The JCE Profiles Hack

The dedicated JCE check above is new. The detection underneath it is not. Every mySites.guru audit has always read every file in your webspace, line by line, including the dormant files a browser-based scanner never sees. The webshells this attack drops, the hidden .xml.php droppers, the obfuscated eval(gzinflate(base64_decode(...))) blobs, the shell_exec command shells, were already being flagged by the suspect content and hacked file scanning that runs on every snapshot: over 2,000 hand-written patterns and 14,000+ confirmed-hacked file hashes, updated daily. Even the fake JCE profile itself stood out, because of tells like the forced -99999 ordering no real profile ever uses.

What we built this week is a whole set of new tooling aimed squarely at this attack. A dedicated check that targets the specific known droppers and files from the JCE hack and reports them in their own "Hacked?" section, a one-click tool that removes a fake profile straight from the JCE profiles database, and the detection signatures behind both, all added in days. It is the difference between "your audit flagged some suspect files, go and read them" and "this is the JCE profiles attack, here is exactly what to remove, remove it now." If you want the detail on the two underlying signals and how to tell a real threat from a noisy one, the suspect content vs hacked files guide walks through it.

That is the pattern, not the exception. mySites.guru is, has been, and always will be updated daily with new features, tools, recipes and detection to match what agencies running Joomla, and WordPress, actually need as the threats move. When the next attack lands, the underlying scanning has usually already seen the shape of it, and a targeted tool follows close behind.