How mySites.guru keeps Joomla 3 sites patched while you plan the move

The packages have two problems that make them hard to manage by hand. They install only onto specific extension versions, and once applied they leave the version number unchanged, so to Joomla's updater, the Extensions manager and any scanner that compares versions, a patched site and an unpatched one look the same. JoomShaper has also shipped several releases of each package since July 2026, and every new one turns a "patched" site back into an outdated one.

So mySites.guru reads the files instead. The Unpatched JoomShaper Security Holes tool runs on every snapshot of a connected Joomla 3 site and looks inside the installed files for a string that exists only in a given release of JoomShaper's patch. For each of Helix Ultimate, Helix3 and SP Page Builder it reports whether the extension is installed, whether any patch has been applied, and whether that patch is the current release.

Applying it is one click on that site's tool page. mySites.guru then:

• backs up the files the vendor package is about to overwrite, and stops if the backup fails
• downloads JoomShaper's own package from our CDN and checks it against a pinned SHA-256, so the site receives the exact file JoomShaper published
• installs it through Joomla's own extension installer, so the vendor's version check runs and a site on the wrong version is turned away, just as it would be if you installed it by hand
• reports the outcome per extension, so a failed backup, download or install shows as a failure rather than a success with nothing changed

Undoing it is one click too, restoring the backed-up originals. We install the whole vendor package because the patched files call methods that exist only in other patched files, and splicing them in one at a time would leave a site that fatals. The tool also covers one hole no JoomShaper package reaches, a local file include in the SP Page Builder 3.8.x addon loader, with a small guard on that one line and its own backup and revert. The background is in the one-click way to patch JoomShaper extensions on Joomla 3.

Each site gets a core vulnerability card that lists every published Joomla core CVE whose affected range includes that site's exact version. The heading counts only what is still open, with the worst rating among them, so a patched site is never told it is exposed to work it has already done. Where some of the open ones can be fixed with one click, the card says how many.

Fixed CVEs are never hidden. A site that has applied every patch we ship still sees each matching CVE, marked as fixed, because hiding them would let an owner believe a published flaw never affected their version. When every one is fixed, the heading says so instead. The card also has a button that copies the CVE ids, for a client report or a ticket.

Where a site reports a version mySites.guru cannot order, for example a build string a fork invented, the card says the core vulnerabilities were not checked, and does not guess. That is the practical cost of the invented version numbers described on the options page.

The mySites.guru audit scans every file on the site against a library of roughly 1,500 regex patterns, and flags matches as a Hacked File. Instead of grepping a whole web space by hand, you get a short list, and you can read the suspect content of any file inline before deciding what to do with it.

The audit also checks core integrity. The connector compares the site's core files with the hashes of the official files for the Joomla release it reports, including 3.10.12, the release the one-click patch is built on. The paid eLTS builds were never published, so there is no official reference to compare them with, and the integrity check skips them. On a 3.10.12 site that has had the one-click patch, the patched files show up as Core File Changes with a readable diff, as you would expect.

Some compromises live in the database rather than in files. mySites.guru has targeted detection for specific database-resident compromises seen on Joomla sites, each with a one-click fix: rogue Super Admin accounts, the Helix Ultimate mega menu hack, the Helix3 template code hack, rogue SP Page Builder assets, and malicious JCE editor profiles. These are targeted checks for known campaigns rather than a general database malware scan.

In the mySites.guru dataset 4.90% of Joomla 3 sites are flagged as hacked, against 0.98% of Joomla 6 sites, and those are sites someone is paying to have watched.

• It does not migrate sites. Moving from Joomla 3 to Joomla 4 or later is a mini-migration with no update path, so the mass upgrade tool cannot do it, and we do not sell a fixed-fee migration. See what a migration involves.
• It does not make Joomla 3 a long-term home. The highest PHP version Joomla 3 runs on is PHP 8.1, which reached end of life on 31 December 2025, and no patch changes that.
• The core patch does not clean a hacked site. Find and remove the malicious files first, then patch.
• The core patch covers Joomla core only. Extension fixes come from their vendors, apart from the JoomShaper packages above, which are still JoomShaper's own code.
• There is no general database malware scan. The database checks are targeted at the specific compromises listed above.
• There is no user-facing whitelist and no way to mark a flagged file as a false positive. A file the audit flags stays in front of you until it is dealt with.
• It cannot vouch for a version that never existed. Forks that number their releases 3.11 or 3.15 cannot be matched against vulnerability data, and eLTS builds have no public core hashes to check against.

A Joomla 3 site with the core patch, the vendor fixes and a clean audit is in a far better state than most Joomla 3 sites, and still needs moving.