Joomla and Drupal: security updates and supported versions

Updated November 2026

Run a supported major version, apply core security releases on the day they appear, and update extensions and modules just as often. That is where most attacks land. As of November 3, 2026, the supported versions are Joomla 6.x and 5.x, and Drupal 11.4, 11.3 and 10.6. Drupal 10 reaches end of life on December 9, 2026.

6.2.0Latest Joomla (October 13, 2026)
Oct 12, 2027Joomla 5 security support ends
11.4.11Latest Drupal (October 21, 2026)
Dec 9, 2026Drupal 10 end of life

What they are

Joomla and Drupal are PHP content management systems, used for company sites, membership portals, universities and government sites. In both, the core gets regular, well-announced security releases. Each site also adds third-party code: extensions in Joomla, modules and themes in Drupal. Each comes from a different maintainer and updates on its own schedule. Every add-on you install is more code that can have a hole, so remove what you don't use.

Check the installed version

Run these from the site root as the user that owns the files, not as root. Here that user is siteuser.

# Joomla 4 and later
sudo -u siteuser php cli/joomla.php core:check-updates    # current version and any update
grep -E 'const (MAJOR|MINOR|PATCH)_VERSION' libraries/src/Version.php

# Drupal 8 and later (Composer-managed)
sudo -u siteuser vendor/bin/drush status --field=drupal-version
sudo -u siteuser composer show drupal/core | grep versions
sudo -u siteuser composer outdated "drupal/*"           # core and modules with updates
sudo -u siteuser composer audit                         # known security advisories

In the browser, Joomla shows its version in System > System Information. Drupal shows it in Reports > Status report, and lists missing security updates under Reports > Available updates if the Update Status module is on.

Supported versions

Joomla and Drupal support status, as of November 2026
Version	Latest	Security fixes until
Joomla 6.x	6.2.0	Oct 16, 2029 (bug fixes until Oct 17, 2028)
Joomla 5.x	5.4.10, the last bugfix release	Oct 12, 2027 (security only)
Joomla 4.x and 3.x	none	Ended (4.x in October 2025)
Drupal 11.4.x	11.4.11	Supported; current minor
Drupal 11.3.x	11.3.20	Week of Dec 7, 2026
Drupal 10.6.x	10.6.20	Dec 9, 2026: Drupal 10 end of life
Drupal 11.2, 10.5 and older, 8, 9	none	Ended
Drupal 7	none	Ended Jan 5, 2025

Drupal 12.0.0 and 11.5.0 are scheduled for the week of December 7, 2026. Drupal 12 supports only PHP 8.5, and Drupal 11 needs PHP 8.3 or newer. Joomla 6 needs PHP 8.3 or newer and recommends 8.4. If you are still on Drupal 10, plan the move to Drupal 11 now. After December 9 it gets no more fixes. Drupal.org lists certified vendors that sell extended security support for Drupal 7. That buys time, but it is not a long-term plan. For anything past its end of life, see end-of-life software.

Packages, Composer and Docker

Update the site with the same tool that installed it. Drupal 8 and later is normally managed with Composer. Joomla is normally installed from the joomla.org package and updates itself. Debian and Alpine don't package current releases of either (Debian's last Drupal package was Drupal 7, in Debian 9). Your OS package manager only updates PHP and the web server, which you should patch as well (see PHP updates).

FreeBSD has ports, but check them before you rely on them. On November 3, 2026, www/drupal11 was at 11.4.8 and www/joomla5 at 5.4.7. Both are older than the latest security fixes (Drupal 11.4.10, Joomla 5.4.9). Official joomla and drupal Docker images exist. Anything you keep on a volume is not replaced when you pull a new image, so follow the image notes on which folders belong on volumes, and update the code inside them with the steps below.

Update Joomla

Take a backup first: files and database. Then update core:

cd /var/www/example.com
sudo -u siteuser php cli/joomla.php core:check-updates
sudo -u siteuser php cli/joomla.php core:update

In the administrator area, use System > Update > Joomla for core and System > Update > Extensions for everything else. Open that screen after every core update, because the core update does not touch extensions. Extensions bought from a vendor usually need a download key, set in System > Update Sites, before they can update.

