Joomla 5.4 Gets Security Fixes Only From 13 October 2026

Joomla 5.4 stops getting bug fixes on 13 October 2026 and stops getting security fixes on 12 October 2027. The Joomla Project restated both dates in its 5.4.9 and 6.1.4 release announcement on 29 September: “We’ll support Joomla 5.4.x until 13 October 2026 with bugfix patches and until 12 October 2027 with security patches.” The same dates are on the Joomla developer roadmap.

5.4 is the last Joomla 5 minor release, so 12 October 2027 is the end of life for Joomla 5 as a whole. In the mySites.guru database, Joomla 5.4 is the most common Joomla version of all, ahead of Joomla 6.1 and Joomla 3.10. This post covers what changes on each date, what our data shows about the sites affected, and the deadline that most 5.4 sites will hit before either Joomla date: their PHP version.

What changes for Joomla 5.4 sites on 13 October 2026?

From 13 October 2026, Joomla 5.4 moves to security fixes only. Joomla will keep publishing 5.4.x patch releases until 12 October 2027, but only when there is a security issue to fix. General bugs, regressions and most compatibility problems found after that date get fixed in Joomla 6 and nowhere else. Joomla 5.4.10 is scheduled for 13 October itself, the same day as Joomla 6.2.0, and is very likely the last 5.4 release with general bug fixes in it. We fully expect it to be a security release too, so plan to apply it across your 5.4 sites on the day it ships.

The first practical change is the release rhythm: through the bug fix year, 5.4.x shipped roughly every six weeks, from 5.4.0 on 14 October 2025 to 5.4.9 on 29 September 2026. Joomla 4.4’s security-only year had five releases at irregular intervals (January, February, March, April and September 2025), each one shipped when a security fix was ready. Expect 5.4 to behave the same way.

The second is that a broken release stays broken for longer. Joomla 5.4.9 shipped with a known issue that makes Web Services API edit requests fail with a fatal error, which we covered in the 5.4.9 security release post. That fix goes into 5.4.10, just inside the window. The next regression of that kind, like the 5.4.8 template manager breakage or the 5.4.7 article options bug, may not get a 5.4 fix at all.

The rule is not absolute. Joomla 4.4.11, released during its security-only year, included a fix for namespace map creation on PHP 8.4. But a compatibility fix in a security release is a bonus, and no one should plan a site’s future around one.

Joomla 5.4 is the whole of Joomla 5 now

Joomla ships four minor releases per major version, and the fourth is a “bridge” release. The software release cycle says you can only upgrade to the next major version from the x.4 release, and “after the x.4.0 release date, we are fixing bugs for one year and making security fixes for two years”. 5.4.0 shipped on 14 October 2025, which is where both dates come from.

Only the newest minor release in a series is supported, so Joomla 5.0, 5.1, 5.2 and 5.3 are already unsupported. Of the Joomla 5 sites in the mySites.guru database, 2.9% are still on one of those older minors. They have no security support today and no direct route to Joomla 6, because a site has to reach 5.4 before the Joomla 6 upgrade is offered.

5.4 also exists to make the next step smaller. It backports the Joomla 6 API changes, and it ships the “Behaviour - Backward Compatibility 6” plugin, which does nothing on 5.4 except exist and be enabled, so that extensions relying on it keep working on the day a site moves to Joomla 6. We have written about why that plugin is a crutch rather than a fix.

How many Joomla sites are still on Joomla 5?

Across the Joomla sites connected to mySites.guru that reported in during the week to 3 October 2026, 38.3% run Joomla 5, and nearly all of those (97.1%) are on 5.4. Joomla 6 accounts for 29.4%. Joomla 5 is still the larger group, a year after Joomla 6.0 shipped and ten days before Joomla 5 goes security-only.

The last two figures are what makes the 2027 date worth taking seriously now. Joomla 4.4’s security support ended on 14 October 2025, almost exactly a year ago, and one Joomla site in sixteen in our data is still on it. Joomla 3 has been through the same pattern for three years, and a quarter of the Joomla sites we see still run it. If Joomla 5 follows Joomla 4, a meaningful share of today’s 5.4 sites will still be on 5.4 in October 2027, and some will still be there a year after that.

Most of those sites were kept on an old version because the upgrade was never booked, and it was never booked because nothing visibly broke on the day support ended. End of life is a non-event on the day and a growing liability afterwards: every later Joomla security release publishes a fix for a flaw the old version still has. We made the agency version of that argument in Joomla 3 didn’t fail, your retainer did.

The PHP deadline comes before Joomla’s

Joomla 5.4 supports PHP 8.1 and newer, with 8.3 recommended, per its technical requirements. PHP has its own calendar, published on php.net, and it does not line up with Joomla’s:

More than a quarter (27.3%) of the Joomla 5.4 sites in the mySites.guru database run PHP 8.1 or 8.2. For those sites the real deadline is 31 December 2026, ten months before Joomla 5’s, because that is when PHP 8.2 stops getting security fixes. A Joomla core that is still patched does not help much on a PHP runtime that is not.

The other 72.4% are already on PHP 8.3 or newer and meet the Joomla 6 PHP minimum today. For them the remaining questions are the database version and the extensions. Joomla 6 technical requirements has the full table, and why PHP 8.5.7 can show amber while 8.4.24 shows green explains how mySites.guru grades PHP branches and patch levels.

Why not wait until October 2027 to move to Joomla 6?

Because the security date is the last possible day, not the planning date. Most sites will be pushed off Joomla 5 well before October 2027, whether or not anyone plans for it.

