nuBlog

JoomlaWorks Blog

1. Joomla 3.x UTD v3.17 now available - a milestone release for this project!

   

   Joomla 3.x UTD v3.17 is out - the biggest release of this project so far, along with a brand new website & 3 live demo sites for our 3 new templates.

   According to market share estimates (as of May 2026), Joomla 3.x is currently used on more than 50% of all installed Joomla sites worldwide. However, official support for Joomla 3.x ended in February 2025 (counting the eLTS program).

   Back in April we launched the first version of Joomla 3.x UTD - an up-to-date distribution of the Joomla 3.x content management system, built to ensure code security, support modern PHP & MySQL/MariaDB versions & fix any broken behaviour that never got sorted before the release of newer major versions of Joomla.

   Releases 3.11 to 3.16 delivered on those primary goals: PHP up to 8.5 and security in-line with Joomla 5 & 6. A few days ago we wrote about what's coming next - fixing what was left unfinished (database drivers beyond MySQL/MariaDB) or never properly implemented (frontend templates that actually showcase a capable CMS).

   Well, that's all in v3.17, released today. And then some.

   A new home: j3xutd.joomlaworks.net

   Joomla 3.x UTD now has its own website at https://j3xutd.joomlaworks.net.

   Up until now, everything about this project lived in the README file on GitHub. The new site puts it all in one place, in a format that's a lot easier to browse & share with clients, colleagues or your hosting company:

   • What's new in the latest release
   • The 3 new templates, with screenshots for desktop, mobile & dark modes
   • Install & upgrade instructions (Web UI, SSH one-liner and fresh installs) with copy-paste ready commands
   • The command line & MCP server, including the full list of all 100 commands
   • Compatibility notes for PHP and a database support table for every database vendor
   • The changelog of every release since v3.11
   • A full list of security fixes per release, with their origin (backported from Joomla 5/6, CVE IDs, or issues found in stock Joomla 3 by us)
   • Our long-term plan & ways to get involved

   The GitHub repository at https://github.com/joomlaworks/joomla-3.x remains the place for code, releases, discussions & issues - and you can subscribe to the releases feed to be notified of new versions.

   3 live demo sites, one for each new template

   Each of the 3 new templates runs live with its own sample data, exactly as a new site gets it from the installer. All 3 demo sites run on PHP 8.5 with SQLite as the database:

   • Hammond (news portals & magazines): https://j3xutd-demos.joomlaworks.net/hammond/
   • Finch (blogs & personal sites): https://j3xutd-demos.joomlaworks.net/finch/
   • Rookwood (studios, agencies & company sites): https://j3xutd-demos.joomlaworks.net/rookwood/

   Click around, test them on your phone, and torture them as much as you like - we're still eager to see how SQLite holds up!

   What's new in v3.17

   Here's a summary:

