw against its websites and honeypots between December 13 and 14, 2015. Separate reporting also noted that exploitation was already occurring in the wild.
Sucuri stated that exploit code for the Joomla! vulnerability was already circulating on December 12, 2015, indicating pre-patch weaponization.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attacks targeting **Joomla!** vulnerability `CVE-2023-23752` increased sharply after the flaw was disclosed and patched, with MBSD-SOC first observing exploitation attempts on February 18 and reporting a further rise through March. The bug is an improper access control issue in Joomla! webservice endpoints that affects versions `4.0.0` through `4.2.7`, allowing unauthorized API access and exposure of sensitive information; researchers warned that successful exploitation could lead to site compromise. MBSD-SOC said attack volume climbed notably after March 8 as proof-of-concept exploit code became publicly available, with most observed traffic originating from the United States and increased activity also seen from Japan and Singapore. The Joomla! Project rated the issue **Critical** and released fixes in version `4.2.8`; defenders were advised to upgrade affected systems and change passwords in the global configuration because exposed credentials and configuration data could aid follow-on compromise.
Aug 15, 2026
A critical vulnerability tracked as **CVE-2026-65883** affects **Aimy Captcha-Less Form Guard** for Joomla, enabling unauthenticated **PHP object injection** through a forged `clfgd` field in versions **18.0 through 20.0**. The flaw stems from the plugin accepting attacker-controlled form data, base64-decoding and XOR-deobfuscating it, and passing the result to PHP `unserialize()` without integrity protection. The issue is classified as **CWE-502** and carries a CVSS v4 rating consistent with network-exploitable, low-complexity attack conditions requiring no privileges or user interaction, with high impact on confidentiality, integrity, and availability. VulnCheck reported that the bug can be chained to **remote code execution** as the web user on **Joomla 3.9 through 5.2.1** by leveraging the Joomla core **FormattedtextLogger** gadget, and demonstrated exploitation through a public form flow that recovers the XOR keystream from known plaintext before submitting a crafted serialized object to drop a PHP webshell. Even where direct RCE is not reliable on newer Joomla builds, the vulnerability still allows PHP object injection and complete captcha bypass. **Aimy Extensions** released a fix in **version 20.1**, and exposed sites running earlier plugin versions remain at risk until updated.
Aug 6, 2026
A critical vulnerability, **`CVE-2026-56290`**, affects the Joomla **Page Builder CK** extension before version **3.6.0** and allows **unauthenticated arbitrary file upload**. The flaw can let remote attackers upload executable files and achieve **full remote code execution**, and it has been assigned a **CVSS 4.0 score of 10.0**. Belgium’s Centre for Cybersecurity issued a warning urging organizations to patch immediately because exposed Joomla sites using the vulnerable extension could be compromised without authentication. Advisories recommend upgrading **Page Builder CK** to **3.6.0 or later**, restricting upload permissions, and validating allowed file types to reduce exposure. Related vulnerability reporting published at the same time also highlighted a separate critical web CMS plugin issue, **`CVE-2026-57331`**, in the WordPress **Paid Videochat Turnkey Site** plugin through **7.4.8**, where an **arbitrary file deletion** flaw rated **CVSS 9.9** was remediated in **7.4.9** or later, underscoring continued risk from insecure file-handling bugs in widely deployed content management extensions.
Jul 1, 2026