Two critical security updates in a single day: PHP and YOOtheme Pro

21 October 2026

Two critical security updates on one day, and at the same moment too. On Wednesday 21 October 2026 at 14:00 UTC (16:00 CEST), both PHP and YOOtheme Pro 5 publish a release that closes a hole through which an attacker can run code on your server without logging in. Below you can read what is going on, what I did for my clients today, and what you need to do yourself.

1. PHP: CVE-2026-109618 and CVE-2026-109619

On 20 October the PHP team announced a "critical security release" for 21 October at 14:00 UTC. It is about two vulnerabilities in PHP itself: CVE-2026-109618 en CVE-2026-109619, both rated with a CVSS v4.0 score of 9.2. Researchers call the attack php2shell: remote code execution, without the attacker needing an account.

What makes this different from a normal vulnerable extension: the problem is not in Joomla, WordPress or a plugin, but in PHP. So every PHP application is affected, from Joomla and WordPress to Drupal and web shops. The problem happens when PHP processes multipart/form-data, the format a browser uses for forms with a file upload. PHP processes such a request before your CMS runs a single line of code. A security extension in Joomla cannot protect you against this.

A setting in php.ini does not help either. On the internet you see the advice to switch off session.upload_progress.enabled, but according to the PHP developers the only real fix is to update PHP.

1.1 Which versions?

PHP only publishes the official list of affected and fixed versions together with the release. What is known now:

PHP version	Status
8.5	Fix in 8.5.12
8.4	Fix in 8.4.27
8.3	Fix in 8.3.36
8.2	Fix in 8.2.35
8.1 and older (including 7.4)	End-of-life: no official fix

The version numbers come from reports published before the release. Check them on php.net as soon as the release is out. According to CERT-EU, everything from PHP 5 onwards may be vulnerable, and Cloudflare already saw the first attacks on the morning of 21 October, so before the patch was available.

If you use the PHP packages of your Linux distribution, also check your distribution's security advisories: distributions sometimes backport fixes to an older version number.

1.2 Websites with personal data temporarily offline

A few clients have websites that store personal data of their own customers or clients. There I did not want to take any risk in the hours between "the attacks have started" and "the patch is installed". With those clients I agreed to take the website offline temporarily and show a holding page. A few hours without a website is annoying. A data breach with client data is much worse, and in the EU you then also have to report it to your data protection authority.

1.3 Old PHP versions on my VPS servers

Because only PHP 8.2 and higher get a security update, I tried to upgrade all sites with an older PHP version on my VPS servers to 8.2 or higher. For most sites that worked.

A few sites have to stay on PHP 7.4 for a while for technical reasons. There will never be a fix for that version. On those Nginx servers I changed the configuration so that forms with multipart/form-data are no longer passed to PHP. That way the vulnerable part of PHP never gets its turn:

if ($http_content_type ~* "multipart/form-data") {
    return 403;
}

This is an emergency bandage, not a fix. Every form with a file upload stops working, and that includes uploading images in the Joomla Media Manager. The only real solution is to update to a PHP version that still gets security updates.

2. YOOtheme Pro 5: CVE-2026-102785

The same afternoon YOOtheme Pro 5.0.53 was released. The changelog is short:

## 5.0.53 (October 21, 2026)
### Security
CVE-2026-102785: Fix unauthenticated remote code execution via image handler

So again remote code execution without logging in, this time through the code in YOOtheme Pro that processes images. Technical details have not been published yet.

2.1 Which versions?

Only YOOtheme Pro 5 is affected: from 5.0.0 up to and including 5.0.52. According to YOOtheme, version 4 and older are not vulnerable to this hole. There is no temporary workaround; updating is the only fix.

Update via System > Update > Extensions in Joomla, or in WordPress via the Updates screen. Afterwards, check in the YOOtheme Pro customizer that it really says 5.0.53.

2.2 Clients informed in advance

For clients with a maintenance contract I update YOOtheme Pro myself. Clients without a maintenance contract got a message from me in advance about the security update at 16:00, so they can update themselves right after the release, and do not see the notification by accident a week later.

3. What should you do?

These are two separate problems. An update of Joomla or YOOtheme Pro does nothing about the hole in PHP, and a PHP update does not fix YOOtheme Pro. So you need to check both.

Make a backup of your files and database before you update anything.
Find out which PHP version your site uses: in Joomla via System > System Information.
PHP 8.2 or higher: install the new release. If you are with a hosting provider, ask when the patch will be installed. Being able to select "PHP 8.3" in the hosting panel does not mean the fixed 8.3 is already on the server.
PHP 8.1 or older: upgrade. If that is not possible right away, block multipart/form-data on the web server or take the site offline temporarily.
YOOtheme Pro 5: update to 5.0.53. If you use version 4 or older, you do not need to do anything for this hole.
Test your website after the updates: forms, images, the backend and connections with other systems.
Check whether your site has already been hacked. The attacks started before the patch, and an update does not remove files an attacker has already placed. Look for unknown PHP files, changed files, new administrators in Users > Manage, and suspicious requests in the server logs.

Two holes this serious on the same day is exceptional. The good news is that you can close both with an update, as long as your software is still supported. Not sure which PHP version your site runs, or want someone to look along with you on an upgrade from PHP 7.4? At db8 Website Support that is daily work.