Drupal 10 end of life falls on 9 December 2026. From that date drupal.org will make no new releases of Drupal 10, so security fixes for Drupal 10 core stop with it.
The same week brings the Drupal 12 release and the end of security support for Drupal 11.3, so a site upgrading now should aim for Drupal 11.4 or later. Drupal 12 is not an option yet, because the core upgrade path does not allow a jump from 10 straight to 12.
When is Drupal 10 end of life, and what sets the date?
Drupal 10 end of life is 9 December 2026, the date given on drupal.org's core release schedule, which was last updated on 27 August 2026. The date comes from a rule the project published in 2023: each major version is supported until two more major versions have been released, and Drupal 10 is followed by 11 and 12.
The release process overview attaches two conditions. A major version gets a minimum of four years, and it is supported only while the versions of its key dependencies are supported. Minor versions arrive approximately every six months, in June and December, and the December 2026 slot carries Drupal 12.0.0 and Drupal 11.5.0.
Drupal 10.6 is the last minor release of Drupal 10. Anything older is already uncovered. Drupal 10.5.x lost security support when Drupal 11.4.0 shipped in the week of 29 June 2026, and the Drupal 10.6.19 security release of 14 October 2026 states that 10.5.x and below "do not receive security coverage".
What the Drupal Security Team stops doing after 9 December 2026
The Drupal Security Team resolves reported security issues and publishes each one as a security advisory. Under its advisory policy, two core minor versions receive advisories at a time: the most recent minor and the one before it. Drupal 10.6 is covered on a separate date set by the release schedule, which ends its security support in the week of 7 December 2026 and allows no Drupal 10 release after 9 December, so a vulnerability found in Drupal 10 core after that date will get no fix from the project.
Contributed modules sit behind the same boundary. The same policy makes advisories only for issues affecting stable releases on "the supported major version branches", and project maintainers opt in to that coverage. Once Drupal 10 is unsupported, a module's Drupal 10 branch falls outside it. Any module you run as a dev, alpha, beta or release candidate was never covered, because the policy gives "no security advisories" for pre-releases at all.
Which Drupal 11 version should a Drupal 10 site upgrade to?
A Drupal 10 site should land on Drupal 11.4 or later. The release schedule ends security support for 11.3.x in the week of 7 December 2026, the same week as Drupal 10, so an upgrade that stops at 11.3 trades one unsupported version for another.
On 26 October 2026 the Drupal core releases page listed 11.4.11 as the newest Drupal 11 stable release, with 11.5.0 and 12.0.0 still in beta. The release schedule sets no end date for 11.4.x yet, so keeping cover after the upgrade means moving up minor versions as they ship. drupal.org's own guidance is that keeping up with minor core releases "is the best way to prepare for upgrading to a new major version".
Drupal 11 needs a newer platform than Drupal 10
The hosting stack has to move before the code does. Drupal.org publishes PHP requirements by minor version and database requirements by major version.
| Requirement | Drupal 10 | Drupal 11 | Drupal 12 |
|---|---|---|---|
| PHP | 8.1 to 8.4 (10.4 to 10.6) | 8.3 to 8.5 (11.3 and 11.4) | 8.5 (12.0) |
| MariaDB | 10.3.7 or later | 10.6 or later | 10.11 or later |
| MySQL | 5.7.8 or later | 8.0 or later | 8.0 or later |
| PostgreSQL | 12 or later | 16 or later | 18 or later |
| SQLite | 3.26 or later | 3.45 or later | 3.45 or later |
A Drupal 10 site on PHP 8.1 or 8.2 needs PHP 8.3 before it can run Drupal 11. PHP 8.2 has its own deadline, with security support from php.net ending on 31 December 2026, three weeks after Drupal 10. Drupal 10.6 already runs on PHP 8.3 and 8.4, so the PHP move can be done and tested on the current site before the core upgrade begins.
Web servers change less. Drupal requires Apache 2.4.7 or greater, or Nginx 1.1 or greater, and as of Drupal 11.0.0 it does not support Microsoft IIS. A site hosted on IIS has a hosting move inside its upgrade, which is the ground our piece on Drupal hosting for the public sector covers.
Sizing the upgrade with Upgrade Status and Drupal Rector
The Upgrade Status module reviews a site's readiness for the next major version, checking the environment and its components. It runs on the current Drupal 10 site against Drupal 11 only. The module and the core upgrade path both refuse to jump more than one major at a time, so a Drupal 10 site reaches 12 by way of 11.
According to drupal.org's guide to deprecation checking tools, Upgrade Status wraps drupal-check and scans both custom code and contributed projects from drupal.org. The same guide notes that some deprecated code can be replaced automatically with Drupal Rector, which automates code upgrades to Drupal 9, 10 and 11. For contributed projects, the Project Update Bot posts automated patches.
