Quick answer: Since 13 October 2026, Joomla 5.4 has received security fixes only. Those security fixes continue until 12 October 2027, which is the end of life for Joomla 5. Joomla 6 is supported with bug fixes until 17 October 2028 and security fixes until 16 October 2029. Joomla 6 needs PHP 8.3 or newer, and you can only upgrade to it from Joomla 5.4. For most Australian sites, the sensible plan is to move to Joomla 6 in the next six months, and to lift PHP to 8.3 first, because PHP 8.2 loses security support on 31 December 2026.
What changed for Joomla 5 on 13 October 2026?
Joomla follows a fixed support pattern. The fourth minor release of each major version, known as the x.4 release, is the “bridge” release. After that release, the Joomla Project provides bug fixes for one year and security fixes for a further year. Joomla 5.4.0 was released on 14 October 2025, so the bug-fix year ended on 13 October 2026.
The Joomla Project confirmed both dates in its release announcement for Joomla 5.4.9 and 6.1.4 on 29 September 2026. In practice, this means:
- Joomla 5.4 will still receive 5.4.x releases, but only when there is a security problem to fix.
- General bugs, regressions and compatibility problems found after 13 October will usually be fixed in Joomla 6 only.
- Joomla 5.4 is the last Joomla 5 minor release, so 12 October 2027 is the end of life for Joomla 5 as a whole. Earlier minor releases (5.0 to 5.3) are already unsupported.
Your site will not stop working on any of these dates. The risk builds quietly. After end of life, every new vulnerability found in Joomla stays open on your site, and attackers can study the fixes released for newer versions.
What are the key Joomla and PHP support dates?
| Software | Status | Key date |
|---|---|---|
| Joomla 3 | End of life | 17 August 2023 |
| Joomla 4.4 | End of life | 14 October 2025 |
| Joomla 5.4 | Security fixes only | Bug fixes ended 13 October 2026; security ends 12 October 2027 |
| Joomla 6 | Fully supported | Bug fixes to 17 October 2028; security to 16 October 2029 |
| Joomla 7 | Not yet released | Joomla’s release policy points to October 2027 |
| PHP 8.1 | End of life | Ended 31 December 2025 |
| PHP 8.2 | Security fixes only | Ends 31 December 2026 |
| PHP 8.3 | Security fixes only | Ends 31 December 2027 |
| PHP 8.4 | Active support | Security to 31 December 2028 |
| PHP 8.5 | Active support | Security to 31 December 2029 |
The PHP rows matter as much as the Joomla rows. Many Joomla 5.4 sites run on PHP 8.2 or older, and for those sites the first deadline is the end of this year.
Is Joomla 5 still safe to use?
Yes, for now, provided you keep applying every 5.4.x release and run a supported PHP version. A patched Joomla 5.4 on PHP 8.3 or newer is a reasonable place to be today. The danger is drifting. Sites that miss a patch, run an old PHP version, or depend on abandoned extensions become the easy targets.
There is also no safety net after October 2027. Joomla offered a paid extended support programme for Joomla 3, which ended in February 2025. Nothing equivalent was offered for Joomla 4, and nothing has been announced for Joomla 5. Joomla 4 and Joomla 3 sites are a useful warning: many organisations kept running them long after support ended, because nothing visibly broke on the day.
Why does the PHP deadline come first?
Joomla 5.4 runs on PHP 8.1 and newer. That means a site can look healthy inside Joomla while sitting on a PHP version that no longer gets security fixes. A fully patched Joomla core does not protect you from a flaw in an unsupported PHP runtime.
The practical order of work is:
- Move to PHP 8.3 now. It is supported until 31 December 2027, which outlasts Joomla 5, and it is the minimum for Joomla 6.
- Then upgrade Joomla. Doing the PHP change and the Joomla change months apart means that if something breaks, you know which change caused it.
We cover the wider PHP picture in our guide to unsupported PHP and the Privacy Act.
What does Joomla 6 require?
Joomla 6 raises the minimum platform versions:
| Requirement | Joomla 6 minimum |
|---|---|
| PHP | 8.3.0 or newer (8.4 recommended) |
| MySQL | 8.0.13 or newer |
| MariaDB | 10.4 or newer |
If your server does not meet these, the Joomla 6 upgrade option will not even appear in the Joomla updater. Check with your host first. Most Australian hosts offer PHP 8.3 and 8.4, but older shared plans and legacy dedicated servers may need to be moved.