   • Every major database, tested: MySQL/MariaDB (native & PDO), PostgreSQL (native & PDO, now fixed for PHP 8.1+), SQL Server & Azure SQL (tested on SQL Server 2022 with both drivers) and SQLite (new). MySQL 8.0, 8.4 and 9.x work with their default authentication (caching SHA-2) - no more my.cnf changes to switch to "native" passwords.
   • SQLite (experimental): a whole site in one file. We use WordPress' emulation layer, so MySQL SQL from Joomla and your extensions runs unchanged. WAL mode lets visitors keep reading while a write happens, and sessions are kept in PHP so browsing writes nothing to the database. Ideal for spinning up dev sites in seconds or keeping a site in Dropbox/OneDrive, but also practical for small to medium sites with caching enabled. Busy shops or forums with many concurrent writers are still better off on MySQL/MariaDB.
   • A brand new installer: app-style, with a sidebar of steps, dark mode and right-to-left support, built with plain HTML, CSS & JavaScript. It supports every database driver, removes the installation folder for you when you continue to the site, and once installed, only the browser that installed the site can go on.
   • 3 brand new frontend templates: Hammond (news), Finch (blogs) and Rookwood (studios & companies). Plain CSS & JavaScript, no jQuery, Bootstrap or MooTools, system fonts & SVG icons, built for Google's Core Web Vitals and using 100% core Joomla extensions. Each comes with an editor.css so your WYSIWYG editor shows articles with the site's fonts, colours & layout, and a css/custom.css that updates never touch.
   • Sample data made for each template: News (227 articles in ten sections), Blog (20 essays in four topics) and Studio (9 case studies & 16 journal posts). Pick one in the installer, or switch sets later from the Control Panel, as if the site had been installed with that set from the start.
   • A command line for everything: cli/joomla.php now ships with 100 commands for content (articles, categories, tags, modules, menus), templates (with undoable changes & backups), databases (export, import, optimize and database:convert between MySQL, PostgreSQL & SQLite in any direction), health checks, logs and more. Every command has JSON output and dry runs, and where Joomla 4 or newer has a command, ours uses the same name.
   • A built-in MCP server: Claude, ChatGPT, Gemini, Qwen, Kimi, GLM and other AI assistants can work with your site through the Model Context Protocol. It's read-only unless you allow writes (--allow-write), anything that puts code on the server needs --allow-code too, and every change is recorded in the User Actions Log. Details in our AI & CLI guide.
   • TinyMCE 8 is the default editor for new sites: image uploads by dropping or pasting, a toolbar builder per user group and 61 languages. TinyMCE 4 stays as "Editor - TinyMCE (legacy)" for existing sites.
   • Quality of life in the backend: a new responsive login page, one-click Clean Cache in the status bar (plus Clean Everything and Global Check-in for administrators), Install from Web back as the first tab, and Help buttons that work again.
   • Post-installation Messages now tell the story of this distribution, one message per release since v3.11, instead of stock Joomla's notes from the 3.2–3.10 era.
   • Thousands of fixes: long-standing bugs in the API sorted, database errors handled as Joomla expects on PHP 8.1+, and every PHP deprecation we could find removed - including thousands while Smart Search indexes.

   22 security fixes

   v3.17 also includes 22 security fixes. And this time most of them were not backports - they were issues present in stock Joomla 3 all along, found while auditing the codebase ourselves. A few examples:

   • Crafted packages could write files outside the site's folders through Joomla Update's extraction, the extension installer or the archive code - such packages are now refused as a whole.
   • Anyone could run the installer again on an installed site while the installation folder remained.
   • The configuration writer could put PHP code into configuration.php through a crafted setting name.
   • The MySQL (PDO) and PostgreSQL drivers ran several SQL statements given at once - every driver now runs one, like "mysqli".
   • {loadmoduleid} showed any module to anyone, whatever its access level or publishing dates.

   Our opt-in Little WAF plugin (introduced in v3.16) now also checks form data and encoded spellings of the tags it filters.

   The full list is on the security section of the new site and in the detailed changelog.

   How to upgrade (or start fresh)

   For existing Joomla 3.x sites (any 3.x release), in the backend open the Joomla Update options (or Global Configuration) and set:

   • Update Channel: Custom URL
   • Minimum Stability: Stable
   • Custom URL: https://joomlaworks.github.io/joomla-3.x/list.xml

   Refresh and v3.17 will show up. If your site is already on Joomla 3.x UTD, it's waiting for you there already.

   Prefer SSH? cd into your Joomla site's folder and run:

   wget -qO- https://github.com/joomlaworks/joomla-3.x/archive/refs/heads/main.tar.gz | tar -xz --strip-components=1 && rm -rf installation .github .gitignore *.md

   For new sites, download the latest release and open it in a browser, or install a complete site on SQLite from the command line in about a second (sample data included):

   wget -q https://github.com/joomlaworks/joomla-3.x/releases/download/rolling/joomla-latest.zip && unzip -q joomla-latest.zip && rm joomla-latest.zip && php cli/joomla.php core:install --site-name="My Site" --admin-email=me@example.com --admin-username=admin --sample-data=news

   (Swap news for blog or studio.)

