So Outside Technology Security CMS
AnQiCMS
Online Demonstration

How to arrange the upgrade plan for websites still using Joomla after the five branches stop issuing regular repair announcements.

📅 October 26, 2026 👁️ 1

Joomla official release records recently showed that there were five branches of regular fix versions: 5.4.8, 5.4.9, 5.4.10, 6.1.3, 6.1.4, and Joomla 6.2 was released on October 13, 2026.The most critical sentence in the announcement is: Joomla 5.4.10 is the last bugfix version in the Joomla 5.x series.That is to say, after 5.x, it's no longer just regular fixes, and the patching on the functional level has also stopped. For sites still using 5.x, it's not just about waiting for the next patch, but about a cross-series upgrade plan.

Two signals in the announcement

The first signal is the closure of the version support cycle. Routine fixes (bugfix) and security fixes (security) are two separate things within the maintenance cycle: discontinuing routine fixes does not mean the site is immediately in danger, sites after 5.4.10 may still receive security fixes, but corrections for functional defects and compatibility issues will no longer be released with versions, and the risk exposure will gradually expand with time and changes in external components.

The second signal is the release of 6.2 on the same day. On the same day, there were both the final version of the old series and the official version of the new series, which is a typical migration guide: The official hopes that sites still on the old series will point the upgrade path to the new version, rather than staying in the old branch for a long time.

The reading for the site owner is: When reading the announcement, you can't just look at 'whether there is a new version', but also see if the branch you are on is still on the regular repair list, as well as where the next similar announcement will fall.

How does the risk change after regular repairs stop?

Stage The corrections still received Risk performance The action to be taken
The branch is still in the regular repair period Feature correction and security repair Mainly for individual functional defects Upgrade small version at a regular pace
Routine fixes have stopped (such as 5.x after 5.4.10) Mainly for security fixes Compatibility issues, template and extension adaptation lag Plan cross-series upgrades
Branch support exit None Security vulnerabilities are uncontrollable Migrate or upgrade immediately

This line in the middle is the most easily ignored: The site looks 'normal,' but the problems all have to be bypassed at the application layer. The longer it takes, the higher the bypass cost, and it often ends up with a major overhaul.

Three steps to arrange the upgrade plan

The first step is to inventory. List the currently running branches and versions, templates, extensions, and custom code, marking whether each item has a new version available and whether a higher runtime environment is required. The purpose of inventory is to know what will be changed along with the upgrade, not just what the current version is.

The second step is to test the upgrade. Go through the target version in the test environment and verify the following sequence: whether the data can be migrated, whether the template and page display are consistent, whether the form and login-like functions are normal, and whether the address rules related to SEO (pseudo-static, redirection, site map) are still effective. Especially for cross-series upgrades, it is particularly important to confirm the mapping of old data fields to the new version content structure.

The third step is to define the window. Write the upgrade date and rollback points into the plan: Make a complete backup before the upgrade (including data and static files), confirm that the backup is recoverable rather than just generating a file; Choose off-peak hours, leave time for verification and rollback; Immediately check the list page, detail page, and backend login after the upgrade.

What to look at in the update records.

The upgrade decision depends on the quality of the update records. Good update records should clearly state what was fixed in each version, which capabilities were affected, and whether to provide upgrade recommendations. AnQiCMS lists the fixed items and upgrade recommendations by version, for example, v3.6.6 (2026-10-08) fixed two high-risk issues of list sorting parameter injection and the login credentials of site switching being forgeable, and the upgrade recommendations require rotating the site signature key and changing the administrator password;v3.6.5 (2026-10-07) focuses on rebuilding and adding capabilities in the MCP tool layer. When reading such records, prioritize three things: whether there are security fixes, whether the scope of impact is explained, and whether an upgrade action is provided. Records with only the new feature list are of limited help in decision-making.

The deployment method also affects the upgrade cost: AnQiCMS supports Docker images and deployment methods such as Baota Panel, aaPanel, etc., and defaults to listening on port 8001. The site deployed in containerized form can be rolled back faster because it is as simple as switching back to the old image, but it still needs to be confirmed separately that the rollback of data and uploaded files is consistent.

Common questions

Can 5.x sites still run securely?They can still run in the short term, but it needs to be confirmed whether the security fixes continue to cover the branch being used, and cross-series upgrades should be scheduled. Do not stop indefinitely on branches that have stopped routine repairs.