Can I upgrade straight to Joomla 6 from any version?
No. Joomla 6 can only be reached from Joomla 5.4. If your site is on Joomla 3, Joomla 4 or an older Joomla 5.x release, it must first reach Joomla 5.4 before moving on.
- On Joomla 5.0 to 5.3: update to 5.4 now. These versions are already unsupported.
- On Joomla 4.4: security support ended in October 2025. Plan a move to Joomla 5.4 and then Joomla 6, ideally within one project.
- On Joomla 3: the site has been out of support since 2023. Treat it as a migration project, not a simple update. Extensions and templates often need replacing.
Why not wait until October 2027?
The security date is the last possible day, not the planning date. There are four good reasons to move sooner.
- Extension vendors move first. Third-party extension developers often drop support for an older Joomla version before the core project does. When a vendor stops shipping Joomla 5 builds, your extension stops getting fixes, whatever Joomla’s own dates say.
- October 2027 will be crowded. Joomla’s release policy places a new major version in October of odd-numbered years, so Joomla 7 is expected around the same time Joomla 5 support ends. Developers and extension vendors will be busy, and the queue for upgrade help will be long.
- New features only land in Joomla 6. Joomla 5.4 was a bridge release, so improvements go to the newer branch. Clients notice a missing feature long before they notice a support date.
- Moving now buys two more years. A site that upgrades today is supported until October 2029, which is two years longer than one that stays on Joomla 5.
How do I upgrade from Joomla 5.4 to Joomla 6?
For a site with well-maintained extensions, this is closer to an upgrade than a migration. The sequence below causes the fewest surprises.
- Back up everything. Take a full backup of files and database, and confirm you can restore it.
- Update to the latest Joomla 5.4.x release. The Joomla 6 upgrade is only offered from 5.4.
- Upgrade PHP to 8.3 or newer on a staging copy. Test the site. Check the database version at the same time.
- Audit your extensions and template. For each one, confirm there is a Joomla 6 compatible release. Update where the vendor offers one package for both versions, and plan replacements for anything abandoned.
- Handle the compatibility plugins. Disable the old “Behaviour – Backward Compatibility” plugin (the Joomla 4 to 5 one) before upgrading, and keep “Behaviour – Backward Compatibility 6” enabled until all your extensions run without it.
- Run the Pre-Update Check. In Joomla’s update options, switch the update channel to Joomla Next and work through the required and recommended settings in the Pre-Update Check.
- Upgrade the staging site first. Test forms, logins, search, payments, multilingual content and any custom code. Fix issues before touching production.
- Upgrade production, then reset the update channel. Set the channel back to Default. Leaving it on Joomla Next is how a site ends up on the next major version by accident.
- Plan to remove the Backward Compatibility 6 plugin. Any extension that still depends on it will break on the way to Joomla 7, so find those extensions now.
Joomla’s automated core updates handle patch and minor updates, but they never move a site across a major version. The jump from 5.4 to 6 is always a deliberate, manual upgrade.
What are the most common problems?
- Abandoned extensions. The most common blocker. If the developer has not released a Joomla 6 version, you need a replacement or custom work.
- Custom templates and overrides. Heavily customised templates often contain code that relies on older Joomla APIs and needs updating.
- Hosting limits. Some hosts do not offer PHP 8.3 or the required database version on older plans.
- Skipped patches. Sites that are several releases behind on 5.4 should be brought fully up to date before attempting the major upgrade.
- Insufficient testing. Forms, payment gateways and integrations with CRMs or booking systems are where problems usually appear.
Is there an Australian compliance angle?
Yes. If your Joomla site collects or holds personal information, such as enquiry form submissions, customer accounts or membership records, then Australian Privacy Principle 11 requires you to take reasonable steps to protect that information. The OAIC states that reasonable steps include technical measures. Unsupported software is hard to defend as a reasonable step after a breach.
The Australian Signals Directorate’s Essential Eight maturity model also expects unsupported online services to be removed, and applies short patching timeframes to internet-facing software. The Essential Eight is guidance for most private businesses, but government agencies and many enterprise customers expect alignment with it. Penalties under the Privacy Act for serious interferences can reach the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover.
