Joomla-based sites are being attacked using the zeroday vulnerability. According to the researchers who discovered the threat, this is an object injection flaw that allows a full remote command execution.