Support

First of all, which vulnerability are you talking about? There has been no exploitable vulnerability in Akeeba Backup for well over a decade.

If you are talking about the security hardening we did two months ago, we did not fix anything exploitable. That's why it's security hardening, not a security release. We addressed pedantic-level issues. The worst that could've happened is that if you were logged into your site, an attacker knew the ID of a backup, and you visited a malicious page they had crafter they could delete the backup from your database – and even that was very conditional. Moreover, this applied to the completely rewritten Akeeba Backup 9 and 10, the version we reimplemented with the Joomla MVC API for Joomla 4 and later. Akeeba Backup 8 was running on our own framework, FOF, where these issues did not apply as far as we can tell. Also note that Akeeba Backup 8 and FOF refuse to run on Joomla 4.2 or later, and you have overwritten the Akeeba Backup component anyway.

If you are talking about the PHP security issue from a few weeks ago, that has to do with PHP itself, not any software running on it. The mere existence of a vulnerable version of PHP on the server would be the problem; but your host has already patched it.

If you are talking about all the other extensions which had major, zero-day security issues back in June – these were not ours. I know the problems these extensions had. These are things that we always guard against in our own software. I have often said no to features which would've required doing something stupid exactly for this reason: it doesn't matter if an extension has a cool feature if the prerequisite for having said feature is lowering its security to the point it becomes trivial to hack your site.

Second, as far as I can see, the only thing left on your site from Akeeba Backup 8 is just the package extension. This is not executable code. Think of it as the big cardboard box it came all in. The actual machine it contained is no longer there; it's thrown away. Even if there was a vulnerability in Akeeba Backup 8 (again, none is known to this date) you'd still be safe since all that's left is an empty shell that does nothing.

To uninstall it, try deleting administrator/manifests/packages/akeeba/script.akeeba.php first. That file is the only code that's left behind. It's the installation script, which runs before the uninstallation to check for leftovers and include them in the cleanup. Since it's written for Joomla 3, it no longer works on Joomla 6; the API it uses had been deprecated in Joomla 3 and removed in Joomla 5. Deleting it won't be a problem for your use case. Quite simply put, there's nothing but the empty box left, so checking for anything else to delete would've still returned nothing if the file was working in your Joomla version; just like what happens when this file is missing.