I try to support all versions of phpwcms with security fixes if it can be easily backported. But it's recommend to update to a current version whenever possible.
On regular basis the following versions of phpwcms are supported:
| Version | Supported |
|---|---|
| >= 1.10.2 | ✅ |
| >= 1.9.38 | ✅ |
| < 1.9.38 | ❌ |
If you find a vulnerability you can report it by email to og@phpwcms.org.
Mostly I am ok with opening an issue if the vulnerability isn't accessible in the frontend of phpwcms.