YOOtheme Pro 5: critical vulnerability attacked before the update – what Joomla site owners should check now

On 21 October 2026 two critical security updates came together: for PHP and for YOOtheme Pro 5. With YOOtheme Pro 5, the vulnerability was already being attacked before the update was released. That is why the update alone is not enough: anyone running YOOtheme Pro 5 should also check whether the website was attacked before. Here you can read what is known, what we did on 21 October and what you should check now.

Two vulnerabilities, two responsibilities

The two vulnerabilities have nothing to do with each other, and neither update closes the other one.

• YOOtheme Pro is part of your website. The site owner installs the update – or we do as part of the maintenance contract.
• PHP runs on the server. On regular web hosting the host updates it; only those running their own server do it themselves.

YOOtheme Pro 5: what is known

• Announcement: on 20 October, YOOtheme announced a critical security update for YOOtheme Pro 5 for 21 October at 4 pm CEST. According to YOOtheme, YOOtheme Pro 4 and older are not affected.
• Update: YOOtheme Pro 5.0.53 was released in the early afternoon of 21 October, a good two hours before the announced time. According to YOOtheme's changelog it closes CVE-2026-102785, which let attackers run code on the server without logging in.
• Affected: YOOtheme Pro 5.0.0 to 5.0.52 (mySites.guru).

We deliberately leave out technical details. What counts for site owners: check the version, update, look for traces.

PHP: what is known

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 close two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that also allow code execution without logging in. PHP 8.1 and older no longer receive updates from the PHP project. Everything else is in the post Critical PHP security update on 21 October 2026.

Why the update alone is not enough

On the morning of 21 October we saw the first attacks on Joomla websites running YOOtheme Pro 5 – hours before the update was released. In these attacks, the attackers left files behind through which they could come back later. The update closes the vulnerability but removes nothing that was placed there before. Such a website often looks perfectly normal.

What we did on 21 October

• Around 10 am we started backups of all websites with a maintenance contract.
• In the morning we recognised the first attacks and immediately passed our observations on to the responsible people in the Joomla community.
• Around 1:30 pm we switched off YOOtheme Pro and its plugins on the websites we look after, as a precaution, so that the vulnerability could not be reached until the update.
• Around 1:50 pm, as soon as the update was out, we installed it and switched YOOtheme Pro back on.
• Since then we have been checking all websites with a maintenance contract again for traces of an attack.

Checklist: what you should check now

1. YOOtheme version: in the Joomla backend under System → Manage → Extensions, search for "YOOtheme". It must be 5.0.53 or newer.
2. PHP version: under System → System Information. Safe are 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer. Otherwise ask your host.
3. Foreign files: PHP files in folders meant only for images and uploads (such as images), and files that are new or changed since 21 October without anyone on your side doing anything.
4. Users: new accounts with Administrator or Super User rights that nobody on your side created.
5. The website from outside: unknown redirects, foreign links or texts; look at "Security issues" in Google Search Console.
6. Keep a backup: do not let a backup from before 21 October be overwritten.

If you find something

• Lock the website: at your host or with access protection. Joomla's offline mode is not enough – files left behind can still be called.
• Secure the traces: a backup in the current state and the server's access logs, before they are deleted automatically.
• Clean up and change all credentials: database, the website's email accounts, Joomla accounts, FTP and SSH.
• Check data protection: if the website stores customer data, registrations or form entries, this may be a personal data breach. In the EU it usually has to be reported to the supervisory authority within 72 hours (Art. 33 GDPR). This is not legal advice.

And Joomla 3?

The YOOtheme vulnerability only affects YOOtheme Pro 5; according to YOOtheme, YOOtheme Pro 4, which Joomla 3 websites run on, is not affected. The problem with Joomla 3 is PHP: Joomla 3 is built for PHP up to 8.0, and such versions no longer receive updates from the PHP project. Such a website is only protected if the host backports fixes itself. The lasting way is the switch to Joomla 6.

Sources: YOOtheme's changelog for YOOtheme Pro 5.0.53 of 21 October 2026, affected versions according to mySites.guru, security advisory of the PHP team on php.net, our own observations of 21 October 2026. As of 22 October 2026 – we will add to this post when there is news.