Recently I find a new user is created on my 3.6.0 site and put into "administrator" group, but the "Allow User Registration" option is set to "NO", though the "enabled" and "Activated" status are both unchecked.
I upgraded Joomla to the latest 3.6.4, then I tried to delete the user, but I was lead to a 404 page saying the page isn't working.
I know Joomla's user registration system is often used to inject malicious files so I turn it off. How did this hacker manage to get by it? And does this mean he some how has compromised my super user account?