Core Updates vs. Extension Vulnerabilities: Why the Task Scheduler Does Not Warn You

Joomla already nudges you when a new core version is available, and Joomla's own Task Scheduler runs background jobs automatically. It is easy to assume one of the two already covers extension vulnerabilities. Neither does. Here is the actual boundary between what Joomla ships and what a tool like Houston adds on top.

What Joomla's own update check actually does

System → Update tells you when a newer Joomla core release exists. That is a version comparison against Joomla's own release feed, not a vulnerability check. It fires the same way for a routine feature release as it would for a release that patches a critical core vulnerability, and it says nothing at all about the dozens of third-party extensions most sites also have installed. The vulnerability-specific version of this, for the core only, is what Joomla's Security Centre feed is for, not the update notice itself. See how that feed compares to the VEL feed for extensions.

What the Task Scheduler is, and is not

Introduced in Joomla 4, System → Scheduled Tasks is generic cron plumbing: a framework for registering and running background jobs on a schedule, triggered by a real server cron job, Joomla's own lazy scheduler on ordinary visits, or Web Cron. It does not know or care what a task actually does. A backup task, a cache-cleanup task and a vulnerability scan are all just tasks to it. Houston registers its own daily task there automatically on install, see the setup walkthrough, but the Task Scheduler itself contributes no vulnerability-checking logic. It is the plumbing the check runs on, not the check.

The actual gap: extensions

Most of a typical Joomla site's code is not core. Once every component, plugin, module and template is counted, the core is usually a minority of what is actually installed and running. None of that third-party code is covered by Joomla's own update notice, or by anything the Task Scheduler does natively. A plugin can sit years out of date, with a publicly disclosed vulnerability, and nothing in stock Joomla will mention it. See the checklist for what to look for manually before automating it.

How Houston closes it

Houston uses the Task Scheduler as the plumbing it is meant to be, a daily job that runs unattended, and adds the vulnerability-matching logic Joomla itself does not ship: reading Joomla's own VEL feed for extensions and the Security Centre feed for the core, matching both against what is actually installed, and alerting only on genuinely new findings.