Still moving in 2026. WordPress (7.1), Drupal (11.4.5), Joomla (6.1.3), TYPO3 (14.3.6), Craft CMS (5.10.14), ProcessWire (3.0.258), SilverStripe (6.2.4), Concrete CMS (9.5.2, renamed from concrete5 back in 2021), Backdrop, ModX, Textpattern, Winter CMS, e107, ExpressionEngine, BigTree, UNA and ZenPhoto have all shipped code this year. CMS Made Simple and PHP-Fusion are slower but not stopped.
Check these three before you commit. b2evolution last released 7.2.5 in September 2022 and its repository has not moved since. PHP-Nuke has had nothing but a dependency bump since 2022. Geeklog still gets the odd commit but has not tagged a release since September 2022, which is activity without a release schedule. All three still install and will still run; none is where a new site should start. Craft CMS is the odd one out in a different way: Solo is free, but Pro is a paid per-project licence with a yearly fee for continued updates, which surprises people who assumed everything on this page was free.
What actually breaks. PHP memory, nearly every time. Page builders and image resizing exhaust it long before CPU becomes the problem, so we run 256MB or higher, cron every minute so scheduled publishing fires, and free wildcard SSL from install. Not for you if nobody owns the update job. An unpatched CMS on any host, this one included, is a matter of when.