   What's next

   With v3.17, Joomla 3.x UTD is secure, current & - for the first time - showcases what a fast, approachable CMS built on Joomla 3.x can look like out of the box. We'll keep backporting security fixes & fixing bugs as they're reported.

   In parallel, our leaner fork based on Joomla 3.x (a separate project) is moving along very actively: stripped down, K2 for content, first-class MySQL/MariaDB, PostgreSQL & SQLite support, a refreshed administrator and modern JavaScript only. The command line & MCP server in v3.17 are the seed for what we want that project to become: a truly agentic CMS.

   If you're a Joomla extension developer reading this, make sure your extension update XML files don't stop at Joomla 3.10.x. Do your users a favour ;)

   Found a bug? Report it in our GitHub Discussions. Want to contribute a fix or a meaningful upgrade? Open an issue.

   Happy updating!

2. Major improvements coming to Joomla 3.x UTD

   

   Development of our modernized Joomla 3.x distribution moves rapidly - here's what we've done and what's coming next.

   According to market share estimates (as of May 2026), Joomla 3.x is currently used on more than 50% of all installed Joomla sites worldwide.

   However, official support for Joomla 3.x ended in February 2025 (counting the eLTS program).

   Back in April we launched the first version of our up-to-date Joomla 3.x distribution, now called 'Joomla 3.x UTD' - an updated distribution of the Joomla 3.x content management system built to ensure code security, support modern PHP & MySQL/MariaDB versions & fix any broken behaviour that never got sorted before the release of newer major versions of Joomla.

   This work has produced 6 releases so far (from 3.11 to 3.16), gradually reaching a major milestone for this project, as it achieves its primary stated goals of supporting newer PHP versions, while being fully in-line in terms of security with newer Joomla 5 & 6 releases.

   We now shift gears by fixing the things that were either left unfinished (e.g. database drivers beyond MySQL/MariaDB) or were never properly implemented (e.g. templates that highlight what a powerful & approachable content management system should be).

   So in version 3.17, slated to be released in the coming days, we're bringing a slew of updates!

   Here's a summary:

   • Full support for all major database vendors: MySQL/MariaDB (native & PDO), Postgres (native & PDO), SQLite, SQL Server & Azure SQL, spanning versions that were released even 15 or so years ago (excluding SQLite which supports versions from around 2020 for now). Our work made all databases simply work as they should with Joomla. And Joomla 3.x UTD works natively with the default user authentication method that ships with MySQL 8.0, 8.4 and 9.x (caching SHA-2) and it does not require switching MySQL to "native" authentication (the old way up to MySQL 5.7).
   • For SQLite specifically, we're using WordPress' emulation layer so that any SQL statement built for MySQL will work with SQLite as well. And we use WAL mode to queue write operations in SQLite, while switching session management to "PHP" to reduce write volume to what would otherwise end up in the sessions table in the database. SQLite is excellent for spinning up Joomla 3.x UTD dev environments in seconds, or even putting entire sites in Dropbox, OneDrive etc. that you can resume working on when switching between devices. But it can also be used for small sites, that don't require lots of concurrent writes. We currently flag the SQLite driver as 'experimental,' having tested it primarily against engine releases from the past six years. Compatibility will continue to improve as we test older releases and gather real-world feedback from third-party extensions.
   • A brand new installation process that supports all database drivers.
   • 3 brand new frontend templates that truly highlight what a good content management system should be: Finch (for blogging), Hammond (for news portals & magazines) and Rookwood (for portfolio/presentation business sites). All using 100% core Joomla extensions, built with plain CSS and JavaScript, providing editor.css files for ensuring your WYSIWYG editor sees the template's CSS styling, including awesome "print CSS" styling for article views and scoring excellent on Google's Core Web Vitals. Not only that, we revamped all sample data sets to adapt on each template. And you can switch between sample data sets even after you've installed Joomla 3.x UTD for the first time, as if you had installed the new sample data set at first. The 3 new templates are a great starting point for any new project and have been professionally crafted using our nearly 2 decades of experience in building high traffic & heavy content websites with Joomla & K2.
   • Protostar has been fully upgraded for PHP 8 and security, but will not be actively used in the future - it's there for backwards compatibility only.
   • We've added TinyMCE 8 (the latest version) as a new default editor plugin for Joomla; TinyMCE 4 stays as "Editor - TinyMCE (legacy)", and existing sites keep it until they switch in Global Configuration, to ensure maximum backwards compatibility.
   • New command line interface (CLI - at cli/joomla.php) using the command names of newer Joomla releases (after version 4), but enhancing with many more and using JSON output so that scripts and AI agents can programmatically interact with your site. We're talking full content management (articles, categories, modules, menus), full template management, dry runs, health checks, converting between databases, log viewers and more! This work will bring Joomla 3.x UTD closer to becoming a truly agentic CMS.
   • The new CLI also exposes a brand new MCP server: All major AI assistants (e.g. Claude, OpenAI, Gemini, Qwen, Kimi, GLM etc.) can now work with your site through this built-in MCP server and perform operations as you instruct them in both the content and structure of the site.
   • It's even possible to install a new Joomla 3.x UTD site using just the CLI in mere seconds, which makes rapid prototyping and testing a joy! See our video on X here.
   • The backend template has a new responsive login page, inline with Isis' colors, but modernized and more practical.
   • We've added a new one-click Clean Cache control in the administrator's status bar for everyone with backend access; administrators also get Clean Everything (the main site cache, anything inside the /cache folder and temporary folders as defined in configuration.php) and Global Check-in from the same spot.
   • Post-installation Messages now show what's new in every release of this distribution, starting from v3.11, instead of stock Joomla's outdated messages from the 3.2–3.10 era.
   • Fixed the administrator's Help buttons, which showed "not found" since v3.11.
   • Fixed a ton of long-standing bugs in the API and ironed out any PHP deprecations we could detect.

