The Joomla 3 timeline, from release to end of life
Joomla 3.0 shipped on 27 September 2012. 106 stable releases later, the free security fixes stopped on 17 August 2023, and the paid eLTS programme that kept patching it ended on 17 February 2025.
This is the whole record in date order: Joomla's own releases, every dated statement and action we have found from extension vendors, and the points where mySites.guru shipped a patch for the sites left behind. Each vendor row links to its source and says when we last checked it.
Three dates, counted in days
Between them they decide whether anyone but mySites.guru still patches a Joomla 3 site.
The last public Joomla 3 release, 3.10.12, came out on 8 July 2023, 40 days before end of life. From 17 August 2023 the Joomla project stopped issuing free security fixes for Joomla 3. Anyone who wanted more had to pay for eLTS.
The eLTS window ran 550 days past end of life. Its last build, 3.10.20, was published on 7 January 2025, and the programme closed 41 days later on 17 February 2025. It was the only official source of Joomla 3 core fixes after 3.10.12, and no build of any kind has followed it.
That leaves 592 days with no official Joomla 3 patch at any price, and 1,142 days since end of life. In that time Joomla has kept publishing core advisories, and the core vulnerabilities page lists the 39 that still reach Joomla 3.
Year by year
A filled dot is something that changed the risk, such as a release that fixed a flaw. A hollow dot is a statement or step that moved nothing. Red is kept for the end of eLTS and for the line that told Joomla 3 users to expect no patches.
2012
Joomla 3.0 is released
The first of 106 stable Joomla 3 releases.
2021
2022
Solidres: "we also dropped support for Joomla 3 to focus only on Joomla 4 from now on."
Source, checked 2026-10-02
Kunena sets out its Joomla 3 policy
"The Kunena team is thrilled to announce the final release of Kunena 5.2.14, a security release and native Joomla extension for Joomla 3.10." Source, checked 2026-10-02
2023
SEBLOD: "If you site runs on Joomla! 3 and you'd like to stay on Joomla! 3 you should remain on SEBLOD 3"
Source, checked 2026-10-02
Joomla 3.10.12, the last public Joomla 3 release
Every later Joomla 3 build was paid-for eLTS.
Weeblr: "from now on no further development will happen dedicated to Joomla 3 support for both extensions."
Source, checked 2026-10-02
Akeeba sets out its Joomla 3 policy
"As we announced two years earlier, this is the final version for Joomla! 3. We will no longer publish feature updates (bug fixes, new features, etc) for our Joomla! 3 software starting August 17th, 2023. We will only publish security updates until August 17th, 2024." Source, checked 2026-10-02
Joomla 3 reaches end of life
Free security fixes stop. Joomla's announcement
Joomlashack: "We plan to support Joomla 3 extensions until at least August 2024."
Source, checked 2026-10-02
Regular Labs: Last Joomla 3 builds across the range, including Sourcerer 9.8.0; every Joomla 3 branch is still frozen at this date
Regular Labs: "Removes Joomla 3 support"
Source, checked 2026-10-02
Extly: "we are extending our support for Joomla 3 until at least the end of 2024."
Source, checked 2026-10-02
2024
mySites.guru launches the 3.10.999 project and the one-click Joomla 3 core patch
Community security backports for end-of-life Joomla 3 sites, applied from one toggle. The 3.10.999 project
YOOtheme: YOOtheme Pro 4.3.7 fixes the installer script for Joomla 3
Sigsiu: "The SobiPro 2.5 series will be the last series made for with Joomla 3 and PHP 7.4"
Source, checked 2026-10-02
Digital Peak sets out its Joomla 3 policy
"From now on we put DPCalendar 8.x in hybrid maintenance mode as we still care about our Joomla 3 users." Source, checked 2026-10-02
JoomlaWorks: "we don't plan on giving up on K2 (or Joomla 3)."
Source, checked 2026-10-02
Akeeba sets out its Joomla 3 policy
"Joomla! 3.10 get priority security updates to February 2025 (when Joomla! 3 eLTS expires), and limited support after that." Source, checked 2026-10-02
Akeeba: "Our free-of-charge software for Joomla! 3 is not supported at all."
Source, checked 2026-10-02
YOOtheme: YOOtheme Pro 4.4.11 ships a Joomla 3 fix
YOOtheme: YOOtheme Pro 4.4.12 fixes a regression in Joomla 3
2025
Joomla 3.10.20, the last eLTS release
The final Joomla 3 release of any kind, available only to paying eLTS subscribers.
YOOtheme: YOOtheme Pro 4.5.3 fixes a regression in Joomla 3
The paid eLTS programme ends
From here there is no official patch for the Joomla 3 core at any price.
Balbooa: "That's mean all future versions of Forms wouldn't be compatible with Joomla 3.x."
Source, checked 2026-10-02
Akeeba: Akeeba Backup 8.4.1.1 ships as a maintenance release for Joomla 3, nearly two years after the "final" Joomla 3 version
RocketTheme: RocketTheme closes; the club, member downloads and support forum close with the site
Gantry: "Dropped Joomla 3.x support"
Source, checked 2026-10-02
Joomlatools: "If your site is still running Joomla 3, 4, or 5, you can upgrade safely when you're ready."
Source, checked 2026-10-02
2026
YOOtheme: "For end users, support for Joomla 3 and 4 has been removed."