What should be prepared most before the upgrade?A backup that is available rather than just existing: both data and static files are backed up and verified for recovery. An additional test environment drill record is added for cross-series upgrades.

Can you skip the intermediate versions and upgrade directly to the latest?It depends on the official supported upgrade path. Confirm the target version's required runtime environment and database version when counting, and decide after going through the actual path during a trial upgrade.

Related articles

Can the content built by the page builder be exported completely, and which one should be checked before switching to the new system?

The content built by the page builder usually cannot be exported completely: blog article data has an export channel, the layout and components generated by the builder often need to be rebuilt in a new system, and most of the migration from platforms like Weebly relies on manual work. Before switching systems, one should first check whether the data layer can be exported structurally; then, consider the cost of reconstructing the structural layer and whether the link layer can use 301 redirects and replace the entire site to handle old addresses.

2026-10-26

llms.txt is called the sitemap of the AI era, how does it divide labor with the robots rules

llms.txt and the robots rule are not the same level of things: llms.txt is the content structure and summary entry for large language models, placed in the root directory or any path according to the proposal in Markdown; the robots rule declares the crawling boundary and the sitemap submits link lists. The three complement each other rather than replace each other, and interpreting llms.txt as a shutdown switch is a misreading.

2026-10-26

AI abstracts let the click-through rate of the top results drop by more than half, what indicator should the content site switch to?

On the query coverage of AI abstracts, the click-through rate metric has already been distorted: Ahrefs' research on 300,000 keywords shows that the average click-through rate with AI abstracts is low by 58%, and the click-through rate of the top results in the sample from December 2025 has dropped to 0.016. Content sites should change the main indicator from click-through rate to three items: the situation of brand words and paragraph citations, the quality of arrival on answer pages, and the indexable feedback brought by llms.txt and push channels.

2026-10-26

The cleanup of the garbage update will take two weeks, should the content team stop releasing during the update window?

The content team in the update window does not need to stop posting regular content. Taking Google's September garbage update as an example, it began on September 24, 2026, and ended on October 8, with a two-week rolling cycle on the system side, not a site exception. The delay is for template revision and structural changes, regular articles are still published but classified according to risk levels, and reviews are kept before going live with scheduled publishing and draft, pending publishing status.

2026-10-26

How should operations use these few days to buffer the advance notice of security updates?

When a security announcement is released ahead of schedule, this buffer time should not be used to wait for the announcement. Taking the Drupal core security release preview as an example, the announcement was issued on October 12th, and the fix was released from 16:00 to 21:00 UTC on October 14th, with the highest risk rating being critical. The correct use of the buffer period is to first make recoverable backups and rollback points, clarify the list of affected branches, and then compare update records and arrange for upgrades at the designated time.

2026-10-26

The patched version was publicly exploited the day after release, which door should the official website close on patch day?

The release of the fixed version and the public exploitation of the code often only takes a day. WordPress' two unauthenticated SQL injection vulnerabilities, CVE-2026-63030 and CVE-2026-60137, were released with a fix on July 17, 2026, and the next morning, the publicly verified code began to circulate. The official website that had not applied the patch first closed the writable and query entry points that could be remotely triggered, and then arranged for upgrades and backup verification.

2026-10-26

Comparison of mainstream website building platforms in 2026: How to choose WordPress, Wix, Squarespace

The price and positioning of mainstream website building platforms in 2026: WordPress itself is free software, with costs in hosting and plugins; Wix is about $17 per month, suitable for beginners; Squarespace is about $19 per month, excels in exquisite design; Webflow's basic plan is about $15 per month, aimed at professional visual development. The choice depends on the type of business and skill level, and in addition to the budget, maintenance costs and subsequent migration costs should also be considered.

2026-10-26

Warning of large-scale CMS exploitation activities: New threats to website content management systems in 2026

In July 2026, the Australian Signals Directorate's Cyber Security Centre issued an alert, indicating a large-scale exploitation activity targeting website content management systems, involving platforms such as WordPress and Joomla. Attackers scan sites for opportunities to plant webshells. Protective measures focus on four points: patching in time, assessing the applicability of automatic patches, recovering from trusted backups, and keeping capabilities within the system to reduce external exposure.

2026-10-26