# Joomla 4 sites are past their announced October 14, 2025 security end date: upgrade through 5.4 to Joomla 6 > The Joomla Project said Joomla 4 would get no new features and security updates only until October 14, 2025. On that date it released Joomla 6.0 alongside Joomla 5.4, a bridge release for upgrading Joomla 5 sites, and it points sites still on 4.x to its 4.4 to 5.x upgrade guide. - Canonical URL: https://update.dsesecurity.com/updates/joomla-4-end-of-security-support-october-2025-upgrade-joomla-5-4-6-0/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-19T00:28:18+00:00 - Modified: 2026-10-19T01:55:08+00:00 - Last reviewed by DSE: 2026-10-19 - Resource type: Briefing - DSE priority: Advisory - Topics: Cybersecurity, IT - Reading time: 2 minutes ## What you need to know The Joomla Project said Joomla 4 would get no new features and security updates only until October 14, 2025. On that date it released Joomla 6.0 alongside Joomla 5.4, a bridge release for upgrading Joomla 5 sites, and it points sites still on 4.x to its 4.4 to 5.x upgrade guide. ## Potentially affected Organizations with websites, intranets or portals built on Joomla 4, and the agencies and hosting providers that maintain them. ## DSE recommendation DSE recommends moving every Joomla 4 site to a supported Joomla release, upgrading through 5.4 and then to 6, after testing on a copy of the site. ## Article The Joomla Project said Joomla 4 would get no new features and security updates only until October 14, 2025. On that date it released Joomla 6.0 alongside Joomla 5.4, a bridge release for upgrading Joomla 5 sites, and it points sites still on 4.x to its 4.4 to 5.x upgrade guide. ## Source facts In its [Joomla 5.2.4 and 4.4.11 release announcement](https://www.joomla.org/announcements/release-news/joomla-5-2-4-security-bugfix-release.html), created February 18, 2025, the Joomla Project said no new features would be added to Joomla 4 and that it would receive security updates only until October 14, 2025; that release fixed an SQL injection flaw in the Scheduled Tasks component. It said moving from 4.4 to 5.x is an upgrade, not a migration, that extensions free of deprecated code work in Joomla 5 and most others work with the Backward Compatibility plugin enabled, and advised testing the upgrade on a copy of the production site first. The [Joomla 6.0 and 5.4 announcement](https://www.joomla.org/announcements/release-news/joomla-6-0-and-joomla-5-4-are-here.html), created October 14, 2025, introduced automatic Joomla core updates in 5.4 and 6.0, building on the TUF-secured updates added in Joomla 5.1. It describes Joomla 5.4.0 as a bridge release for upgrading Joomla 5 sites to 6.0, says moving from 5.4 to 6.0 is an upgrade rather than a migration, and directs sites still on Joomla 4.x to the 4.4.x to 5.x upgrade guide. ## Applicability Use this for any website or intranet built on Joomla. Check each extension and template for Joomla 5 and 6 compatibility before upgrading, since unsupported extensions can block or break the upgrade. ## DSE recommendation DSE recommends moving every Joomla 4 site to a supported Joomla release, upgrading through 5.4 and then to 6, after testing on a copy of the site. Back up files and the database first, check extensions in the Joomla Extensions Directory, treat the backward compatibility plugin as a temporary bridge, and turn on automatic core updates once the site is current. ## Verification Confirm each site’s Joomla version in the administrator panel, review its update settings, and keep a dated backup from before each upgrade. ## Official references [Joomla! — Joomla 5.2.4 Security & Bugfix Release (and Joomla 4.4.11)](https://www.joomla.org/announcements/release-news/joomla-5-2-4-security-bugfix-release.html). [Joomla! — Joomla 6.0 and Joomla 5.4 are here!](https://www.joomla.org/announcements/release-news/joomla-6-0-and-joomla-5-4-are-here.html). Reviewed October 19, 2026. ## Primary reference - Name: Joomla! — Joomla 5.2.4 Security & Bugfix Release (and Joomla 4.4.11) - Authority: www.joomla.org - URL: https://www.joomla.org/announcements/release-news/joomla-5-2-4-security-bugfix-release.html - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Joomla 4 sites are past their announced October 14, 2025 security end date: upgrade through 5.4 to Joomla 6,” DSE Security, https://update.dsesecurity.com/updates/joomla-4-end-of-security-support-october-2025-upgrade-joomla-5-4-6-0/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.