Jce Security Update And A Free Patch For Older Sites

On 3 June 2026 I released JCE 2.9.99.5 to patch a critical vulnerability in all earlier versions, followed on Monday 8 June 2026 by 2.9.99.6 , which added hardening on top. JCE 2.9.99.8 was released on 18 June 2026 to add a few more security features and fix a few bugs.

JCE Pro 2.9.99.9 is the recommended version for every site.

If you have not yet updated, please do so immediately. The vulnerability is being actively exploited, working exploit code is public, and the attacks are automated, so a site with no public registration is not safe.

One important point: updating closes the entry point but does not clean a site that was already compromised. If you were hit before updating, the update will not remove what the attacker left behind.

The attack works by getting an editor profile onto your site that permits uploading executable files, then using it to upload one. What to look for:

The reliable confirmation is in your web server access logs, which you can usually find in your hosting control panel, or request from your host. Look for unauthenticated requests to the profile import task, index.php?option=com_jce&task=profiles.import . The earliest matching entry shows when the site was first reached, so restore from a backup taken before that date. Get hold of them sooner rather than later, as many hosts keep logs only briefly, and once they have rotated away there may be no record left. A site can still be compromised even when the logs no longer show it.

Be wary of any PHP file in your images , media or tmp folders that you did not put there. Those folders should not normally contain PHP files, or files with php in the file name, eg: foo.php.xml. When a profile sets no upload path, the default location is the images folder, so start there. If you are not confident judging this by eye, the free audit below will do it for you.

For a fuller technical breakdown and a complete list of indicators, Phil Taylor of mysites.guru has published a detailed independent analysis .

Assume the site is compromised and work through it in this order:

If you would rather not do this by hand, or you manage several sites, mysites.guru offers a free audit that scans the whole site, including files outside the public web root, and flags rogue JCE profiles and anything uploaded through them.

2.9.99.9 needs PHP 7.4 and Joomla 3.9 or later. For sites not yet able to meet that, a free patch package patches the vulnerability in JCE 2.7.x, 2.8.x and 2.9.x.

JCE 2.6.x does not appear to be affected in a default configuration. The unauthenticated profile import path is blocked, and no guest-accessible profile exists by default. This has not yet been independently verified. 2.6.x is unsupported and may contain other unpatched issues, so please still plan to migrate.

Please note before using the patch:

Download the Patch Package

If you cannot update, and cannot use the Patch Package, please uninstall JCE .

If you have any questions please post on the forum .