Community Magazine 
Software security isn't just about fixing vulnerabilities anymore, it's about communicating them effectively. With the upcoming Joomla 5.4.9 release, extension developers can now mark an extension update as a security release, allowing Joomla to clearly highlight security fixes from regular feature or maintenance updates. It may seem like a small addition, but it's an important step towards a more secure Joomla ecosystem.
Why security updates deserve special treatment
Not every update has the same priority. A feature release can usually wait until the next maintenance window. A bug fix may not affect every installation. But a security vulnerability is different. Every hour a known vulnerability remains unpatched increases the risk of a successful attack. Recent discovered and abused security issues in Joomla extensions through AI revealed that problem dramatically.
Until now, Joomla displayed all extension updates in exactly the same way. Administrators had no immediate indication whether an available update contained a critical security fix or simply introduced a new feature. Joomla 5.4.9 changes that. By allowing extension developers to flag a release as a security update, administrators can instantly recognize updates that deserve immediate attention. This seemingly small change helps reduce one of the biggest challenges in security: prioritization.
A simple addition with a big impact
The implementation couldn't be much easier. Extension developers simply add a security flag to their update XML:
<security>4</security>
Once the flag is present, Joomla recognizes the update as a security release and highlights it appropriately in the Extension Update Manager and the dashboard in the the quick icon. More background information can be found in the pull request. For your convenience, we list the severities with their meaning here:
-
4. Critical (CVE score 9.0 – 10.0):
Severe impact with high exploitability; requires immediate emergency patching. -
3. High (CVE score 7.0 – 8.9):
Serious impact and relatively easy to exploit. -
2. Medium (CVE score 4.0 – 6.9):
Moderate impact requiring some skill to exploit. - 1. Low (CVE score 0.1 – 3.9):
Minimal risk and hard to exploit. -
0. None (CVE score 0.0):
No security impact or threat.
Start flagging your security releases today
Although the feature officially arrives with Joomla 5.4.9, there's no reason to wait before adapting your release process. Security releases should be clearly identified from the moment they're published. When Joomla 5.4.9 will be out, they'll immediately benefit from improved update notifications without any additional work from extension developers.
Preparing now also encourages a healthier security culture within the Joomla ecosystem. When a vulnerability is fixed with an update, it should be obvious, to both developers and administrators, that the update deserves immediate attention.
Akeeba Release System is already prepared
The eco system is already catching up. If you're using Akeeba Release System (ARS) to distribute your extensions, you're already ahead of the curve. ARS 7.5 will support Joomla's new security flag, allowing developers to mark releases as security updates directly when publishing them. For many extension developers, adopting this new feature is therefore as simple as setting the appropriate severity during a release. Hopefully, other update server implementations and build tools will follow soon.
Beyond Joomla: Better visibility for managed websites
The benefits of the new security flag are not limited to Joomla's Extension Update Manager. An increasing number of agencies and service providers manage tons of Joomla websites through centralized management platforms. These platforms already aggregate available updates from all managed websites into a single dashboard, allowing administrators to keep their fleets up to date efficiently. With the introduction of the security flag, these services can take the next logical step.
Instead of simply listing available updates, they can prominently identify security releases, prioritize them in dashboards, trigger dedicated notifications, or allow administrators to filter specifically for websites requiring immediate attention.
A small feature that strengthens the ecosystem
The new security flag won't prevent vulnerabilities. It won't automatically patch websites. But it will help ensure that critical fixes receive the attention they deserve.
The real power of this feature lies in standardization. Once extension developers consistently mark security releases, the entire Joomla ecosystem, from the CMS itself to update servers, management platforms, and automated maintenance services, can help administrators identify and install critical updates faster. That's a win for developers, agencies, hosting providers, and, ultimately, every Joomla website.
Comments