Joomla 5 End of Life: Bug Fixes Stop October 13, 2026
Joomla 5 stops receiving regular bug fixes on October 13, 2026. From then it gets security fixes only, and those end on October 12, 2027, which is its end of life. Both dates are from the Joomla project roadmap, which already describes 5.x as in bugfix mode only, with no new features. Joomla 6 is the current series and the one to move to.
Joomla versions and their dates
| Series | End of regular bug fixes | End of security fixes (end of life) | Status |
|---|---|---|---|
| Joomla 6 | October 17, 2028 | October 16, 2029 | Supported |
| Joomla 5 | October 13, 2026 | October 12, 2027 | Supported |
| Joomla 4 | October 15, 2024 | October 14, 2025 | EOL |
| Joomla 3 | August 17, 2021 | August 17, 2023 | EOL |
The pattern is steady: a new major series every two years, each one getting roughly three years of bug fixes and a final year of security fixes only. The last minor release of a series is the one that carries it to the end, which for Joomla 5 is 5.4.
Why the security date matters for Joomla
Joomla is on CISA's Known Exploited Vulnerabilities list. The core entry is CVE-2023-23752, an improper access check in the web service endpoints. Joomla's own advisory gives the affected versions as 4.0.0 to 4.2.7 and the fix as 4.2.8, so every later 4.x release and all of 5.x and 6.x have it fixed. Two further entries, added in mid 2026, are for third-party Joomla extensions and not the core: a page builder and a content editor.
Two lessons follow. First, a Joomla site past its security date has no route to a fix when the next core flaw of that kind is found; Joomla 3 and 4 sites are already there. Second, on Joomla the extensions are as much of the attack surface as the core. An extension abandoned by its developer is end-of-life software inside a supported site, and no core update will fix it.
What to do
- On Joomla 3 or 4: past end of life, with no fixes of any kind from the project. Move now. The route from 3 runs through 4 and then 5; do not expect a single jump.
- On Joomla 5: get onto the final 5.4 release if you are not there, then plan the move to 6 during the security-only year, not at the end of it.
- Inventory extensions and the template first. For each one, check the developer has shipped a Joomla 6 release. The ones that have not are the real schedule. Replace abandoned extensions whatever version you stay on.
- Check the platform underneath. Each Joomla series raises its minimum PHP and database versions. Confirm your hosting meets the Joomla 6 requirements before the upgrade, and that your current PHP version is itself still supported: see PHP.
Frequently Asked Questions
When is Joomla 5 end of life?
Joomla's roadmap gives two dates for the 5.x series. Regular bug fix support ends on October 13, 2026. After that Joomla 5 receives security fixes only, and those end on October 12, 2027, which is its end of life.
Is Joomla 5 still supported?
Yes. Joomla 5 receives bug fixes until October 13, 2026 and security fixes until October 12, 2027. Joomla's roadmap already describes 5.x as in bugfix mode only, with no new features.
Is Joomla 4 still supported?
No. Joomla 4 reached the end of its security support on October 14, 2025 and no longer receives fixes of any kind from the Joomla project.
Should I upgrade from Joomla 5 to Joomla 6 now?
Plan it now. Joomla 5 stays secure until October 12, 2027, so there is no emergency, but from October 13, 2026 only security issues are fixed in it. The usual blocker is extensions and templates: check that each one has a Joomla 6 release before scheduling the upgrade.
Related
- Joomla — every series, live status and EOL Risk Score
- Drupal 7 end of life
- PHP end of life
- Exploited and Unpatchable