Hello,

Thanks for reaching out to us. Could you please share temporary administrator access to your Joomla backend? You can provide the credentials securely in the hidden content section. Also, please take a full backup of your site before we make any changes.

Once I have access, I’ll investigate further and see what’s causing the issue. Let me know once you’ve shared the details!

Best regards,

Hi,

Thanks for reaching out.

I checked your site and noticed that the menu contains an injected JavaScript snippet, which is causing the broken HTML to appear in the active menu items. This is not related to the Helix update itself but indicates that malicious code has been injected into your menu.

Please check your menu items in Menus → Menu Items, especially the active menu item, for any unexpected script tags or other injected code. You should also perform a malware scan on your site, verify that there are no unauthorized administrator accounts, and consider installing a reputable firewall/security extension to help detect and prevent future attacks.

Once the malicious code has been removed, the menu should display correctly again.

Best regards,

Hi and thank you

I found this injected snippet. But I have the same issue on 6 websites, and the snippet seems to come with update helix or sp pagebuilder. Every Site was ok, and after update the injected code is activ.

Last month we had a lot of problems with hack of sp pagebuilder/helix and I am not sure, if the new problem comes also from helix.

So what can we do?

Thank You

Hi,

Thanks for the follow-up.

The injected snippet is not part of either the Helix Ultimate or SP Page Builder update. We have not identified any such code in our released packages.

If the same injected code is present on multiple websites, it is more likely that they were compromised through another attack vector (for example, outdated extensions, compromised administrator credentials, or the previous security incident) before or during the update. Maybe the update itself simply made the already injected code visible.

We recommend the following:

• Perform a full malware scan on each affected website.
• Check for any unauthorized Super User accounts.
• Update Joomla and all third-party extensions to their latest versions.
• Change all administrator, hosting, FTP, and database passwords.
• Install a reputable firewall/security extension to help detect and prevent future attacks.

If you continue to find the same injected code after completely cleaning a site, please provide temporary Joomla administrator access and FTP access. We'll be happy to investigate further to determine whether the code is still being injected and, if so, from where.

Best regards,