
During the latest release of Joomla! 3.6.1 an issue emerged because of a security fix. 3.6.1 introduced a CSRF token check to the Joomla! Update component as an extra level of security to fix a Medium Level security issue. 3.6.0 down to 2.5.4 (every Joomla! release with the update component) will hit an issue with failing to pass the CSRF token check because those versions don't generate the needed token to pass the check.
Therefore we have had to make some emergency decisions:
Unfortunately there was a bug when updating Joomla! 2.5.x to 3.6.0 - this was patched in the 3.6.1 release - however as this migration is no longer possible - you will need to first migrate to Joomla! 3.5.1 then upgrade to 3.6.0. Then follow the steps below for users on Joomla! 3.6.0.
Update to Joomla! 3.6.0 through the Joomla! Update component. Then follow the steps below for users on Joomla! 3.6.0.
Update the Joomla! Update Component through the Extension Manager. (In the administrator part of your website (example.com/administrator), go to Extensions -> Manage -> update. It might be that you have to clear the update cache before the component is shown, if the necessary update still doesn’t show up, go to Update Sites and click Rebuild.)
Then use the Joomla! Update component ( components -> Joomla! Update) to update to the latest 3.6.x version.

Joomla! 3.6.1 is now available. This is a security release for the 3.x series of Joomla. This release fixes several low level security issues. We strongly encourage you update your sites.
IMPORTANT: PLEASE READ THIS ANNOUNCEMENT ABOUT THE 3.6.1 UPDATE PROCESS

Version 3.6.1 also addresses several issues:
Thanks to the hard work of 46 different volunteer contributors, more than 500 code commits, addressing nearly 150 issues, were made for the 3.6.1 release.
See the list of fixed GitHub issues for details of the tracker items fixed.
For known issues with the 3.6.1 release, see the Version 3.6.1 FAQ in the documentation site.
The Production Leadership Team's goal is to continue to provide regular, frequent updates to the Joomla! Community. Learn more about Joomla! development at the Joomla! Developer Network.

The Joomla! Project and the Production Leadership Team are proud to announce the release of Joomla! 3.6 as the latest in the 3.x series.
Joomla! 3.6 introduces more than 400 improvements, including many features which make administration of Joomla! Web sites easier and more feature-rich, as well as many UX (user experience) improvements.
Joomla! 3 is the latest major release of the Joomla! CMS, with 3.6 the seventh standard-term support release in this series. Please note that going from 3.5 to 3.6 is a one-click update and is not a migration. The same is true for any subsequent versions in the 3 series of the CMS.
Here are some highlights of the 3.6 release:

The Joomla! Project is pleased to announce the availability of Joomla! CMS 3.6 Release Candidate 2. Community members are asked to download and install the package in order to provide quality assurance for the forthcoming 3.6 release.
Joomla! 3 is the latest major release of the Joomla! CMS, with 3.6 the seventh standard-term support release in this series. Please note that going from 3.5 to 3.6 is a one-click upgrade and is NOT a migration. The same is true is for any subsequent versions in the 3 series of the CMS. That being said, please do not upgrade any of your production sites to the release candidate version as release candidate is ONLY intended for testing and there is no upgrade path from a Release Candidate.

The Joomla! Project is pleased to announce the availability of Joomla! CMS 3.6 Release Candidate. Community members are asked to download and install the package in order to provide quality assurance for the forthcoming 3.6 release.
Joomla! 3 is the latest major release of the Joomla! CMS, with 3.6 the seventh standard-term support release in this series. Please note that going from 3.5 to 3.6 is a one-click upgrade and is NOT a migration. The same is true is for any subsequent versions in the 3 series of the CMS. That being said, please do not upgrade any of your production sites to the release candidate version as release candidate is ONLY intended for testing and there is no upgrade path from a Release Candidate.