   As we prepare the release for v3.17, we've setup 3 demo sites to showcase the new templates, using PHP 8.5 and SQLite for database.

   Browse, test and torture these demo sites (we're eager to see how SQLite will perform)!

   • For Finch: https://j3xutd-demos.joomlaworks.net/finch/
   • For Hammond: https://j3xutd-demos.joomlaworks.net/hammond/
   • For Rookwood: https://j3xutd-demos.joomlaworks.net/rookwood/

   Below you'll find some screenshots of the updates...

   

    

   

   

3. Simple Image Gallery Pro v3.10 released - PHP 8.x compatible for Joomla 3.x UTD, WebP, AVIF, ImageMagick!

   

   Simple Image Gallery Pro v3.10 is now available to download for subscribers. To summarize the release, we've added full support for PHP 8.x (those using Joomla 3.x UTD will certainly appreciate the update) and extended to new features.

   Here's what's been added or changed in Simple Image Gallery Pro with the release of v3.10:

   • Full support for PHP versions from 5.6 to 8.5 - as Joomla 3.x UTD works up to PHP 8.5
   • Accepts AVIF as input format in galleries (WebP was already supported in previous releases).
   • WebP output is now the default format for generated thumbnails (with JPEG fallback).
   • Added support for ImageMagick if it's installed on your server for better quality of created images (and of course GD fallback).
   • Updated third-party libraries elFinder (used in the extension's file manager) and Plupload (used for backend uploads) to their most recent releases.
   • General code cleanups.
   • Security: fixed a path traversal in the gallery image delete flow, a stored XSS in the admin gallery image description field and a missing permission check on the media manager's file browser connector.
   • Security: hardened image upload extension validation and gallery path handling (when using the "gallery" plugin tags) against malicious input.
   • Minor functional bug: Fixed modal image preview in the backend not opening for images uploaded to an existing gallery in the backend, since newly appended images were never bound to the modal JS.

   If you have any custom gallery layouts, you may have to slightly modify them to play nice with PHP 8.x.

   As always, send a ticket in our helpdesk system for assistance with such matters...

