Scheduled-task audit (Joomla 4+ only)

A scheduled task that runs attacker code on every tick is persistence that survives cleanup. The scheduled-task audit card (Pro, Joomla 4.1+) lists every row in the scheduler table with last/next execution — and flags the suspicious ones. Only published tasks are ever flagged; disabled or trashed rows are listed for context.

What gets flagged

• Orphaned routine — the task's type isn't offered by any installed task plugin. Left over from an uninstalled extension, or registered by something that shouldn't be there. Review under System → Manage → Scheduled Tasks.
• Failed last run — recorded failures with a non-zero exit code. A hijacked task often errors; check what the routine actually does.
• Overdue execution — next run more than a day past due. Either the scheduler is broken or the task can no longer run.
• Brand-new task — created within the last 30 days. On an established site, a new scheduled task deserves one review; the flag ages out on its own.

When the installed task routines can't be enumerated (e.g. a broken third-party task plugin), orphan state reads "unknown" — displayed, never flagged. Pre-4.1 cores have no scheduler table, so the card reports unavailable.

Joomla 3

Not available. Joomla 3 has no Scheduler component, so there is nothing to audit — this card exists only on Joomla 4+ builds.