Automated core updates. Joomla 5.4 and 6.0 (October 2025) added automatic core updates. A joomla.org server tells your site that an update is waiting, and your site then downloads and installs it. They are on by default for new installs but off for sites upgraded from older versions, so check yours. The site must be reachable from the internet, use the "Standard" update server and accept only stable releases. They do not cover extensions.

The September 29, 2026 release (6.1.4 and 5.4.9) fixed at least ten issues, including a multi-factor login bypass through "remember me" cookies and server-side request forgery (SSRF: making the server fetch URLs an attacker chooses) in core extensions. All earlier 5.x and 6.x releases are affected.

Update Drupal

cd /var/www/example.com
sudo -u siteuser composer outdated "drupal/*"
sudo -u siteuser composer update "drupal/core-*" --with-all-dependencies   # core (core-recommended projects)
sudo -u siteuser composer update drupal/modulename --with-all-dependencies # one contrib module
sudo -u siteuser vendor/bin/drush updatedb            # puts the site in maintenance mode while it runs
sudo -u siteuser vendor/bin/drush cache:rebuild

If your project requires drupal/core directly, use composer update drupal/core --with-dependencies. drush deploy runs the database updates, configuration import and cache rebuild in one step and fits automated deployments. Commit composer.lock and deploy the same lock file to production, so production runs exactly the code you tested.

The contrib Automatic Updates module can install core patch releases, such as 11.4.10 to 11.4.11, from the browser. It needs a Composer-managed site whose code the web server can write. That conflicts with the file-permission advice below. Many teams run Composer from CI or cron instead.

When you can't update today. Drupal advisories sometimes name a workaround. For SA-CORE-2026-014 (critical remote code execution, October 14, 2026, fixed in 11.4.10, 11.3.19 and 10.6.19), uninstalling the Field UI module protected sites until they could update.

Restart and verify

A CMS update restarts nothing. If you updated PHP at the same time, restart PHP-FPM, for example sudo systemctl restart php8.4-fpm on Debian and Ubuntu (this restarts the service). Then check:

sudo -u siteuser php cli/joomla.php core:check-updates     # Joomla: should say up to date
sudo -u siteuser vendor/bin/drush status --field=drupal-version
sudo -u siteuser composer audit                           # Drupal: no advisories listed

Load the site and log in to the admin area. In Drupal, Reports > Available updates should show nothing in red. If you find files you did not put there, follow our hacked-website steps.

Where advisories appear

Joomla: the Joomla Security Centre (RSS) lists every core issue with affected and fixed versions. Releases are announced under Release News.
Drupal: drupal.org/security with RSS feeds for core and contributed projects. To get them by email, log in on drupal.org and subscribe to the security newsletter under Edit > My newsletters.
Drupal security release windows: core usually on the third Wednesday of the month, contributed projects on any Wednesday, between 16:00 and 22:00 UTC. Contrib advisories come out almost every week. On October 28, 2026 alone there were ten.
Our vulnerability pages for the most serious issues.

Quick hardening tips

Uninstall and delete extensions, modules and themes you don't use. In Drupal, also remove them from composer.json so the code is gone from disk.
Before you install an add-on, check that it is maintained and, for Drupal, covered by the security advisory policy (shown on the project page).
Code should not be writable by the web server. Drupal's guide suggests directories at 750 and files at 640, owned by a deploy user with the web server's group. Only sites/*/files should be writable by the web server.
Make settings.php (Drupal) and configuration.php (Joomla) unreadable to other users on the server.
Block PHP execution in upload folders (sites/*/files, Joomla's images and media).
Turn on two-factor login (MFA) for every administrator, and remove admin accounts nobody uses.
Keep the Drupal Update Status module on, or check Joomla's update screens weekly, so missed updates show up.
Keep daily off-server backups of code, files and database, and test a restore.