What a Wednesday this is going to be

Advance notice of one critical security release is rare. Advance notice of two, pointed at the same hour of the same afternoon, is something I have not seen before. Tomorrow, Wednesday 21 October 2026, at 14:00 UTC, two critical updates arrive at once: one for PHP itself, one for the YOOtheme Pro 5 Joomla template. Neither fix exists yet, so tonight is about preparation, not patching.

First, PHP. The PHP security team has given advance notice of a release fixing two critical security issues, both rated 9.2 on CVSS v4.0. This is the PHP underneath every WordPress and Joomla site you manage, so there is no scoping it to one CMS: it is the whole stack. The supported branches, PHP 8.2 through 8.5, will get the fix. Anything on 8.1 or older will not, because those are past end of life. On most sites it is your host, not you, who controls the PHP version, so tonight is about knowing what each site runs and whether your host is one that will actually apply this.

Second, YOOtheme Pro 5. YOOtheme has told customers a critical update is due at 16:00 CEST, which is 14:00 UTC, the same hour. Every site running Pro 5 must update the moment it is out. Pro 4 and earlier are not affected. Tonight, confirm which of your Joomla sites run Pro 5, take a fresh backup of each, and line them up. If they are connected to mySites.guru, the detection rule I added today has already flagged them for you.

Further down: two new posts from the blog, and a thank you for a trophy I did not expect.

Critical

PHP: two critical issues, one release, 14:00 UTC tomorrow

The PHP security team has announced a security release for Wednesday 21 October at 14:00 UTC, fixing two critical vulnerabilities both rated CVSS v4.0 9.2. The catch is who applies it. PHP 8.2, 8.3, 8.4 and 8.5 get the fix; anything on PHP 8.1 or older gets nothing, because those versions are past end of life. On most Joomla and WordPress sites your host controls the PHP version, so a fix being available is not the same as a fix being applied. How long will your host take to actually upgrade? Some move within hours of a release, some take weeks, and a few never move you off end-of-life PHP at all. My write-up walks through how to check what each of your sites runs and whether the host behind it is one that moves.

Critical

YOOtheme Pro 5: every Pro 5 site, the same hour

YOOtheme has given a day's notice that a critical security update for YOOtheme Pro 5 is due at 16:00 CEST (14:00 UTC) tomorrow, and that every site on Pro 5 needs it the moment it appears, while Pro 4 and earlier need nothing. The flaw was reported to YOOtheme by a third party, no technical details are public, and I will not speculate about an unpatched critical issue. What I have done is add a detection rule to mySites.guru, so every connected Joomla site on Pro 5 is flagged on its next snapshot and your update list is built before the fix exists.

Two more from the blog this week

Favourite Tool for Your Joomla Workflow, chosen by you

At the Joomla World Conference in Potsdam on 16 October, mySites.guru won Favourite Tool for Your Joomla Workflow at the J!Awards 2026, the Joomla project's first community choice awards: no jury, just the community nominating the finalists and 731 people voting. It is our fifth Joomla award, after four J!OSCARs between 2013 and 2017, and the first decided by all of you rather than a room of judges, which makes it the one I am proudest of. Thank you.

Need help with your site? Phil Taylor – Fixing websites since 2004

Found something wrong with your Joomla or WordPress site? If it were simple, you'd have fixed it already. I offer same-day expert help at a flat rate of £120 per incident. No hourly billing surprises.

If I can't add value, you don't pay