Drupal 10 reaches end of life on December 9, 2026. After that date, the Drupal Security Team stops publishing fixes for any Drupal 10 release. As of late October 2026, that is about seven weeks away, and Drupal 12.0 ships the same week.
Updated October 23, 2026: adds what the October 2026 PHP security flaws (php2shell) mean for Drupal 10 sites. The October 21 update added the time left before the deadline, a Drupal 10 vs 11 comparison, and what to do if you can't finish in time.
Key takeaways
- Drupal 10 end of life: December 9, 2026. No extension has been announced.
- Patch PHP now. Two critical PHP flaws disclosed October 21, 2026 are being exploited, and PHP 8.1, the Drupal 10 minimum, gets no official fix.
- Drupal 10.5.x already lost security support in June 2026. Only 10.6.x is covered until the end.
- The practical move is Drupal 11, not Drupal 12. Drupal 12.0 ships the week of December 7, too late to plan around.
- If you haven't started, an upgrade can still land before the deadline on a clean site. Complex sites need a plan for running past it safely.
If you'd rather hand this off, see our Drupal migration and upgrade services.
How long will Drupal 10 be supported?
Drupal 10 is supported until December 9, 2026, and only on its last minor release, 10.6.x. Support already ended for older Drupal 10 releases:
| Drupal release | Security support ends |
|---|---|
| Drupal 10.4.x | December 2025 (ended) |
| Drupal 10.5.x | June 2026 (ended) |
| Drupal 10.6.x | December 9, 2026 |
| Drupal 11.3.x | Week of December 7, 2026 |
| Drupal 11 (latest minor) | Until Drupal 13 ships (no date set) |
The same week Drupal 10 ends, Drupal 12.0.0 and Drupal 11.5.0 are released. These dates come from the Drupal core release schedule, and unlike Drupal 7, nothing suggests they will move.
If your site is still on 10.5.x or older, it is already running without security fixes. Updating to 10.6.x is the first job, even before you plan the Drupal 11 upgrade.
October 2026: patch PHP before anything else
On October 21, 2026, PHP disclosed two critical flaws, CVE-2026-109618 and CVE-2026-109619, known as php2shell. They let an attacker run code on a server without logging in, attacks are already happening, and the researchers who found them say they confirmed attacks against specific versions of Drupal, WordPress, Joomla and Magento. US and European cyber agencies have asked for immediate patching (CISA alert).
| PHP branch | Fixed in |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 8.1 | No official release |
This matters for Drupal 10 because PHP 8.1 is its minimum version, and many Drupal 10 sites still run on it. If yours does, move to PHP 8.3 (8.3.36 or later) now. Drupal 10.6 runs on PHP 8.3 and Drupal 11 requires it, so this one change fixes today's risk and gets part of the upgrade done.
If your host installs PHP from Linux distribution packages, the version number may not match the table. Ask your host directly whether the php2shell fix is applied. Firewall rules from your CDN help while you patch, but they don't replace the patch.
Drupal 10 vs Drupal 11: what changes
For most sites, Drupal 11 is an evolution of Drupal 10, not a rebuild. The work is in the platform requirements and in code that relied on deprecated APIs.
| Drupal 10 | Drupal 11 | |
|---|---|---|
| Minimum PHP | 8.1 | 8.3 |
| Symfony | 6 | 7 |
| Databases | MySQL 5.7+, MariaDB 10.3+, PostgreSQL 12+ | MySQL 8.0+, MariaDB 10.6+, PostgreSQL 16+ |
| Upgrade path | Must reach 10.3 or later first | Installed from Drupal 10.3 or later |
| Deprecated APIs | Still available, with warnings | Removed |
| Security support | Ends December 9, 2026 | Continues until Drupal 13 |
What this means in practice: your hosting must run PHP 8.3, every contrib module needs a Drupal 11 compatible release (or a replacement), and custom modules must stop using APIs that Drupal 10 marked as deprecated.
How to upgrade from Drupal 10 to Drupal 11
The steps are the same for every site. What varies is how long each one takes.
- Update to Drupal 10.6.x. This keeps you covered until December 9 and is the required base for a smooth upgrade.
- Run a compatibility audit. Install the Upgrade Status module, list every contrib module with its Drupal 11 status, and review custom modules by hand. The module catches most deprecated code, but not all of it.
