BriefingAdvisoryCybersecurityIT

Joomla 4 sites are past their announced October 14, 2025 security end date: upgrade through 5.4 to Joomla 6

The Joomla Project said Joomla 4 would get no new features and security updates only until October 14, 2025. On that date it released Joomla 6.0 alongside Joomla 5.4, a bridge release for upgrading Joomla 5 sites, and it points sites still on 4.x to its 4.4 to 5.x upgrade guide.

Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.
DSE visual intelligenceCyber defenseBriefing · 2 min read
Executive summary

What you need to know

The Joomla Project said Joomla 4 would get no new features and security updates only until October 14, 2025. On that date it released Joomla 6.0 alongside Joomla 5.4, a bridge release for upgrading Joomla 5 sites, and it points sites still on 4.x to its 4.4 to 5.x upgrade guide.

Potentially affected

Organizations with websites, intranets or portals built on Joomla 4, and the agencies and hosting providers that maintain them.

DSE recommendation

DSE recommends moving every Joomla 4 site to a supported Joomla release, upgrading through 5.4 and then to 6, after testing on a copy of the site.

The Joomla Project said Joomla 4 would get no new features and security updates only until October 14, 2025. On that date it released Joomla 6.0 alongside Joomla 5.4, a bridge release for upgrading Joomla 5 sites, and it points sites still on 4.x to its 4.4 to 5.x upgrade guide.

Source facts

In its Joomla 5.2.4 and 4.4.11 release announcement, created February 18, 2025, the Joomla Project said no new features would be added to Joomla 4 and that it would receive security updates only until October 14, 2025; that release fixed an SQL injection flaw in the Scheduled Tasks component. It said moving from 4.4 to 5.x is an upgrade, not a migration, that extensions free of deprecated code work in Joomla 5 and most others work with the Backward Compatibility plugin enabled, and advised testing the upgrade on a copy of the production site first.

The Joomla 6.0 and 5.4 announcement, created October 14, 2025, introduced automatic Joomla core updates in 5.4 and 6.0, building on the TUF-secured updates added in Joomla 5.1. It describes Joomla 5.4.0 as a bridge release for upgrading Joomla 5 sites to 6.0, says moving from 5.4 to 6.0 is an upgrade rather than a migration, and directs sites still on Joomla 4.x to the 4.4.x to 5.x upgrade guide.

Applicability

Use this for any website or intranet built on Joomla. Check each extension and template for Joomla 5 and 6 compatibility before upgrading, since unsupported extensions can block or break the upgrade.

DSE recommendation

DSE recommends moving every Joomla 4 site to a supported Joomla release, upgrading through 5.4 and then to 6, after testing on a copy of the site. Back up files and the database first, check extensions in the Joomla Extensions Directory, treat the backward compatibility plugin as a temporary bridge, and turn on automatic core updates once the site is current.

Verification

Confirm each site’s Joomla version in the administrator panel, review its update settings, and keep a dated backup from before each upgrade.

Official references

Joomla! — Joomla 5.2.4 Security & Bugfix Release (and Joomla 4.4.11). Joomla! — Joomla 6.0 and Joomla 5.4 are here!. Reviewed October 19, 2026.

Primary reference

Review the official source

Joomla! — Joomla 5.2.4 Security & Bugfix Release (and Joomla 4.4.11) · Verified October 19, 2026

Open official reference ↗
Plan the next step

Need help applying this guidance safely?

DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.

Talk with DSE