This is general information, not legal advice. If you are unsure about your obligations, speak to a privacy lawyer.
Timing also matters locally. Many Australian organisations enter a change freeze in mid-December. If you leave the PHP 8.2 deadline until the last week of December, you may not be able to deploy anything until the new year.
How long does a Joomla 6 upgrade take?
It depends on the number of extensions, the complexity of the template, and how far behind the site is. A simple brochure site with a handful of up-to-date extensions can often be upgraded in a few days, including testing. A large site with many extensions, custom components and integrations may need a structured project over several weeks. The best way to get a realistic estimate is to audit your extensions and template for Joomla 6 compatibility first, which turns an unknown into a concrete list.
How can Joomla Professionals help?
We are an Australian Joomla development team that helps businesses upgrade, secure and maintain their Joomla sites. For a Joomla 5 to Joomla 6 project we typically provide:
- A readiness audit covering Joomla version, PHP, database, extensions and template.
- Staging builds so the upgrade is fully tested before it reaches your live site.
- PHP and hosting upgrade planning.
- Replacement or custom development for extensions that have no Joomla 6 version.
- Ongoing maintenance and security patching, so you do not fall behind again.
If you are not sure which Joomla version you run, contact us for a short assessment.
Frequently asked questions
When does Joomla 5 reach end of life?
Joomla 5 reaches end of life on 12 October 2027. Joomla 5.4 received bug fixes until 13 October 2026 and now receives security fixes only until that date.
Is Joomla 5 still supported?
Yes, but only for security fixes. Joomla 5.4 is supported with security releases until 12 October 2027. Earlier Joomla 5 minor releases (5.0 to 5.3) are no longer supported.
What PHP version does Joomla 6 need?
Joomla 6 requires PHP 8.3.0 or newer, with PHP 8.4 recommended. Joomla 5.4 still runs on PHP 8.1 and up, but PHP 8.1 is end of life and PHP 8.2 loses security support on 31 December 2026.
Can I upgrade from Joomla 4 or Joomla 3 directly to Joomla 6?
No. You can only upgrade to Joomla 6 from Joomla 5.4. Joomla 4 sites need to reach 5.4 first, and Joomla 3 sites usually need a migration project because extensions and templates often need replacing.
Will Joomla automatically update my site to Joomla 6?
No. Joomla’s automated core updates apply patch and minor updates but do not move a site across a major version. The upgrade to Joomla 6 is a manual process through the Joomla Next update channel.
How long is Joomla 6 supported?
Joomla 6 receives bug fixes until 17 October 2028 and security fixes until 16 October 2029, according to the Joomla developer roadmap.
The bottom line
Joomla 5 is not broken, but its safety margin is shrinking. Bug fixes ended on 13 October 2026, PHP 8.2 support ends on 31 December 2026, and Joomla 5 itself ends on 12 October 2027. The best plan for most Australian sites is simple: move to PHP 8.3 now, audit your extensions, then upgrade to Joomla 6 on a staging copy before touching production. A planned upgrade in the next six months costs far less than an emergency one in late 2027.
Sources and further reading
- Joomla Project, Joomla 6.1.4 and 5.4.9 Security and Bugfix Release: https://www.joomla.org/announcements/release-news/joomla-6-1-4-5-4-9-security-bugfix-release.html
- Joomla developer roadmap: https://developer.joomla.org/roadmap.html
- Joomla software release cycle: https://manual.joomla.org/docs/development-strategy/software-release-cycle/
- Joomla, Joomla 5 to 6 planning and upgrade, step by step: https://guide.joomla.org/user-manual/migration/joomla-5-to-6-planning-and-upgrade-step-by-step
- PHP project, Supported versions: https://www.php.net/supported-versions.php
- mySites.guru, Joomla 5.4 Is Security-Only Since 13 October 2026: https://mysites.guru/blog/joomla-5-4-end-of-support-dates/
- endoflife.ai, Joomla 5 and Joomla 6 end-of-life dates: https://endoflife.ai/article-joomla-5-eol
- OAIC, APP Guidelines Chapter 11: Security of personal information: https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information
- ASD, Essential Eight: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight