A working homepage can hide a compromised site
A website compromise can begin with an unfamiliar PHP file in an upload or temporary directory. Visitors may see nothing unusual while an attacker has another route into the hosting account.
This incident account concerned Joomla and possible abuse of an editor or upload feature. The original article named JCE and CVE-2026-48907. Without confirmed advisory details and the originating requests, that identifier alone doesn’t prove the route used in this particular incident.
What the investigation found
The notes described two suspicious PHP files in the site’s temporary directory, with names beginning lanciau. A scan identified them as malware. A PHP management interface labeled BYTE_BUNK Shell v4.0 included extensive file-management and command-execution functionality.
Those findings justify treating the hosting environment as potentially compromised. They don’t establish which HTTP request wrote the files or who operated the shell. Access logs, PHP logs, quarantine copies, and a timeline are needed to investigate that.
Web shell versus reverse shell
A web shell accepts instructions through a web-accessible endpoint. A reverse shell instead establishes a connection outward from the affected server. A web shell may enable further actions, but its presence doesn’t prove that a reverse connection occurred.
The investigated material didn’t establish a fixed command-and-control destination. Capabilities in code and actions actually executed are different kinds of evidence.
Failed logins are another signal
The original notes counted 1,129 failed Joomla login entries, including a large number from one address. That indicates hostile login activity, not proof that the same address uploaded the shell. An IP address alone doesn’t identify a person.
Respond to the environment, not just one file
- Contain access while preserving relevant evidence.
- Review CMS, extensions, hosting accounts, and the upload path.
- Inspect additional files, administrators, scheduled tasks, configuration changes, and redirects.
- Assess exposed database credentials and data access.
- Close the entry point and recover from a trustworthy state.
- Rotate affected secrets and monitor for recurrence.
A web application firewall can reduce some malicious requests, but doesn’t remove existing persistence or replace updates. A preventive service also isn’t automatically a forensic investigation service. Define what your host or security provider is actually doing before calling the incident resolved.
