Hi,

Thank you for reaching out and for providing detailed information about the incident. We understand the urgency of the situation and apologize for the inconvenience this has caused.

If you have a clean and verified backup from before the compromise, we recommend restoring that backup first. After confirming the website is clean, update both the System - Helix3 Framework and Helix3 - Ajax plugins to the latest version (v3.1.2). This is the safest and most reliable recovery approach.

If you do not have a clean backup available, please follow these steps:

1. Go to Site Template Styles → Your Template → Template Options → Custom Code → Custom JavaScript.
2. Check the Custom JavaScript field for any suspicious or unknown JavaScript code. If you find any injected code, remove it and save the changes. This should remove the malicious message if it was injected through the template settings.
3. Update both the System - Helix3 Framework plugin and the Helix3 - Ajax plugin to the latest version (v3.1.2).

If the update is not available through your Joomla Update Manager, you can download the latest Helix3 package from the following page and install it manually via Extensions → Install:

https://www.joomshaper.com/joomla-templates/helix3

Please note that when updating Helix3, some template settings—such as the logo, Custom CSS, and other template configuration options—may need to be reconfigured manually afterward. We recommend taking screenshots or exporting your current template settings, if possible, before performing the update.

If the website has been compromised beyond the injected JavaScript, we also recommend performing a full security audit of the Joomla installation, including checking core files, third-party extensions, administrator accounts, and the hosting environment to ensure no additional malicious files or backdoors remain.

Best regards

Hi, I can confirm that I am experiencing exactly the same issue on multiple Joomla 3 websites. I currently manage several Joomla websites, and during the last few days three different Joomla 3.10.12 websites have been compromised in exactly the same way.

In every case I found malicious code injected into Template Style → Template Options → Custom Code.

For two websites, the attacker injected code into:

• Before </head>
• Custom CSS
• Custom JavaScript

For another website, the malicious code was injected only into Custom JavaScript.

One of my hosting providers analyzed the server logs and informed me that the suspected attack vector may be related to the recently disclosed vulnerabilities CVE-2026-48907 and CVE-2026-48908.

All affected websites are running:

• Joomla 3.10.12
• SP Page Builder 3.8.10
• Helix 3

I understand that Joomla 3 is End of Life, and whenever possible I migrate my clients to newer Joomla versions. However, not every client is willing or able to migrate immediately, so many websites must temporarily remain on Joomla 3 while still needing the highest possible level of security.

Could you please clarify:

• Is SP Page Builder 3.8.10 affected by these vulnerabilities?
• Is updating only Helix sufficient, or should SP Page Builder also be updated?
• Is there an official security advisory or recommended mitigation for websites that must temporarily remain on Joomla 3?

Thank you very much for your support.

Hi, Thank you very much for your prompt and detailed clarification. That makes perfect sense. You are absolutely right: the reference to CVE-2026-48907 and CVE-2026-48908 came from my hosting provider's investigation, but it was related to a different website running Joomla 5 with a newer version of SP Page Builder. The three Joomla 3 websites I mentioned are a separate case, and your explanation regarding the recently identified Helix3 security vulnerability helps clarify the situation. I really appreciate your support and the technical explanation. I will update both the System - Helix3 Framework and Helix3 - Ajax plugins to version 3.1.2 and continue checking the affected websites for any remaining malicious code or indicators of compromise.

Thank you again for your assistance and for the excellent support. Best regards

About cleaning, please use our script > https://github.com/zkrana/joomla-security-scanner

It also clean malware from Template db

Thank you. I really appreciate your help and all the information you and your team have provided. I will definitely use the scanner along with the Helix3 updates during the cleanup process. Thank you again for your excellent support.

reply in hidden content

Please recheck the credentials you have provided

Did it! in hidden

I apologize for the inconvenience caused. Could you please check now and let me know if the issue is resolved on your end?

Looking forward to your response.

Best regards

hidden