Source, checked 2026-10-02
JCE: "Remove official support for Joomla 3"
Source, checked 2026-10-02
JCE sets out its Joomla 3 policy
"This ensures Joomla 3 users remain supported for critical fixes while development progresses toward JCE Pro 3.x." Source, checked 2026-10-02
JoomlaWorks: First release of the Joomla 3.x UTD fork, version 3.11
JoomlaWorks sets out its Joomla 3 policy
"We're continuing the development of an open distribution of Joomla 3.x (we call it Joomla 3.x UTD for now) to ensure code security and support modern PHP versions." Source, checked 2026-10-02
JCE: Free security patch published for JCE 2.7.x to 2.9.x, for sites that cannot update to 2.9.99.6 or later
Web357: Cookies Policy Notification Bar 5.0.3 adds compatibility for Joomla 3 installations
iCagenda: iCagenda 3.9.15, a security release for Joomla 3
JCE: JCE 2.9.99.7 allows installation on Joomla 3.9 and later
JoomDonation: Events Booking 4.9.5 ships for Joomla 3 with the fixes for the flaws mySites.guru reported, but not in the public downloads area
JoomShaper: "No security patches, regardless of severity"
Source, checked 2026-10-02
Digital Peak: DPCalendar 8.19.4 for Joomla 3 fixes the unauthenticated SQL injection mySites.guru reported
mySites.guru adds a one-click patch for unpatched JoomShaper extensions on Joomla 3
Helix Ultimate, Helix3 and SP Page Builder, across every site in an account. How it works
Balbooa: "upgrading Joomla remains the only meaningful long-term security solution"
Source, checked 2026-10-02
Balbooa: Publishes a community-written Joomla 3 compatibility patch for Balbooa Forms
JoomShaper: Joomla 3 security patches ship for Helix Ultimate, Helix3 and SP Page Builder, six days after the no-patches announcement
JoomShaper: Helix Ultimate Joomla 3 patch 1.0.1 released
Tassos: Convert Forms 4.4.16 fixes unauthenticated submission disclosure on the Joomla 3 branch
SEBLOD: SEBLOD 3.30.0 ships for the Joomla 3 line, fixing the unauthenticated path traversal file download among other security issues
Fabrik sets out its Joomla 3 policy
"Because F4 and F5 are complete rewrites of F3, none of this work will be backported to the F3 codebase." Source, checked 2026-10-02
Fabrik: A one-line manual patch for the Fabrik 3 calc element flaw is posted in the forum, offered as-is
iCagenda: iCagenda 3.9.16, a security release for Joomla 3
Phoca: Phoca Cart 6.1.7 security release; the Joomla 3 line stays on 3.5.8 with no fix
Joomlapolis: "This is a reminder that Joomla 3.x support has come to an end."
Source, checked 2026-10-02
Tassos: Convert Forms 4.4.17 backports a CAPTCHA and validation bypass fix to the Joomla 3 branch
YOOtheme: YOOtheme Pro 4.5.34 backports all four 2026 security fixes to the Joomla 3 line
YOOtheme: YOOtheme Pro 4.5.35 repairs a regression introduced by 4.5.34
RSJoomla: RSForm! Pro 3.4.10 released
JoomShaper: Helix Ultimate J3 Security Fixes 1.0.2 backports most of the 2.2.10 security work, under the unchanged version string 2.1.4-j3sec
Digital Peak: DPCalendar 8.19.5 for Joomla 3, security fixes only
JoomShaper: Helix Ultimate J3 Security Fixes 1.0.3 closes an authorisation gap mySites.guru reported in 1.0.2
J2Commerce: J2Store 3.3.22 fixes five flaws reported by mySites.guru, the same day as the 4.x releases
J2Commerce: "October 19, 2026 J2Store 3 end of life. No further releases of any kind."
Source, checked 2026-10-02
Digital Peak: DPCalendar 8.19.6 for Joomla 3, security only, fixes the location title escaping mySites.guru reported
JoomShaper: SP Page Builder Joomla 3 patch 1.0.2 ships alongside 6.9.1; mySites.guru reports two gaps in it the same day
J2Commerce: J2Store 3.3.23 fixes six more flaws reported by mySites.guru, again the same day as 4.x
JCE: JCE 2.9.99.11 released on the 2.9.99 line that still runs on Joomla 3
JoomShaper: SP Page Builder Joomla 3 Security Patch 1.0.3 closes the captcha bypass and the incomplete XSS fix
The one-click Joomla 3 core patch reaches 85 files
Fourteen more core fixes, each reproduced on a real Joomla 3.10.12 install first: 84 files replaced and 1 added. Read the update
Phoca: Phoca Cart 6.1.9 security release; 3.5.8 for Joomla 3 has the same flaw and no fixed release
J2Commerce: J2Store 3 end of life: no further releases of any kind, including security fixes
Find out where your Joomla 3 sites sit on this timeline
Connect one site and the audit shows the Joomla version it runs, how many core patch files it is missing, and which extensions have known vulnerabilities. The first audit is free, with no card.
What the vendor dates show
Joomla set the deadline. Extension vendors then made their own, and the record does not always agree with their words.
We track 46 extension vendors. 27 have said something dated about Joomla 3, which gives 26 dated statements in the timeline above. The other 19 have no public statement on file.
Of the 46, 7 are marked as having said they stopped and then kept shipping, and 9 are shipping for Joomla 3 without announcing an end. 13 have stopped, 13 have said nothing and 4 no longer exist as a vendor. JoomShaper is the clearest case: it announced on 9 July 2026 that Joomla 3 would get no security patches and shipped Joomla 3 packages six days later.
A vendor's announcement tells you little about its next release. The vendors page sorts every vendor by what it did, and the extension vulnerabilities page shows where a Joomla 3 branch is still open. For the full write-ups behind these rows, see the reading list.
Keeping Joomla 3 patched is part of the subscription
The one-click core patch, JoomShaper's Joomla 3 packages, vulnerable extension alerts and malware scanning are all included, alongside everything else mySites.guru does for Joomla and WordPress. No per-site fees, and no price increases since 2012.
Keep your Joomla 3 sites patched while you plan the move
One free audit of one site, no card, no time limit.