View Larger Image

Joomla 1.5 Vulnerable: Setting The Record Straight!

It has come to our attention that some hosting companies are force upgrading or suspending Joomla 1.5 users citing security concerns.

We would like to clear the air, even though Joomla 1.5 is not officially supported any more, it is still a secure system as long as you have a patch for the one reported issue in place. There are no known vulnerabilities with Joomla 1.5.26.

Site Owners using Joomla! 1.5, what are your options?

In an ideal world, website owners should already be migrated to Joomla 2.5.x or 3.x or at least in the planning stages to do so by now. But for whatever reasons you cannot do a migration immediately, it means you need to communicate with your hosting provider to make sure they support Joomla 1.5.

If you are a Joomla site owner with a site on one of the hosts forcing a migration, here are your options:

Move to a host that is willing to support a Joomla 1.5 installation
Make sure your Joomla site is running the latest stable version, 1.5.26, and also has the patch applied
Make sure if you have any third party extensions installed that they are running the latest version — Third party extensions are also vulnerable to security issues
Plan to migrate as soon as possible
To discuss this blog post please see this forum thread: http://forum.joomla.org/viewtopic.php?f=704&t=833086

A note to Joomla! hosting providers

If you do not wish to support Joomla 1.5 sites anymore, we recommend educating users on website security and maintenance best practices. Using a forceful one click script updater is not recommended and may create additional problems.

Reach out to Joomla experts who can help you keep your Joomla 1.5 sites secure & also help you with a communication strategy to promote upgrades to the latest supported versions.

Understand that migrations are complicated and can break thousands of sites if you do a ‘one solution fits all’ migration which will leave you with a huge number of support issues
The 1.5 to 2.5 migration can be particularly challenging as many templates and extensions need to be re-written or updated
Users will need a sufficient notice period to allow them to plan for the migration of their website – especially if they need to bring in Joomla experts to do this work for them.

So the bottom line is that if you do have a Joomla! 1.5 site, its not the end of the world. You can keep running it as long as you keep it secure but site owners should plan on migrating to a stable supported version as soon as possible.

To discuss this blog post please post on this forum post: http://forum.joomla.org/viewtopic.php?f=704&t=833086

Resources: