Skip to main content
Critical security updates on 21 October 2026

PHP and YOOtheme Pro 5: We bring your Joomla website up to a safe state.

PHP and YOOtheme closed critical holes on 21 October 2026: PHP in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, YOOtheme in YOOtheme Pro 5.0.53. We check your website for traces of an attack, back it up and install the updates. On Joomla 3 we show you the way to Joomla 6.
  • We back up your website first.
  • We check PHP, Joomla, YOOtheme and the extensions.
  • You know the price before we start.
  • On Joomla 3 we say openly what still works.
Have my website checked 0176 103 183 56Rather talk directly?
Check the state
Free
Install updates
Price upfront
by effort
Maintenance contract
from €30
net / month
Our approach

Check first. Then update.

!
An update without a check can bring the website down, for example when an extension does not cope with the new PHP version. That is why we work in fixed steps.
Check the state
PHP, Joomla, YOOtheme, extensions
Back up
Files and database
Update
YOOtheme, PHP, Joomla, extensions
Check and report
Test and short report
On Joomla 3 a change of the PHP version can stop the website – then we discuss the way first.
Price before the start.
We name the price before we start.
17
years of Joomla experience
specialised in Joomla since 2009
ENT practice Dr. Wischatta
Karate Sülfeld
Nord-Bike Sülfeld
Swingolf Hamburg
ICD Hamburg
Peter Reuff Licht
Transparent pricing

What does the update cost?

The effort depends on the state of your website. We name the exact price after a first look, before we start.
First assessment
Free
You tell us your website. We tell you what needs doing and what it costs.
Ask for an assessment
Check the state
Install the updates
For now
Price upfront
by effort
Back up, update YOOtheme and PHP, bring Joomla and the extensions up to date, then check.
Ask about the update
Install updates
Protected afterwards
from €30
net / month
With a maintenance contract we install updates regularly, with backups and security checks.
Ask about maintenance
Maintenance contract
Joomla 3:
If your website still runs on Joomla 3, a PHP update alone does not help. We check the move to Joomla 6 and name the effort upfront.
Now

What you should do
today.

The updates are out. With three steps you know where your website stands – even if it looks perfectly normal.

Look up the versions
YOOtheme Pro 5.0.53 or newer (System → Manage → Extensions), PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer (System → System Information).
Look for traces
PHP files in the images folder, unknown administrators, files that are new since 21 October – and keep a backup from before.
Ask your host – or us
When does the host install the PHP update? We find out for you if you like.
Only install updates from official sources: PHP through your host, YOOtheme Pro through the Joomla update or your YOOtheme account.
Up to a secure state
Back up first, then update.
What is happening

Two updates, one date.

Both updates were released on 21 October 2026. The hole in YOOtheme Pro 5 was attacked before that – so besides the update, looking for traces counts too.

PHP: two critical holes

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 close two holes with a severity of 9.2 out of 10 (CVE-2026-109618, CVE-2026-109619).

YOOtheme Pro 5: update 5.0.53

Affected are YOOtheme Pro 5.0.0 to 5.0.52, fixed in 5.0.53. YOOtheme Pro 4 and older are not affected.

PHP comes from the host

The PHP update is usually installed by the host. We check whether and when that happens and switch the PHP version if needed.

Only current PHP versions

Security updates only come for supported PHP versions, currently 8.2 to 8.5. PHP 8.1 and older no longer get any.

Joomla 3 is left out

Joomla 3.10 is designed for PHP up to 8.0. These versions no longer get updates from the PHP project; they are only protected if the host backports fixes itself.

Back up first, then update

An update without a backup is a risk. We back up files and database before we change anything.
How we work

Four steps to an up-to-date website.

We do not just install updates; we first check whether template and extensions play along.

Check the state

We look at the PHP, Joomla and YOOtheme version, the extensions and the state at the host.

Back up

We back up files and database before we change anything.

Update

We install the YOOtheme update as soon as it is out, switch PHP or sort it out with the host, and bring Joomla and the extensions up to date.

Check and report

We check the website afterwards and tell you what we did and what is still open.
Before we start you know the steps and the price.
Have it checked now
Honestly calculated

What the effort depends on.

Every website is different. These points decide how much work the update takes.
We name the price before we start.

Joomla version

Joomla 4, 5 and 6 we usually bring up to date directly; Joomla 3 needs a way of its own.

Extensions and template

Outdated extensions may have to be updated too, so that they cope with the new PHP version.

Access to the hosting

If we can switch the PHP version ourselves, it is faster than going through the host.
Good to know

Frequent questions about the security update

The most important answers about PHP, YOOtheme and Joomla 3.
Do I have to do anything myself?
If your website runs on YOOtheme Pro 5, yes: the update does not install itself. The PHP update is usually done by the host; whether and when is up to them. With a maintenance contract we take care of it.
Is my website affected?
The YOOtheme hole affects YOOtheme Pro 5.0.0 to 5.0.52, not YOOtheme Pro 4 and older. With PHP, every version older than 8.2.35, 8.3.36, 8.4.27 or 8.5.12 is affected – PHP 8.1 and older too.
What about Joomla 3?
Joomla 3.10 is designed for PHP up to 8.0. PHP 8.0 has had no updates since November 2023, PHP 8.1 since the end of 2025. There is no fix for these versions. The website only becomes safe with the move to Joomla 6.
Can an update bring my website down?
Yes, if extensions or the template do not cope with the new version. That is why we back up first and check afterwards; if there are problems, we restore the old state.
What does it cost?
The first assessment is free. We name the price of the update upfront; it depends on the state of the website. The maintenance contract from €30 net a month includes updates.
How fast do you get back to me?
Usually on the next working day. If your website already behaves strangely, it is best to call us.
Personal, not a ticket

Rather talk directly?

Not sure what your site runs on? Tell us your website.
0176 103 183 56Call without obligation
Have the state checked
Ask for a check

Tell us your website.

Send us the address of your website. We get back to you with a first assessment and the price.
Or call us directly:0176 103 183 56

We are happy to advise you personally.

Ufuk Avcu
Your personal contactUfuk Avcu · Owner & developer

Free first estimate

Two required details are enough to start.

Please enter your website.
This email address is being protected from spambots. You need JavaScript enabled to view it.Please enter a valid email address.
Invalid input
Invalid input
Invalid input
Invalid input

We use your details to process your inquiry. More in our privacy policy.