Active webshell with full control over the website
An anonymized case of a critical Joomla compromise where deleting individual files was not enough.
A healthcare website on Joomla. The client reported that the site was “behaving oddly” and brought a backup, asking us to put it back. We reviewed that backup offline first instead — and that decision shaped the entire recovery.
What we found
The backup contained two substantial PHP web shells from a well-known family of administrative shells, a separate backdoor allowing file upload and system command execution, and modified rules in directories that should only have held static files. The security inventory additionally listed dozens of historical payloads in randomly named subdirectories of one extension.
What we did not find is just as telling: the Joomla core itself was intact and the extensions were reasonably current. That is precisely the situation in which a routine scan declares a site “almost clean”. It changes nothing about the severity — together, those files allowed file management, upload, deletion, permission changes, command execution and access to configuration and the database.
How we handled it
We kept the original backup as an immutable evidence source and worked on a separate copy. Suspicious PHP files and modified rules were isolated rather than deleted outright — with an active shell, the order of operations matters more than speed.
We built the recovery as a clean rebuild from verified distribution packages rather than deleting individual findings. Extensions were reinstalled instead of being assumed untouched. Then came a review of the database, administrator accounts, permissions and configuration secrets, rotation of every credential, and a final comparison of the clean copy against the production state.
Outcome
We marked the backup as unsuitable for direct deployment. The recommended recovery went through a clean rebuild — had the original backup been restored instead, the site would have gone back online with the attacker’s full toolkit intact.
The takeaway
An up-to-date core does not mean a clean site. With an active shell, the correct assumption is that the entire webroot, the accounts and the stored secrets may all be compromised — and the recovery has to match that assumption. An antivirus scan, or deleting the one file that was found, is not a completed cleanup in that situation.