- Fix the platform now. Move hosting to a patched PHP 8.3 (8.3.36 or later) and check your database version against the table above. After the October 2026 PHP flaws, this can't wait for the audit to finish.
- Update contrib, then custom code. Bring modules to their Drupal 11 compatible releases, replace abandoned ones, and fix deprecated API calls in your own code.
- Upgrade core in staging. Run the upgrade on a copy of the site, run your regression tests, and plan for at least one round of fixes.
- Go live with a buffer. Aim for production at least two weeks before December 9, so stabilization doesn't overlap the deadline week.
How long it takes: sites with a clean codebase and well-maintained modules usually need 4 to 8 weeks. Sites with many custom modules or an older PHP stack often need 3 to 5 months. If you are starting in late October, step 2 tells you which group you are in.
If you can't finish by December 9
Many teams starting now won't make it on a complex site, and that is a risk to manage, not a reason to panic. A sensible plan:
- Patch PHP first. Run PHP 8.3.36 or later (see above). Nothing else on this list helps much on an unpatched server.
- Get to 10.6.x now, so you are fully patched on the day support ends.
- Start the audit anyway. A dated upgrade plan matters to your security and compliance teams even if go-live falls in January.
- Reduce exposure while you finish. Remove unused modules, keep contrib updated where releases still appear, and tighten your web application firewall rules.
- Ask your host about extended support. Some vendors have sold paid security coverage for past Drupal versions. As of this update, none has announced a program for Drupal 10, so don't plan around one.
For regulated industries (healthcare, government, finance), running unsupported software is also a compliance question. Bring your security team in early rather than after the deadline passes.
Should you wait for Drupal 12?
No. Drupal 12.0.0 ships the week of December 7, 2026, two days before Drupal 10 ends. That leaves no time to check contrib compatibility or test a migration before the deadline. Drupal 11 is stable, supported until Drupal 13, and the upgrade from Drupal 10 is the shorter and better documented path. You can move to Drupal 12 later, on your own schedule.
Still on Drupal 7?
Drupal 7 reached its end of life in January 2025, so a Drupal 7 site has gone longer without fixes than any Drupal 10 site will. Moving from Drupal 7 is a migration, not an upgrade: content and configuration are moved into a new Drupal 10 or 11 site. See our Drupal 7 end of life guide and the lessons from a high-traffic Drupal 7 to Drupal 11 project.
Frequently asked questions
When is Drupal 10 end of life?
December 9, 2026. After that date, no security fixes are published for any Drupal 10 release. Drupal 10.6.x is the only Drupal 10 version supported until then.
Is Drupal 10 still supported?
Yes, until December 9, 2026, but only on version 10.6.x. Drupal 10.5.x and older releases already lost security support.
What is the difference between Drupal 10 and Drupal 11?
Drupal 11 requires PHP 8.3 and Symfony 7, needs newer database versions, and removes APIs that Drupal 10 deprecated. For most sites the upgrade is about updating modules and custom code, not rebuilding the site.
How do I upgrade from Drupal 10 to Drupal 11?
Update to Drupal 10.6.x, audit contrib and custom code with the Upgrade Status module, move hosting to PHP 8.3, update modules and code, then upgrade core in staging before going live. The full steps are above.
Can I skip Drupal 11 and go straight to Drupal 12?
Not before the deadline. Drupal 12.0 ships the week of December 7, 2026, which leaves no time to evaluate and test it. Upgrade to Drupal 11 now and move to Drupal 12 later.
Does the October 2026 PHP vulnerability affect Drupal 10 sites?
Yes, if the server runs an unpatched PHP version. Update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later. PHP 8.1 has no official fix, so sites on it should move to PHP 8.3, which Drupal 10.6 supports and Drupal 11 requires.
How long does a Drupal 10 to 11 upgrade take?
Usually 4 to 8 weeks for a clean site, and 3 to 5 months for sites with many custom modules or an outdated PHP stack.
Talk to a team that has done this before
weKnow has worked on Drupal since 2009 and is the top Drupal contributor in Latin America. If you are looking at this deadline and unsure where to start, we'll review your setup and tell you honestly what we'd do, whether or not you hire us. Write to yes@weknowinc.com or see our Drupal migration and upgrade services.