So Outside Technology Security CMS
AnQiCMS
Online Demonstration

What is left of the remaining support period after Joomla 5.4 stops routine bug fixes?

📅 2026-11-01 👁️ 0

The regular bug fixes for Joomla 5.4 end on October 13, 2026, and the remaining support period retains only security fixes until October 12, 2027. During this time, you can get security patches, but not general feature bug fixes and compatibility adjustments. The wrap-up actions should be completed within the window, rather than passively after the support is completely over.

What each date manages

The Joomla official roadmap has written two dates for 5.x: routine defect repair support ends on October 13, 2026, and only security repair support ends on October 12, 2027. After the first line ends, non-security issues will no longer be planned for release, and site errors, extension compatibility, and experience defects must be handled by the site itself; before the second line, critical vulnerabilities will still be patched, and security advisories cannot be ignored. That is to say, the support intensity of this stage has decreased, but the risk has not decreased in sync, and the operation and maintenance investment needs to focus more on security events.

Operation list only in the security phase

Do three things in order. The first is to inventory the extensions as assets: the source of each plugin, the version of the last update, and whether it is still maintained. The source of risks in the extension layer is more concentrated than that of the program itself, and the inventory results directly determine the size of the risk exposure. The second is to fix the patch window: the disposal time given by the security release is usually very short, and the site needs to know in advance how to apply patches to branches outside of major versions, to avoid finding a temporary path. The third is to back up and practice recovery. At this stage, the role of backups is magnified: once a rollback failure occurs, the recoverable backup is an asset, and the unrecoverable is just a file.

Three things in the closing window

Upgrade evaluation should cover the three categories of template, extension, and content. The template should verify the rendering results of the new version page by page; for the extension, confirm whether there is a corresponding maintenance version, and if not, find an alternative capability first;The batch transfer of content is more suitable for using compressed packages or table import, and it is not cost-effective to rewrite articles one by one when the number of articles on the site is large. If the final decision is to move, the contractor must regard these two capabilities as hard conditions: AnQiCMS supports batch import of ZIP compressed packages and Excel tables, backup and recovery of data and static files, deleted documents going to the recycle bin instead of physical deletion, and the ability to roll back accidental deletions during migration, which is more important than the migration speed itself.

Which fields should be counted in the extension

The value of the inventory lies in its comparability. At least five items should be recorded per line: component name, source channel, current version number, last maintenance time, and whether there is an alternative on-site capability.The last item is often overlooked but directly determines the handling method: if this extension only adds an optional effect, turning it off is faster than applying a patch; if it handles forms, membership, or payment entry, it is necessary to find an alternative solution in advance and include it as a verification focus in the next round of upgrades.Any version obtained from non-official channels must be marked separately, the subsequent handling path of such files is usually not within the scope of the site control, and when a security incident occurs, one can only rely on themselves to rollback.

Common questions

Question: Can we not do anything during the security support period?Answer: You can push the large version upgrade to the due date, but security patches still need to be applied in a timely manner according to the announcement. The workload at this stage will be concentrated on security events, and scheduling should be reserved.

Question: Should we stay at version 5.4 or upgrade to a larger version?Answer: See if there is a corresponding version for the extension. If the extension is not up to date, stop at the supported branch first, and complete the compatibility verification of the template and content before moving to the large version.

Question: How can we judge if the site is actually no longer supported?Answer: Verify the branch deadline on the roadmap with the actual effective version at the site. If they are inconsistent, the actual version shall be taken as the standard, and the version number displayed on the background may be different from the running version.

Related articles

How many costs will increase when an open-source content system shifts from self-hosting to managed hosting services?

The additional costs for shifting a content system from self-hosting to managed hosting services are concentrated in three areas: the billing method changes to per seat or per request, additional items such as environment and backup are listed separately, and there is a one-time expenditure for migration and reconstruction. According to the current standards, Strapi's self-hosted core platform is not charged, while the Contentful commercial tier is $300 to $900 per month, and the Lite tier starts at about $300 per month, so the price comparison window should be extended to five years.

2026-11-01

Self-hosted open source content systems cost fifty to three hundred dollars per month, when is it more cost-effective than subscription per seat?

Self-hosted Strapi or Directus backend costs about $50 to $300 per month, Contentful business hosting costs about $300 to $900 per month; hosting side also priced by seat, Strapi Cloud small projects start from $25 per month, Sanity's Growth tier starts from $15 per person per month. The crossover point is determined by the number of sites, request patterns, and whether there is existing operations staff, multi-site scenarios are easier to amortize the fixed items of self-hosting.

2026-11-01

After the release of the high-risk patch, the official said there were no complete mitigation measures, and which temporary configurations can be changed.

PHP on October 21, 2026, with versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, fixed two unauthorized remote code execution issues rated 9.2, the official clearly stated that there are no complete mitigation measures, and upgrading is the only safe practice. When you cannot change the version, you can only temporarily relax the memory limit, reduce the request body size according to the business, turn off session upload progress and fatal error traceback, and must restart all worker processes and keep a rollback backup.

2026-11-01

Last year, 90% of the newly discovered vulnerabilities came from plugins, how should the priority list of site updates be arranged?

WordPress added 11,334 vulnerabilities last year, with plugins accounting for 91%, themes for 9%, and the core only 6. The median time from disclosure to widespread exploitation of severe vulnerabilities is about 5 hours. Therefore, the update list is not arranged according to the version newness, but according to the in-the-wild exploitation signs, component exposure surface, and whether it can be rolled back: those with in-the-wild signs and front-end accessibility are handled on the day, and a recoverable backup is made before batch updates.

2026-11-01

AI robots visited tens of thousands of times, but no one read llms.txt; what does this ratio indicate?

A ninety-day observation recorded two types of numbers: AI robots visited the site more than sixty thousand times, of which only more than eighty times requested llms.txt. This ratio indicates that the file is not a collection switch and will not bring additional crawling; the model consumes the already caught page text, and what truly determines whether it can be cited is whether the paragraph can stand alone as an answer, and whether the conclusion is presented in advance.

2026-11-01

When blocking training crawlers, first identify the identity of the robot, and control access and reading paths.

Access control is handled by robots.txt, and the reading path is handled by llms.txt; they cannot be substituted for each other. Mainstream AI crawlers have about eight and each has different behaviors, GPTBot is not equal to OAI-SearchBot, ClaudeBot is not equal to Claude-SearchBot; training and retrieval types need to be configured in groups; after modification, use logs to verify distribution instead of just checking whether the rules are written.

2026-11-01

The rankings are still fluctuating after the garbage update, what groups of data should webmasters review in the monthly review?

When the ranking fluctuates continuously after the algorithm update, the review order is to first divide the traffic source and query intent, then check the collection and site map health, and finally it's time for content rewriting. The main theme of the October webmaster circle is still the fermentation of the September garbage update, and at the same time, another message related to traffic is that the pilot of generative answers is divided to hundreds of publishers in a very small proportion, and looking only at the ranking curve will miss the changes in the source structure.

2026-11-01

Shared hosting costs $2 per month to $500 for dedicated servers, how to estimate the website billing according to which grade.

The common categories of hosting plans for website hosting are shared hosting costing $2 to $15 per month, VPS entry-level $10 to $50, high-end $30 to $100 and above, dedicated servers $100 to $500 and above, and domain names costing about $15 to $20 per year. The basis for selecting the category is concurrent traffic and data volume rather than the brand of the program; how many websites a single machine can host also depends on the resource overhead of the runtime stack.

2026-11-01