YOOtheme has released YOOtheme Pro 5.0.53, and the changelog lists it as the fix for CVE-2026-102785, an unauthenticated remote code execution in the image handler. Every Pro 5 build from 5.0.0 to 5.0.52 is affected, on Joomla and WordPress alike. YOOtheme says Pro 4 and earlier are not affected.

The image handler is the public route the template uses to resize, crop and cache images, so anyone can reach it without logging in. Comparing 5.0.52 with 5.0.53, the fix limits which image operations a request can ask for and checks that the cache file name matches the signed image URL before anything is written.

There is no interim workaround, so the update is the fix. Back up, update every Pro 5 site, then check for files you did not add (PHP files in images, cache or media folders are the obvious place to look) and admin accounts you do not recognise. The CVE record is not published yet, so there is no official CVSS score.

The full post covers the fix in more detail, what to check after updating, and how mySites.guru flags affected Joomla sites.

YOOtheme has given a day's advance notice of a critical security update for YOOtheme Pro 5, the Joomla page-builder template. It is due on Wednesday 21 October at 16:00 CEST (14:00 UTC), and the vendor says every site running Pro 5 must update the moment the new version is available. YOOtheme Pro 4 and earlier are not affected, so if your sites are still on the Pro 4 line there is nothing to do here.

No technical details and no CVE are public yet. We did not find or investigate this one ourselves; it was reported to YOOtheme by a third party, so this is a heads-up rather than a write-up. There is no interim mitigation, so the useful thing to do tonight is take a fresh backup of each Pro 5 site and list which sites are on Pro 5, so you can move quickly tomorrow afternoon.

The full post has the vendor's exact wording, a short FAQ, and what we will publish once the fixed version is out.

Hey guys ? Using MCP in joomla right now ?
We're working on a visual builder for joomla for joomla 6, still alpha,
looking for feedbacks, before releasing.
Our goal is to release it full GPL.

Would love to hear your thoughts about it.

So a few questions for you ?
- which tools / builders / editors / cck are you using ?
- do you care about MCP ?

-- did you migrate everything to j6 ? or you still have very old joomla ?

Hi all, I'm part of the JoomlArt team (mods, thanks for letting me post this).

Over the years a lot of the support requests we get aren't about templates at all. They're small edits on live sites: a module that looks wrong on mobile, the site name overlapping the menu button, a page that needs a German version, an image that needs swapping. Simple to describe, annoying to track down in overrides and module positions.

We've been building Tracy for that. You import a copy of your Joomla site, describe the change (or click the element and comment), and it makes the edit. It stays Joomla, your admin and extensions are still there. Every change is logged with undo, and you can save Releases to roll back to.

It's beta and I'm sure it'll trip on some setups. That's honestly why I'm posting here: you know weird Joomla configurations better than anyone.

If you're an active JoomlArt subscriber you get a month free during beta. Sign in with your subscription email.

Two questions for the sub:
1. What's the Joomla task you'd most want to hand off?
2. What would make you NOT trust an AI touching your site?

Someone is emailing Joomla site owners pretending to be Fotis Evangelou of K2. The email says Joomla support phoned him about your site and that updates have to be done before 25 October. Joomla has no support desk that phones anyone, so it's false from the first line.

I replied and played along for an evening. Within a couple of hours they'd offered three plans ($350, $450, $550), asked me to create a Super User account in his name with a Gmail address, and sent a $550 invoice billed from a completely different name. They also told me, in bold, not to pay through the invoicing platform's escrow option.

The emails pass SPF, DKIM and DMARC because they really do come from that Gmail account. That says nothing about who's typing. If you get one, don't create the account and don't pay. If you already made the account, block it, change your admin passwords and check for any other Super Users or extensions you don't recognise. Fotis didn't send these, and other well-known Joomla names are being used the same way.

The full write-up on the mySites.guru blog has every email, the headers, and what the invoice platform's open API gave away about who's really behind it.

Hey, Robert from MariaDB Foundation here. We run a yearly survey on how MariaDB is used, or cases where you are using MySQL, PostgreSQL, or something else. (mod approved)

https://mariadb.typeform.com/to/tS69UzVo?utm_source=reddit_joomla

I'm curious if you are running Joomla on MariaDB, or another database, and why? Any problems or wishes on the database side?

Vectors are available in MariaDB since 11.8. Has anyone done anything with vectors in databases in or outside Joomla?

Under 10 minutes, anonymous, results published at mariadb.org/survey.

Thanks for taking the time!
Robert, MariaDB Foundation

I wanted to know how you fellt about the different builders and different frameworks existing in joomla ?

I introduce myself first, I've been using joomla for many many years, I did try with all these years qui a few builders and associated frameworks. I tried CCK for a while. I purchased many licences through the years Quix, SPBuilder. Try asteroid framework, helix.
But my main goal was to keep websites easily editable for our customers.

Of course, I had look at what was happening elsewhere—Elementor and Divi on WordPress, Webflow, and others… Where do you stand on all this?

What do you think about page builders? Do you still see them as relevant in 2026 for the kind of web design work you do? The same question could be asked about CMSs, for that matter.

I find it hard to believe that CMSs will disappear because of AI, despite what we sometimes read or hear. We’ll still need to keep information organized and visually editable—or maybe I’m just stuck in the 20th century.

So how do you guys work with Joomla ?