Today a guy from the Joomla team mailed to the phpsec mailinglist, that they have released a new version of Joomla because of a security hole, that according to him is used by script kiddies to install rootkits on servers.

The URL to the announcement he posted is: http://www.joomla.org/content/view/498/74/

At this official announcement URL they say that they fixed 6 vulnerabilities, but only describe 5 of them, leaving out the most critical, that allows remote code execution. After reading this I was of course curious and asked the guy by email:

Is it project policy, to announce that you fix 6 vulnerabilities, then only describe 5 of them and leave out the one that allows remote code execution?

Unfortunately the phpsec moderator Marco Tabini thinks that my question is not appropriate for a PHP security mailinglist and censored it away.

Update: meanwhile the announcement mentioned above adds a 6th vulnerability to the list. But It only speaks about another XSS vulnerability and does not say anything about the remote PHP code execution vulnerability.