If you still have Joomla version 2.5 (hopefully 2.5.28), it’s time to upgrade if you haven’t already.  In fact, it’s way overdue. If you’ve been untouched up to this point consider yourself extremely lucky.  Your hosting company is most likely above average when it comes to blocking specific script injections, known vulnerabilities and has a backup strategy.  However, due to the fact that Joomla has dropped support for 2.5, there’s only so much your hosting company will be able to do by mid 2016.

Hackers are coming. Joomla 2.5 defacements are coming.

Joomla issued a warning about this way back in December 2014. That said, they recently issued a patch to 2.5.28 which caught a vulnerability, and responsible developers applied this to all of their Joomla client sites.  Joomla stated at that time this would be ‘the final patch for 2.5’ and recommended immediate migration to 3.5. If a site is injected with shell code, hackers can create directories and programs inside your site. Mostly this is for defacing all of the sites on the server, or they will install fake pages that resemble PayPal and popular banks in order to phish out user passwords.

They can also redirect your site to a malware site that will infect your website visitors. Google will make note of this in their search, and will require you to prove that your site is virus-free before re-instatement.

Maybe worst of all, your host may shut down your site until it’s in the clear.

If you need help with your migration you should contact your web developer as soon as possible.  Stay current.  And find a qualified web host that will watch your back.