I agree with everything you wrote. I also appreciate JoomShaper as one of the few developers who still take the Joomla platform seriously.

I think all of us got overwhelmed in this situation because, after years of “peace” regarding hacking incidents, we suddenly had 3–4 weeks of daily Joomla exploits — serious, dangerous ones — and thousands of hacked and compromised websites. The real danger is that many of those sites still haven’t been cleaned, and attackers continue to exploit them for further attacks, crypto‑mining, and similar activities. Most people don’t even know their site has been breached if the homepage hasn’t been visibly defaced.

Honestly, I’m not satisfied with the lack of support for older Joomla versions, and now we’ve seen clearly that a huge number of users are still running Joomla 3. Unfortunately, the upgrade process is not simple, and for the average client it’s often too expensive. So we end up stuck on older versions — but we can’t just ignore that reality. Ideally, Joomla, Helix, and SP Page Builder updates would be one‑click, smooth, and painless. But of course, that’s not the case. We can see from open forum threads how many problems people face when updating Helix or SP Page Builder. If you maintain 50 or 100 websites, imagine the enormous number of hours spent fixing issues on each individual site — and in the end, how do you charge for that? Who is going to pay us for all that work?

It would have been helpful to have a timely and clearly structured response — for example: Helix 3, specific version, update instructions here; for older versions, apply this patch; then the same for Helix Ultimate and SP Page Builder.

Situations like this will only become more frequent because attackers are using AI to discover vulnerabilities. But the same approach needs to be applied on the development side at JoomShaper: proactively research vulnerabilities and patch them before releasing the product.

Good luck to everyone.

I appreciate that the JoomShaper team said two days ago they would look into possible protection measures for Joomla 3 when used together with Helix Ultimate. Unfortunately, we still haven’t received any information on this. Those websites remain active targets for ongoing attacks.

Hi Steve,

First of all, thank you for taking the time to write such a detailed and thoughtful post.

We truly appreciate your continued trust in JoomShaper over the years. Feedback from experienced professionals like you, who manage many Joomla websites in production, is incredibly valuable to us. We're also grateful for your kind words about our products and our support team.

We've carefully read through your feedback, and we'd like to respond to each of your points below.

1. Response Time

We completely understand your concern about the time it took to release the security updates.

During a security incident, our first priority is to investigate the reports thoroughly, identify the root cause, develop a reliable fix, and validate it before releasing an update. While we always aim to respond as quickly as possible, we also have a responsibility to ensure the fix is stable and doesn't introduce new issues.

2. Communication

Thank you for pointing this out.

We agree that communication is just as important as the technical fix during a security incident. Your suggestions about earlier notifications, clearer messaging, and providing more detailed guidance are appreciated.

We'll continue working to improve how we communicate important security-related information with our customers.

3. Simultaneous Releases

Although the underlying issue may affect multiple products, each product has its own codebase, compatibility requirements, and testing process. Because of that, updates cannot always be released at the same time.

That said, we understand why a coordinated release would be beneficial for customers managing many websites, and we'll continue looking for ways to improve this process.

4. Security Advisories

We appreciate this suggestion.

A more detailed security advisory that clearly explains the affected versions, the required actions, how to determine whether a site has been compromised, and the recommended remediation steps would certainly be helpful.

We'll take this into consideration as we continue improving our security communication.

5. AI for Security Analysis

Security is an ongoing effort, and we're always evaluating new tools and technologies that can strengthen our development and review processes.

Your suggestion about using AI to assist with security analysis is appreciated, and it's something we'll continue exploring.

6. Security and Stability Before New Features

We understand your perspective.

While we continue developing new features, security and product stability remain among our highest priorities. Finding the right balance is important, and feedback like yours helps us better understand what matters most to agencies and long-term customers.

7. Release Quality

We understand how frustrating follow-up releases can be, especially when you're responsible for updating many production websites.

Every release goes through testing before publication, but we know there's always room to improve. We're continuously refining our QA process and testing procedures to deliver more stable releases and reduce the need for follow-up updates.

8. Forum Knowledge Base

Thank you for this excellent suggestion.

We agree that, whenever possible, sharing the root cause and a general explanation of the solution would make the forum much more valuable for the community.

While some cases involve customer-specific configurations that can't be shared publicly, we'll continue encouraging our team to provide more useful technical summaries whenever appropriate.

Once again, thank you for taking the time to share your feedback and for your continued support of JoomShaper.

Constructive feedback like yours helps us improve not only our products, but also our communication, documentation, and the overall customer experience.

We truly appreciate your trust and look forward to continuing to earn it.