Joomla 3.9.4 Release

Joomla 3.9.4 is now available. This is a security fix release for the 3.x series of Joomla which addresses 4 security vulnerabilities and contains 28 bug fixes and improvements.

What's in 3.9.4?

Joomla 3.9.4 includes 4 security vulnerabilities fixes and several bugs and improvements, including:

Security Issues Fixed

  • High Priority - Core - Missing ACL check in sample data plugins (affecting Joomla 3.8.0 through 3.9.3) More information »
  • Low Priority - Core - XSS in com_config JSON handler (affecting Joomla 3.2.0 through 3.9.3) More information »
  • Low Priority - Core - XSS in item_title layout (affecting Joomla 3.0.0 through 3.9.3) More information »
  • Low Priority - Core - XSS in media form field (affecting Joomla 3.0.0 through 3.9.3) More information »

Bug fixes and Improvements

  • User Terms (#23787) and Privacy Consent (#23660) plugins: Layouts for the label and message added
  • Featured articles: Page subheading added #23583
  • Custom formfield layout paths simplified #22645
  • Com_contact: Contact name field moved out of the Contact Information block #23563
  • Custom module: Improvement of the frontend editing #23741
  • Action Logs improvement: Cache (#22739) and Purge/Export (#22740) actions are now logged

Visit GitHub for the full list of bug fixes.


Upgrade Packages

Upgrade Packages
Joomla 3 upgrade packages

Note: Please read the update instructions before updating.
Remember… Please clear your browser's cache after updating.
Found a bug? Report it on the Joomla Issue Tracker.
Questions? See the documentation wiki for FAQ’s regarding the 3.9.4 release.

Continue reading



  2441 Hits

Joomla World Conference Nov 8-10, 2019 in London, England

 Joomla World Conference (JWC) will be held in London, UK, from November 8th to 10th, 2019. The Conference will bring the brightest Joomla minds together to share their experiences, connect with others, and learn more about Joomla and its community. ​What is JWC? "Joomla! World Conference (JWC) is an annual user conference aimed at users ...

Continue reading
  2513 Hits

A Statement on the Recent Report by Check Point

A report by Check Point Research has been brought to our attention relating to a security vulnerability that was patched back in December 2015. This report has also been picked up by Threat Post.

Both reports contain a great deal of inaccuracies and intimate that the vulnerability detailed is a current one. 
This statement serves to clarify the facts surrounding this issue. Furthermore we would like to assure our user base that, much as these posts attempt to state that this is a current issue, the truth of the matter is far from that.

With this in mind, we would like to clarify a few points:

  • There is no current security issue with the JMail class.
  • The underlying issue, used to create and store the backdoor, is a PHP issue rather than a Joomla issue.
  • A successful attack is only possible with severely outdated PHP and Joomla versions that are more than 3 years out of date (PHP versions 5.4.45, 5.5.29, 5.6.13 and all higher versions are patched for this vulnerability). Please see our recent article about the importance of keeping your sites up to date here.
  • A mitigation for Joomla 1.5, 2.5 and 3 was released more than 3 years ago in December 2015. Patches for EOL versions were released alongside the Joomla 3.4.7 release. Patches for the other Joomla versions are still available here. The Joomla Project also distributed WAF rules to many shared hosting providers at the time of discovery to protect against common exploits of this vulnerability.
  • The file mentioned in Check Point's report is not a Joomla core file, it's a copy of the original class used by the attacker to obfuscate a backdoor.
  • The file does not "override" the core JMail class.

More information on the exploit

The pattern described by Check Point is a classic one - where an attacker exploits a well-known security issue. The issue is over 3 years old and stems from a security issue found in PHP, rather than the Joomla core.  More information on this issue can be found here:

By exploiting this issue an attacker can embed a backdoor in site, which can be used for malicious activity. In order to make detection as hard as possible, attackers often use copies of real application files (in this case a copy of Joomla's mailing class) to embed their exploit code. Those copies will never be used in normal application execution, so there's no "override" as claimed in the report, they simply used the file to obfuscate the actual backdoor.



  2373 Hits

Joomla 3.10 and Joomla 4.0

At the end of 2019, the Joomla Project plans to release two versions simultaneously: the minor version, Joomla 3.10 and the new major version, Joomla 4.0. Joomla 3.10 will be the last release of the 3.x series. As announced in May 2018, and due to the release of Joomla 3.9, Joomla 3.10 will be the final release of the Joomla 3.x series. J...

Continue reading
  2568 Hits

Joomla attended the CMS Security Summit at Google in Chicago

January 30th 2019 - It’s freezing cold in Chicago today and according to the news, it’s even colder than on the Mount Everest - so a perfect day to stay inside a warm building, sitting in front of your machine and having a (sorry, bad Everest joke) summit!

Read More ...

  2122 Hits

Joomla 3.9.3 Release

Joomla 3.9.3 is now available. This is a security fix release for the 3.x series of Joomla which addresses 6 security vulnerabilities and contains 30 bug fixes and improvements.



  2249 Hits

Keeping your Joomla website up-to-date

As of release 3.5 Joomla is collecting stats data, thanks to the stats plugin (only works if it’s enabled), and it found too many websites are not using the currently supported release of 3.9.2. This data is based on the Joomla, PHP, and database version. These are some pretty alarming statistics, and should not be ignored! We have provided some links at the bottom of this article for your reference, review, and to even get the latest release of Joomla.



  2425 Hits

JUG Dallas/Fort Worth Feb 11th Joomla 3 Template Overrides

Join the DFW (Dallas/Fort Worth, TX USA) Joomla User Group this Monday February 11 at 7pm CST (GMT-6) for a presentation on: Topic: Introduction to Joomla 3 Template OverridesMany Joomla webmasters have heard about template overrides, but don't know how to do them. They assume they need to know PHP in order to make changes to their template. Good n...

Continue reading
  3061 Hits

#PolarVortex - Stay Warm Everyone

Quick reminder to Midwest Joomlers to keep warm over the next few days of brutal windchills. 

  2878 Hits

Joomla 3.9.2 Release

Joomla 3.9.2 is now available. This is a security release for the 3.x series of Joomla which addresses 4 security vulnerabilities and contains over 50 bug fixes and improvements.



  2231 Hits