Statamic 5 security countdown: fixes stop in December 2026

Just a heads up, Statamic's support policy lists December 2026 as the last month of security fixes for Statamic 5. After December, the only way to keep getting updates is to move to Statamic 6.

Staying covered until December

Statamic 5 still gets security fixes until the end of December, but they only protect your site once they're installed. The simple rule is to stay on the latest Statamic 5 release.

What changes after December 2026?

Your site won't stop working when the fixes end. What changes is that new vulnerabilities found in Statamic 5 won't be fixed.

Once a fix is published, the details are public, so a site that never gets the fix becomes an easier target over time.

Statamic 3 and 4 are already past this point; their security fixes stopped in 2024. This isn't unique to Statamic. Every content management system stops supporting older versions eventually.

If your website is on an unsupported version of Statamic, make the upgrade a priority.

How many sites are still on Statamic 5?

In early October 2026, roughly a quarter of Statamic installs on Packagist were still on version 5, so if that's you, you're not alone. Packagist counts installs rather than websites, so treat that as a rough guide.

How to check your Statamic version

There are two ways to find it.

1. In the Control Panel (CP), open Tools > Updates.

2. On the server, run php please --version in the site's folder.

What to do before December 2026

1. Update to the latest Statamic 5 release. It stays within version 5, so it's a smaller job than an upgrade.

2. Plan the move to Statamic 6. A Statamic upgrade takes your site from Statamic 5 to the current release. Doing it before December means there's no gap in security fixes.

3. Keep it updated afterwards. Statamic 6 has a new release most weeks, and being on version 6 isn't enough on its own.

If you're not sure where your site stands, install Sentinel. It's a free Statamic addon that checks Statamic and the hundreds of packages it relies on against public advisories, flags versions that are out of date, and emails you a status report.

Once you're on Statamic 6, my website maintenance plan keeps it updated every month, with a report after each update showing what changed.