The Joomla extension market has a security incentive problem. The EU Cyber Resilience Act might fix it
Something has changed in how Joomla extensions get attacked, and it has changed faster than most of the ecosystem has adjusted to. This post is about that shift, and about an incentive problem in the extension market that the EU Cyber Resilience Act (CRA in short) may end up fixing almost by accident.
Hours, not weeks
There used to be a rhythm to extension vulnerabilities. A researcher finds a flaw, reports it responsibly, the developer has days or weeks to build and test a fix, a patch ships, and only later does technical detail become public. That rhythm gave defenders time.
What happens when there's no share button to click
When you think about GDPR on your website, you probably think about cookies, analytics scripts, and your own third-party embeds. Fair enough, those are the usual suspects.
But there is a tracking mechanism that happens entirely outside your website, on your visitor's phone, and most site owners (and most visitors) have never heard of it.
Read more: What happens when there's no share button to click
What the EU Cyber Resilience Act means for your Joomla website
If you use Joomla extensions developed and sold by EU-based vendors, wherever you are in the world, the EU Cyber Resilience Act is about to change what those vendors are required to provide you. And if you are an EU-based developer selling extensions, it changes what you are required to provide.
This post explains what the CRA is, what it requires, and what it means in practice for Joomla site owners, agencies and extension developers, inside and outside the EU.
This post is informational and does not constitute legal advice. For your specific situation, consult a qualified legal professional familiar with EU digital regulation.
Read more: What the EU Cyber Resilience Act means for your Joomla website
CRA compliance checklist for Joomla agencies
The EU Cyber Resilience Act is coming. If you run a Joomla agency, building and maintaining sites for clients, the regulation almost certainly does not apply to you directly. But it does change what you should expect from the extension vendors you rely on, and it creates practical responsibilities that are easy to overlook until a client asks an uncomfortable question.
This checklist is designed to help you get ahead of that conversation.
Reflection & Reality: will 2026 be the "Year of Joomla"?
Dear Partners,
As the year draws to a close, it’s a natural moment for reflection, especially in our industry, where change is constant and long-term direction matters more than ever.
For decades, the tech world has repeated a familiar joke: “This will finally be the year of the Linux desktop.” It is a phrase that has carried equal parts optimism and irony for more than 25 years. That same question has followed Joomla for a long time as well: Will next year finally be the year of Joomla?
Read more: Reflection & Reality: will 2026 be the "Year of Joomla"?
New Two-Factor Authentication for Secure Joomla Extension Downloads
At OnlineCommunityHub, we’re always looking for ways to improve both the functionality and security of our Joomla extensions. To better protect your subscription-based downloads, we are introducing a new layer of security: Two-Factor Authentication (2FA) for the use of your Download ID.
This new feature will help ensure that only authorized devices are able to download and install our extension updates via the Joomla update server.
Read more: New Two-Factor Authentication for Secure Joomla Extension Downloads