    

   FUTURE PLANS

   The next version of SIGPro is already being worked on. These are the things we're considering:

   • Consider supporting Joomla versions 5 and 6. Drop support for Joomla 1.5 and 2.5 and in the future maintain support for Joomla 3.x UTD and any actively supported version by joomla.org (e.g. v6, v7 and so on).
   • Custom ordering for images using drag and drop in the backend.
   • Switch to a new, custom made modal that uses vanilla JS only. This modal's design will be fully CSS-controlled, so this means we can have a few variations, to replace what we have now in the form of multiple "popup engines".
   • All-new gallery layouts using CSS Grid properties, with distinct options for responsive designs.
   • More slideshow-like (carousel) gallery layouts.
   • Updated backend UI that is fully responsive on mobile devices for gallery management on the go.
   • Dynamic image filters (e.g. grayscale, mix with background colors or gradients etc.)
   • New JSON based format for captions.

   Not all the features above will be available when SIGPro v4 is released, but they will be gradually included as updates come in.

    

   DEMO

   The JoomlaWorks demo site has been updated to the latest Simple Image Gallery Pro release. Have a look here: https://demo.joomlaworks.net/simple-image-gallery-pro

    

   DOWNLOAD

   If you have an active Simple Image Gallery Pro membership, just head over to the Member Dashboard at https://www.joomlaworks.net/members and grab your copy from your "Subscriptions" page.

   Or purchase this latest release from just 19.90 EUR. More info at: https://www.joomlaworks.net/extensions/commercial/simple-image-gallery-pro

    

   UPGRADING

   Just upload the new version and it will overwrite the old one.

   For more help, please visit the updated documentation page for the extension at: https://www.joomlaworks.net/support/docs/simple-image-gallery-pro

   For support questions please use our Helpdesk system included in your Member Dashboard at https://www.joomlaworks.net/dashboard (active product membership required).

4. Joomla 3.x development continued to ensure code security & support modern PHP versions

   

   This may be of interest to existing Joomla 3.x users who cannot yet upgrade to newer Joomla releases for various reasons...

   We're continuing the development of an open distribution of Joomla 3.x (we call it Joomla 3.x UTD for now) to ensure code security and support modern PHP versions.

   The project is hosted on GitHub: https://github.com/joomlaworks/joomla-3.x

   First release of Joomla 3.x UTD, version 3.11, was uploaded on Monday, Apr 20th, 2026.

   Joomla 3.x UTD is currently compatible with PHP 7.1 and up to 8.5 and is tested with latest versions of MySQL (8.0 & 8.4 LTS) & MariaDB (10, 11 and 12) at the time of writing. As we roll newer releases, we will test against more recent versions of Postgres as well.

   Please note that the point of this project is to ensure Joomla 3.x works with new PHP & MySQL/MariaDB versions and remains secure, for those who still use it.

   As such, any contributions should focus towards that goal, as well as any bugs they may have existed in Joomla 3.x and which were never resolved due to the Joomla core team's change of focus to newer releases.

   This distribution is obviously a community project, not an official Joomla project.

   As always, thanks goes out to all the people who built and contributed to Joomla 3.x until its EOL date.

   Update on July 19th, 2026:

   We're continuing to roll out updates. The last one, v3.15, includes many security issues discovered in Joomla 5/6, backported to Joomla 3.x UTD, along with further improvements and bug fixes in Joomla 3.x.

5. K2 will not be made available for Joomla 4/5 - change of course

   

   The writing's on the wall. Joomla 4 and 5 are failed CMS releases.

   They account for around 0.3% of ALL Joomla sites according to W3Techs (https://w3techs.com/technologies/details/cm-joomla).

   Joomla's official stats (which were introduced near the end of life of Joomla 3 - https://developer.joomla.org/about/stats.html) are far less accurate obviously (e.g. they don't account for Joomla 1.5 > 2.5 sites or older Joomla 3 releases) but still show around 10% of sites use Joomla 4/5, after 3 years of their release. And these stats can be disabled by users of Joomla sites (most do).

