In the content management ecosystem, Joomla has for years been a robust platform for building dynamic websites, but its security relies heavily on third-party extensions. Recently, two vulnerabilities of maximum severity – with a CVSS score of 10.0 – have been detected in the iCagenda and Balbooa plugins, which are being actively exploited as zero-days in real-world attacks. This situation not only exposes thousands of Joomla sites, but reopens the debate on security practices in extension development and the need for a comprehensive enterprise cybersecurity strategy.
The flaws allow a remote attacker to execute arbitrary code without the need for authentication, posing a critical risk for any organization that uses these components to manage events (iCagenda) or create forms and calendars (Balbooa). The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has already included these Common Vulnerabilities and Exposures in its catalog of known exploited vulnerabilities, urging emergency patches. However, the market response has been slow, and many administrators still don't update their sites, leaving the door open to massive commitments.
Beyond the technical urgency, this incident illustrates an uncomfortable reality: the security of a platform does not end at the core of the CMS, but extends to every module, plugin, or extension that is installed. Companies that rely on Joomla for their digital presence should consider that the risk multiplies with each external dependency. Therefore, a modern cybersecurity strategy cannot be limited to patching; It should include continuous monitoring, vulnerability analysis, penetration testing (pentesting), and, if possible, the development of bespoke applications that reduce the attack surface by removing unnecessary extensions or replacing them with audited proprietary components.
At Q2BSTUDIO we understand that IT security is a business enabler, not a brake. That's why we offer cybersecurity and pentesting services tailored to each infrastructure, from vulnerability detection to remediation and the implementation of proactive controls. But protection is not achieved only with specific audits; it requires a bespoke software architecture that integrates security by design, using artificial intelligence to identify anomalous patterns in real-time and AI agents that automate incident responses. These systems, combined with properly configured AWS and Azure cloud services, allow you to scale security without sacrificing performance.
The problem with Joomla extensions like iCagenda and Balbooa is that, being third-party, their update cycle isn't always in sync with security needs. When a zero-day is discovered, the exposure time can last for weeks until the developer releases a patch. Meanwhile, attackers take advantage of the window of opportunity to inject malicious code, steal sensitive data, or take complete control of the server. In this scenario, having a rapid response team and business intelligence tools that correlate security logs is essential to detect suspicious behavior before it causes irreversible damage.
AI for business is no longer a luxury, but a necessity in modern cybersecurity. Machine learning algorithms can analyze thousands of events per second, identifying deviations that would go unnoticed by a human team. In addition, AI agents can orchestrate automated actions—such as isolating a compromised container across AWS and Azure cloud services—reducing the average containment time from minutes to milliseconds. At Q2BSTUDIO we integrate these capabilities into our developments, offering solutions that not only react to, but anticipate threats.
On the other hand, patch management is not the only front. Many organizations still operate with outdated versions of Joomla or maintain extensions that are no longer supported. The temptation to "not touch what works" can lead to a false sense of security. The reality is that every line of code not maintained is a latent risk. An effective strategy involves taking a complete inventory of components, assessing their criticality and, when feasible, migrating to bespoke applications that exactly meet business requirements without exposing yourself to third-party vulnerabilities. That is precisely one of the added values that we provide at Q2BSTUDIO: tailor-made software with controlled life cycles and scheduled updates, backed by artificial intelligence to optimize fault detection.
The impact of these zero-days is not limited to websites that use iCagenda and Balbooa. Because these sites are often part of larger infrastructures—with connections to databases, cloud services, and ERP integrations—a successful attack can serve as a gateway to the entire corporate network. That's why any company using Joomla should consider cybersecurity as a cross-cutting pillar, not an add-on. And this is where AWS and Azure cloud services offer additional advantages: with a well-segmented architecture, even if a site is compromised, the impact can be isolated through network policies, security groups, and serverless functions that limit lateral movements.
In addition, continuous monitoring using business intelligence services such as Power BI allows you to visualize security metrics in real time: number of intrusion attempts, patch status, anomalous traffic, etc. Transforming security data into actionable information is key to making fast, informed decisions. At Q2BSTUDIO we help companies build those custom dashboards, integrating data sources from their cloud and on-premise infrastructure, with dashboards that alert on baseline deviations.
Finally, this incident should serve as a reminder that cybersecurity is not a state, but a process. Threats evolve, attackers innovate, and vulnerabilities appear when they are least expected. Investing in custom applications with high quality standards, having a technology partner that offers proactive cybersecurity and adopting operating models based on AWS and Azure cloud services with artificial intelligence capabilities for companies is no longer an option, it is a demand of the current market. At Q2BSTUDIO we are prepared to accompany organizations on this path, offering solutions ranging from custom software development to the implementation of AI agents and Power BI for risk management. The best defense is a good strategy, and that strategy starts with understanding that security is not an expense, but an investment that protects any business's most valuable asset: the trust of its customers.
