--- title: "Drupal 10 end of life: upgrade to Drupal 11 before 9 December" description: "Drupal 10 reaches end of life on 9 December 2026, the same week Drupal 12 arrives. Here’s why your next move is Drupal 11, and why you need to start now." url: https://www.pivale.co/blog/drupal-10-end-of-life/ date: 2026-11-04 author: "Darren Fisher" tags: ["Advice", "Drupal", "Security & compliance", "Support & maintenance"] publisher: Pivale (https://www.pivale.co) --- # Drupal 10 end of life: upgrade to Drupal 11 before 9 December Quick question: is your website running Drupal 10? If the answer is "yes", "probably" or "erm, I'd have to ask someone", keep reading. Drupal 10 reaches end of life on **9 December 2026**. That's five weeks away, and right in the middle of Christmas party season. Not ideal timing, I know. [Book your Drupal 11 upgrade](https://www.pivale.co/contact/) ## What happens on 9 December? Your Drupal 10 site won't fall over at midnight. It'll still load, your editors will still log in and nobody will send you a sad email. What changes is that the Drupal Security Team stops releasing fixes for Drupal 10. From then on, when someone finds a vulnerability in Drupal 10 core, it stays open on your site. It gets worse over time, too. Contributed module maintainers will move their effort to Drupal 11 and 12, so the modules your site depends on will stop getting Drupal 10 releases. And if you hold personal data on your website (contact forms, accounts, orders), running software with no security support is a hard thing to defend under GDPR. ## In the age of AI, unsupported isn't an option A few years ago you could just about get away with running an old version of Drupal for a few months. Those days are over, and AI is the reason. AI has made finding security holes much cheaper and much faster. In the Drupal Association's own words, ["AI-assisted analysis is finding latent vulnerabilities at an accelerating pace"](https://www.drupal.org/association/blog/introducing-the-drupal-ai-security-initiative-the-first-six-weeks). The numbers back that up: [from June to October 2026, Drupal published 256 security advisories](https://alpha-omega.dev/blog/256-advisories-in-five-months-results-from-the-drupal-ai-security-initiative/) across core and contributed modules. That's more than 50 a month. It's so many that the Drupal Association set up a dedicated AI Security Initiative to help the volunteer Security Team keep up. Attackers have access to the same AI tools, and they read the same advisories. On a supported release, each advisory comes with a fix, ready for you to apply the same day. After 9 December, the advisories keep coming, but no fixes are released for Drupal 10, so the list of known holes on your site grows by the week. Being on an unsupported release really is no longer an option. ## The PHP flaw that made the BBC News If you want proof, last month delivered it. On 21 October, PHP (the programming language Drupal and a huge chunk of the web run on) got an emergency fix for two critical flaws, now known as PHP2Shell. It was serious enough to make the mainstream news: the BBC reported [websites being taken down worldwide](https://www.bbc.com/news/articles/cmly0lg3w5x2o) as cyber-security agencies told organisations that couldn't patch in time to take their sites offline. Finland temporarily shut down its government's public web services. The flaws were found by AI. Wiz, one of the security firms behind the discovery, called them the "most severe vulnerabilities ever discovered" by the technology. It matters for Drupal 10 sites in particular. Fixes went out for PHP 8.2, 8.3, 8.4 and 8.5, but [older, end-of-life versions such as PHP 8.1 only got source-code patches](https://en.wikipedia.org/wiki/PHP2Shell), with no official releases. Drupal 10 can still run on PHP 8.1. Drupal 11 needs PHP 8.3 or newer, so upgrading moves you onto a supported PHP version too. Two birds, one stone. ## Drupal 12 arrives the same week To make December even more exciting, [Drupal 12.0.0 is scheduled for the week of 7 December 2026](https://www.drupal.org/about/core/policies/core-release-cycles/schedule), alongside Drupal 11.5.0. So you might be tempted to skip a version and jump straight from 10 to 12. Please don't. A brand new major release of Drupal core is only half the story. Your site also runs on contributed modules, and in our experience it takes three to six months for most of them to catch up with a new major version. If you upgrade on day one, you'll likely find there are a lot of gaps. That's why we don't move clients to a new major release straight away. Drupal 11 is the stable, well-supported place to be right now: Drupal 11 keeps getting security releases after Drupal 12 arrives, with 11.4.x supported until 21 April 2027 and 11.5 released alongside Drupal 12. ## What a Drupal 10 to 11 upgrade involves The good news: going from Drupal 10 to 11 happens in place. If you remember the leap from Drupal 7, relax. Your content, users and configuration stay where they are, and the work is in what sits around them: 1. **Check your hosting.** Drupal 11 needs a newer stack than Drupal 10, starting with PHP 8.3 or newer, so your server may need updating first. 2. **Audit your modules.** We run [Upgrade Status](https://www.drupal.org/project/upgrade_status) to see which contributed modules have a Drupal 11 release, which need updating and which have been abandoned and need replacing. 3. **Fix your custom code.** Drupal deprecates old APIs before it removes them, so any custom modules and themes need their deprecated code updated. [Drupal Rector](https://www.drupal.org/project/rector) handles a lot of this automatically, and a developer handles the rest. 4. **Test, then upgrade.** We run the whole upgrade on a copy of your site first, test it properly, then switch it over when you're happy. How long that takes depends on how much custom code and how many contributed modules your site has. That's why you shouldn't leave it until the week of 7 December. ## And then Drupal 12 Once your site is on Drupal 11, Drupal 12 stops being a deadline and becomes a plan. When the contributed modules your site relies on are stable on Drupal 12, we audit your custom code for deprecations and anything worth optimising along the way, then upgrade you. Drupal 12 needs [PHP 8.5](https://www.drupal.org/docs/getting-started/system-requirements/php-requirements), so we check your hosting again too. No panic, no Christmas party disasters. ## Don't leave it until December If your site is on Drupal 10 and you don't have an upgrade booked, now's the time. With security releases coming this thick and fast, every week on an unsupported release is a week of known holes left open. Talk to one of our friendly experts, with no obligation: we'll tell you what your upgrade involves and how quickly we can do it. We've been building on Drupal since 2008, our whole team is in-house and UK-based, and we'd much rather help you upgrade now than help you clean up later. [Book your Drupal 11 upgrade](https://www.pivale.co/contact/) Not sure what's under the bonnet? Our [website systems audit](https://www.pivale.co/services/audits/#website-systems-audit) finds your Drupal version, custom code, modules and integrations, and what each one needs. And once you're upgraded, a [support plan](https://www.pivale.co/services/support/) applies security updates weekly or fortnightly, checked against each new advisory, so you don't face this cliff edge again. --- Source: https://www.pivale.co/blog/drupal-10-end-of-life/. Pivale is a UK digital consultancy. Book a 30-minute call at https://www.pivale.co/contact/ or email hello@pivale.co.