One of the sites I maintain was hacked a while ago through a critical vulnerability in the Sourcerer plugin for Joomla. I didn’t know about the vulnerability until the damage was done. I replaced all the site’s files and updated the plugin, but the site was hacked again the next day. There was less damage the second time. I then discovered that the fix I had installed did not address the vulnerability.
I built the site a long time ago and had already considered replacing Sourcerer several times. It lets you run PHP code directly in Joomla articles, but it also comes with a large third-party code library that is unnecessary for my needs. So I made my own plugin. It includes PHP files in articles, with restrictions on which files can be used. It's only using Joomlas own code library, so no more code injections. Install the plugin, activate it and add the file to the white list and it will work.
Download from here https://extensions.joomla.org/extension/php-include/
Or direct link: https://github.com/dameraus-code/phpinclude/releases/tag/v1.3.3
An example: {phpinclude:time.php}
2026-11-02 00:08:10 UTC