Cleanup the hack or revert to a backup.

The best thing to do is upgrade all your Joomla sites to the latest version so you have all the latest security updates.

Hi,

Thank you for reaching out.

Please note that the recent security updates for SP Page Builder apply only to SP Page Builder 4, 5, and 6. SP Page Builder 3 is not affected by this issue.

Based on the symptoms you've described, the compromise is more consistent with the recently identified Helix3 security vulnerability, rather than SP Page Builder 3.

To secure your Joomla 3 website, please update the following Helix3 extensions to the latest available version (v3.1.2):

• System - Helix3 Framework
• Helix3 - Ajax

You can download the latest Helix3 package from the following page:

https://www.joomshaper.com/joomla-templates/helix3

After downloading the package, please install or update both plugins to v3.1.2. This version is fully compatible with Joomla 3 and includes the necessary security fixes.

In addition to updating Helix3, we strongly recommend performing a thorough security audit of your website to ensure it has been completely cleaned. This should include:

• Removing any malicious code or injected scripts.
• Checking for unauthorized administrator accounts.
• Reviewing installed extensions and files for any unauthorized modifications.
• Changing all administrator, hosting, FTP, and database passwords as a precaution.

If you continue to experience any issues after applying the updates, please let us know. We'll be happy to assist you further.