Published on 2 August 2026
If your company website runs on Joomla and you use one of the extensions SP Page Builder or Page Builder CK to build your pages, don't put this article off until tomorrow. Since mid-June 2026, automated attackers have been actively exploiting two critical security vulnerabilities in precisely these extensions – on a massive scale. The result of a successful attack: the website is completely taken over. Attackers create hidden admin accounts, upload malicious code and can steal all stored data. The good news: patches already exist, and securing your site takes just a few minutes.
On 10 July 2026, the Cyber Security Agency of Singapore (CSA) issued an official warning (Alert AL-2026-085) about the active exploitation of two critical vulnerabilities in popular Joomla extensions:
Both vulnerabilities received the highest possible severity rating: CVSS 9.8 under version 3.1, and even 10.0 under the newer CVSS version 4.0. The CVSS score (Common Vulnerability Scoring System) rates the danger of a vulnerability on a scale up to 10 – it doesn't go any higher.
The US agency CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog (KEV) on 7 July 2026. This catalog lists only vulnerabilities whose active exploitation in the wild has been confirmed. US federal agencies were given a patch deadline of just three days – a clear signal of the urgency.
„Attackers are exploiting critical vulnerabilities in Joomla's SP Page Builder and Page Builder CK extensions to upload malicious files and execute arbitrary code. Patch immediately." – Cyber Security Agency of Singapore (CSA)
Both vulnerabilities stem from the same fundamental flaw: an unprotected file upload (technical term CWE-434, "Unrestricted Upload of File with Dangerous Type"), combined with a missing authentication check (CWE-284, "Improper Access Control").
Put simply: both extensions had a function for uploading files that did not check who was uploading something or what type of file it was. An attacker therefore did not need to be logged in or know a password. They could simply upload a so-called web shell – a small malicious file in PHP format that gives the attacker remote control over the server (RCE, "Remote Code Execution", i.e. running arbitrary code from afar).
The attack runs via an endpoint at the address index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon. This was actually only meant for uploading small icon graphics – but it checked neither authentication nor file type. An attacker could thus upload a .php file, call it up in the browser, and the server would dutifully execute it. The patch in version 6.6.2 now enforces an access check: only logged-in users with admin permissions and a valid security token.
Here the only hurdle was a so-called anti-CSRF token – a security feature meant to prevent requests being submitted from external sites. The problem: this token can be read publicly on the website's own pages and therefore poses no real barrier. Particularly critical: the attacker could freely choose the target folder for the upload and thus place their web shell anywhere.
Both vulnerabilities were discovered by security researcher Phil Taylor, founder of mySites.guru, as part of a broad investigation into popular Joomla extensions. He reported them responsibly to the vendors. His assessment of the root cause:
„The vulnerabilities were always there. The difference this month is that somebody was finally looking. […] I was finding one to two critical or high-severity unauthenticated remote code execution flaws every single day, for over a week." – Phil Taylor, mySites.guru
SP Page Builder is one of the most widely used Joomla extensions of all: over 13.6 million downloads and around 792,000 users worldwide (source: JoomShaper). Page Builder CK is a widespread free alternative. Joomla itself, according to W3Techs (as of 1 August 2026), powers around one percent of all websites worldwide – roughly one million sites.
For German SMEs the situation is particularly relevant, because Joomla has traditionally been widely used in Germany and many mid-sized companies run their websites on it. Making matters worse: 53.7% of all Joomla installations still run on the outdated version 3, which often complicates applying updates.
Important to understand: the attacks run fully automatically through bots that scan the internet specifically for vulnerable installations. Nobody is targeting your company personally – but every vulnerable website is a target. Both vulnerabilities were being actively exploited within hours of the patches being released.
/components/com_sppagebuilder/ or /components/com_pagebuilderck/.@secure.local (e.g. webeditor48@secure.local)..php files in /media/com_sppagebuilder/assets/, /images/ and /media/ including subfolders. Suspicious files often contain strings such as "PHP File manager"..php files under /media/com_pagebuilderck/ (especially /gfonts/), and also in /images/, /media/, /templates/ and /administrator/. Known web shell: bhup.php with the content $_POST["_upl"] == "Upload".index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon.#__users and #__user_usergroup_map, watch out for unknown super-user entries.crontab -l to check for unknown entries – attackers like to establish persistence there.Security researcher Phil Taylor sums up the order of priorities: "Update to 6.6.2 before you do anything else, then check whether you were already hit." So: patch first, then check for compromise.
asset.uploadCustomIcon. Note: the dot in the task name can be transmitted URL-encoded as %2e – the rule must cover both variants. With Page Builder CK, merely disabling it does not reliably protect; here the update is the only reliable solution.@secure.local addresses.$_POST["_upl"]).configuration.php), FTP/SSH access and API keys..htaccess (Apache) with php_flag engine off or in the Nginx configuration with location ~* /(images|media)/.*\.php { deny all; }.Between mid-June and the end of July 2026, mySites.guru discovered a total of 19 critical vulnerabilities in 17 popular Joomla extensions, five of them with the maximum value of CVSS 10.0. The wave of attacks did not just hit individual operators: one affected Joomla service provider reported in the JoomShaper forum internal costs of over 20,000 euros just for cleaning up compromised client websites.
There was also criticism of the vendors' communication. A long-standing JoomShaper customer wrote in the forum: "This is a global problem yet I have not received even one notice from JoomShaper about this. That is absolutely NOT acceptable." The lesson: don't rely on being actively informed about security problems – check regularly yourself.
If such an attack accesses personal data – for example customer data, contact form entries or email addresses – this has significant data protection consequences:
If you suspect a compromise, you should immediately involve your data protection officer and document the incident properly.
Two vulnerabilities with the maximum severity rating, actively exploited by automated bots, in two of the most widely used Joomla extensions: this is one of the clearer calls to action there is in website security. The patches have been available since June 2026 and are free. Anyone using SP Page Builder or Page Builder CK should now do two things – in this order: update and then check whether the website has already been compromised. Because the attackers leave behind hidden admin accounts and backdoors; once a website has been taken over, it can remain under someone else's control even after patching. Take the 30 minutes – it's far cheaper than a GDPR proceeding or cleaning up a hacked server.