Extension vendors set their own dates, and they tend to come first. J2Commerce has already set the end of life for J2Store 4, which runs on Joomla 4 and 5, at 19 October 2027, and its current line runs on Joomla 6 only, as we covered in the J2Store 3 end of life post. Smaller projects are following: the Proclaim Bible study component has a public issue to drop Joomla 5 support around Joomla 5’s end of life. Once an extension a site depends on stops shipping Joomla 5 builds, its Joomla 5 support date no longer matters.

New Joomla features only go into Joomla 6. 5.4 was a bridge release with no new features of its own, so everything in the Joomla 6.1 release stays on the newer branch. One example with security weight: from 6.1 you can force MFA for Super Users, and that option is not coming back to Joomla 5. Clients notice a missing feature long before they notice a support date.

October 2027 is also going to be a crowded month. Joomla’s release policy puts a new major version in October of every odd-numbered year, so Joomla 7.0 and Joomla 6.4 are due around the same time Joomla 5 support ends. Every agency that left its Joomla 5 sites until the last quarter will be doing the same upgrades, against the same extension vendors’ support queues, at the same time.

Our view, after watching the Joomla 3 and Joomla 4 deadlines pass: move Joomla 5.4 sites to Joomla 6 during the next six months, while 5.4 is still patched and before PHP 8.2 runs out. A site that moves now is supported until 16 October 2029, two more years of security fixes than one that waits. There is no extended support for Joomla 5 to fall back on. Joomla’s paid extended support for Joomla 3 ended in February 2025, nothing equivalent was offered for Joomla 4, and nothing has been announced for Joomla 5.

How mySites.guru tracks Joomla 5.4 sites through the change

Everything below is part of the mySites.guru subscription, and it works the same across five Joomla 5 sites or five hundred.

Which Joomla 5 sites are ready for Joomla 6?

The Joomla 6 Technical Requirements tool lists all your connected Joomla 4, 5 and 6 sites on one screen, with the installed Joomla version, the update channel, the PHP version and the database type and version. Each PHP and database value is colour-coded against Joomla 6’s minimum (PHP 8.3.0, MySQL 8.0.13, MariaDB 10.4) and recommended versions, so the sites needing a PHP or database upgrade before anything else are obvious at a glance. Press c then 6 anywhere in mySites.guru to jump straight to it.

Keeping 5.4 sites on the current patch

The security-only releases still matter, and they only protect sites that install them. In our data, 26.9% of Joomla 5.4 sites are behind the current 5.4.9 release. mySites.guru’s “Joomla CMS Version Must Be Up-to-date” check, one of the Joomla configuration checks, shows any site not on the latest patch for its branch in red, and the bulk upgrade applies 5.4.10 (which we expect to include security fixes), and every 5.4.x security release after it, to all your out-of-date 5.4 sites in one action. If you prefer it hands-off, mySites.guru’s automatic core upgrade settings can be set to patch releases only, which keeps 5.4 sites patched without ever starting a major upgrade.

Joomla’s own automated core updates, a free service run by the Joomla Project, also handle patch and minor releases from 5.4 onwards. The Joomla Project’s 6.1 announcement states they do not move a site across a major version, so they will never take a 5.4 site to Joomla 6 on their own.

The two backward compatibility plugins

The Joomla 5 to 6 upgrade depends on two plugins being in the right state. The old Joomla 4 to 5 plugin, “Behaviour - Backward Compatibility”, must be disabled before the upgrade, and “Behaviour - Backward Compatibility 6” should stay enabled until every extension runs without it. mySites.guru reports the state of both plugins on each connected site as part of its extension checks, so the sites with the old plugin still switched on show up before an upgrade fails.

Checking extension support across every site

The extension inventory records each extension and its version on all your connected sites. Searching for an extension returns the sites it is installed on, which is how you find out, before booking the work, which Joomla 5 sites depend on something with no Joomla 6 release. The audit then flags any installed extension version with a known vulnerability, and that matters more on a branch that is no longer getting general fixes.

How to upgrade Joomla 5.4 to Joomla 6

The Joomla Project calls this an upgrade rather than a migration, and for a site with well-maintained extensions it usually is. Its own step-by-step planning and upgrade guide covers the details. The order that causes the fewest surprises:

1. Update to the latest Joomla 5.4.x and take a full backup. Joomla 6 is only reachable from 5.4.
2. Move PHP to 8.3 or newer while still on 5.4, and test. If the database is below MySQL 8.0.13 or MariaDB 10.4, sort that out at the same time.
3. Check every extension and template for a Joomla 6 release. Update to it while still on 5.4 where the vendor ships one package for both, and plan replacements for anything abandoned.
4. Disable “Behaviour - Backward Compatibility”, the Joomla 4 to 5 plugin. Leave “Behaviour - Backward Compatibility 6” enabled.
5. Switch the update channel to Joomla Next in the Joomla Update options, and work through the Pre-Update Check’s required settings, recommended settings and extension list. If the server is below Joomla 6’s requirements, the upgrade option does not appear at all.
6. Upgrade, test, then set the channel back to Default. Leaving a site on Joomla Next is how it ends up on Joomla 7 by accident, and preventing accidental Joomla version jumps covers the channel settings.

After the upgrade, check whether the site still needs the Backward Compatibility 6 plugin. Every extension that still relies on it will break on the way to Joomla 7, so finding them now is cheaper than finding them in 2027.

For the wider process of running core upgrades across many sites, including staging, backups and rollback, see our guide to managing CMS updates at scale. For a look at your own sites first, run a free audit, or compare the plans if you want the Joomla 6 readiness view across every site you manage.