Thanks, I just uploaded the 2.5.9 and the feed update.
Version 2.5.9 was necessary because the auto-update sometimes rolled back on already hacked sites due to malware found in media/com_sppagebuilder/assets/iconfont/codexsppb76eaf9d2/...
The post-update malware scan now only runs via the diff.