   This means adoption for these versions is close to non-existent. A sad reality, but an understandable one (read my posts on May 30th at https://x.com/joomlaworks for additional context).

   There is literally nothing to say about how things have evolved for Joomla.

   At this rate, it will probably be a dead software project within the next couple of years.

   It's not just the users that are de-motivated, it's the developers too (the Joomla core developers). Few people will enjoy working on Joomla if no one uses it. It just makes sense.

   As such, and given that we're strongly invested in Joomla 3 (in some of the largest news/media site implementations worldwide with Joomla), we don't plan on giving up on K2 (or Joomla 3). In fact, our goal is to pivot and work on a possible fork, unless a miracle happens and the Joomla core team gets their shit together and works on a true/seamless Joomla 3 to Joomla 5 (or 6?) upgrade.

   The fork is a reasonable path for us for many reasons but I'd list the following ones here (for now):

   • It'll be exciting to go from K2 (a "half" CMS so to speak) to a full CMS. Any crap that didn't work or half-worked on J3 will be fixed.
   • Sky's the limit. Really. No stupid politics, irrelevant conventions, idiotic patterns to follow. We have a clear goal for K2 (and Joomla) and that's what we're gonna work on. That goal is a fast, reliable. modern CMS that leaves people asking "why WordPress?"
   • Some will nag Joomla 3 uses old code. No it doesn't. It uses a certain design that was popular at the time it was introduced. The only change that is required is for it to be updated so it catches up with PHP's latest versions (for the record, we actively run sites with Joomla 3 / K2 on PHP 8.2). It's a mature code base that can be gradually improved.
   • The fork could be introduced in 2 phases. Phase 1: A re-branding for existing sites to move over their content from com_content to K2 (far less work than switching to Joomla 4/5) and existing Joomla/K2 sites to freshen up their backend. Phase 2: This would be the part we lighten up the core. This means com_content & components like banners, newsfeeds, messages etc., their respective modules and plugins and generally other accumulated crap (like User Notes) that literally noone ever used will be stripped off Joomla. Either way K2 can reproduce most of these stuff far better.
   • Any design changes will be subtle and NOT affect existing Joomla extensions that respected the Joomla UI design. It will also certainly NOT affect extensions that brought in their own design/MVC and so on (think AcyMailing, page builders etc. etc.).
   • If our friend Ryan provides his blessing, we would also love to swap the current Joomla WYSIWYG editor with JCE Core. If not, it's always available either way. We will just upgrade TinyMCE and still install our beloved JCE. This would also be a good time to standardize things like "editor xtd" buttons in a way that they better integrate with the WYSIWYG editor...
   • Features and custom extensions we've used for large scale projects could be integrated in the new CMS, if it makes sense for most users to have. E.g. fast search powered by Elasticsearch is a no-brainer (and we can throw that Smart Search crap out for good).

   The point is to do something that's fun, while professional at the same time.

   Backward compatibility will be our holy grail. Anyone that tells it can't are either lazy or just plain bad programmers (hell, we've maintained K2 for Joomla 1.5 to 3 for 15 damn years).

   We're already in touch with partners to finance this move. On the long term, all we need is a couple of devs, working full time.

   The next big phase will be infrastructure as required for any modern CMS. That means rebuilding something like the JED, working on documenting use and code etc. At the same time, it's practical to keep everything to a minimum. E.g. there is no reason to use our own forum, but probably go for something like GitHub so we can have everything in a single place: code and discussion, coupled with solid anti-spam (cause let's face it, that's what forums suffer from these days).

   By keeping things lean and simple, we will work less on infrastructure and more on the CMS's code and features.

   If you ask "why now", I can respond with 2 things:

   1) There's been plenty of time for people to switch to Joomla 4/5. Very few did.

   2) It's MUCH worse waiting things out to chart their predefined course than actually fucking doing something about it, even if it fails or doesn't work out.

   Follow up blog posts will provide more insight into how things will play out in the coming months and how others can join this effort.

    

   P.S.

   If you have any questions, please use Twitter/X to communicate these to us (@joomlaworks).