[walrus]

This is the only additional info I have:

We've removed the javascript server side.
This is not necessarily a Joomla exploit.
It is definitely a php exploit that we are looking in to.