Whatever Rector cannot replace in custom modules and themes falls to a developer, and a site carrying years of bespoke code has more of it. Our piece on reducing technical debt without disrupting services covers how to clear that code in steps.
What LocalGov Drupal sites need before Drupal 11
The LocalGov Drupal documentation states that Drupal 11 is supported for LocalGov Drupal sites from release 4.0. LocalGov Drupal 4.0.0 was released on 17 March 2026, and the latest 4.x release on 26 October 2026 was 4.0.5, from 14 September 2026. A council cannot reach Drupal 11 on the 3.x line: the 4.x profile is the one that requires Drupal core 11, with PHP 8.3 or later.
The same documentation lists the prerequisites as PHP 8.3 or later, a compatible database such as MariaDB 10.6 or later, and Drush 13. The project's upgrade wiki says to run Upgrade Status beforehand. It expects warnings for Content Lock, Image Widget Crop and the LocalGov profile itself. LocalGov Microsites is a separate track with the same PHP 8.3 and MariaDB 10.6 minimum, so a council running microsites plans two upgrades.
We are a LocalGov Drupal certified supplier and have delivered Drupal sites for the London boroughs of Bexley, Lambeth and Merton. For the governance, patching and procurement checks that sit outside the Drupal 11 move, see what to verify before adopting LocalGov Drupal.
What to ask your supplier about the Drupal 11 upgrade
Put these questions in the requirement or the next service review.
- Core version. Which Drupal core minor are we on today? A strong answer is a version number checked that week. A weak one is "Drupal 10", since 10.5 and below already have no security coverage.
- Readiness report. What does Upgrade Status report against Drupal 11, and how many custom modules and themes does it flag? A strong answer is a dated report with counts. "It should be straightforward" is a weak one.
- Contributed modules. Which contributed modules have no stable Drupal 11 release, and what is the plan for each? Betas and dev releases get no advisories, so "we'll use the beta" needs a reason.
- Platform. Which PHP, database and web server versions does our hosting run, and when will each change? A strong answer names versions and dates against the table above.
- Target minor. Which Drupal 11 minor will we land on? The answer should be 11.4 or later.
- LocalGov. For LocalGov sites, when do we move to the 4.x profile and, where used, the Drupal 11 release of Microsites?
- Fallback. If the work cannot finish by 9 December 2026, what covers us, and who issues the fixes? Ask for that in writing.
- Next step. Is the work planned so that Drupal 12 follows as routine maintenance? Drupal 12.0 lists PHP 8.5 only, so the hosting plan should already show it.
If the upgrade will not finish by 9 December 2026
drupal.org publishes no extended support for Drupal 10. For Drupal 7, which reached end of life on 5 January 2025, the release schedule points to a resource centre for migration and long term support options. It describes nothing equivalent for Drupal 10.
Ask whether your supplier offers extended support. Any such arrangement is commercial and sits outside the Drupal Security Team, so the contract has to say who writes the fixes, which modules are covered, how fast a critical issue is patched and when the cover ends.
Moving to Drupal 10.6 restores core cover until December, and PHP 8.3 runs on both 10.6 and Drupal 11. Clearing Upgrade Status findings shortens whatever window remains. Plan the cutover with a rollback you have rehearsed, as set out in our piece on business continuity and disaster recovery for websites.
Before you reach Drupal 10 end of life
- Confirm the core minor on every Drupal site you own, and move anything below 10.6 now.
- Ask your host for the PHP and database versions in production, and book PHP 8.3 if the site is on 8.1 or 8.2.
- Run Upgrade Status against Drupal 11 and keep the dated report with the project papers.
- Set Drupal 11.4 or later as the target in writing, and add the LocalGov 4.x and Microsites moves if they apply.
- If 9 December 2026 is out of reach, get the fallback cover terms from your supplier in writing before the date.
Frequently asked questions
Will a Drupal 10 site stop working on 9 December 2026?
No. A Drupal 10 site keeps serving pages after end of life. What stops is the supply of fixes: drupal.org will make no new Drupal 10 releases after that date, so any vulnerability found later stays open on your site.
Can a Drupal 10 site skip Drupal 11 and go straight to Drupal 12?
No. The Upgrade Status project page states that jumping multiple major versions at once is supported neither by the module nor by the Drupal core upgrade path. A Drupal 10 site upgrades to 11 first, then to 12.
What PHP version does Drupal 11 need?
Drupal 11.3 and 11.4 support PHP 8.3, 8.4 and 8.5, according to drupal.org's PHP requirements. A Drupal 10 site on PHP 8.1 or 8.2 has to upgrade PHP first, and can do so while still on Drupal 10.6.
