Joomla is built by many talented individuals, carefully reviewing every code contribution made to the project to ensure that a secure system is built.
But what would happen if an attacker is able to manipulate the Joomla update server? Or if a successful attack is made against the CDN that Joomla uses for update distribution? Or to ask a more generic question: how can we be sure that an update presented in Joomla backend is actually legitimate?
