Drupal 10 reaches end of life on 9 December 2026. After that date, the Drupal Security Team stops publishing security releases for it. If your organization's website runs on Drupal 10, it needs to be on Drupal 11 by December 2026, or as soon after as possible.
Here is what end of life means for a running website, why waiting for Drupal 12 does not help, and how to plan the upgrade.
What happens to a Drupal 10 site after end of life
Your site won't switch off on 10 December. It will keep serving pages as it did the day before. What changes is everything around it:
- No more security fixes. When a new vulnerability is found in Drupal core, it gets fixed for supported versions. A fix for Drupal 10 would be an exception, not something you can plan on. Your site most likely keeps the hole, and the fix for newer versions effectively tells attackers where to look.
- Contributed modules move on. Contributed modules (the community-built add-ons most Drupal sites depend on for things like SEO, forms, and media) drop Drupal 10 support over time. Bug fixes and security fixes for them land on Drupal 11 and later.
- Compliance gets harder. Security frameworks and audits such as ISO 27001, SOC 2, or PCI DSS generally expect software to be supported and patched. "We run an unsupported CMS" is a finding you'll have to explain.
- Hosting gets narrower. Hosting providers phase out old PHP versions on their own schedules. A site that can't run on a current PHP version eventually runs out of places to live, or ends up on a "legacy" plan.
None of this happens overnight, but the risk and the cost of upgrading grow every month.
Why you can't skip straight to Drupal 12
Drupal 12 is released the same week Drupal 10 reaches end of life: the week of 7 December 2026. It's tempting to wait and do one big jump. Drupal doesn't allow that.
Drupal's upgrade path goes through every major version: 10 → 11 → 12. Each major release removes the database update code of the versions before it. Drupal 12 only contains updates from Drupal 11.3 onward, so a site has to be on Drupal 11.3 or later before it can move to 12.
Waiting for Drupal 12 means doing the Drupal 11 upgrade anyway, later. The good news: from a recent, updated Drupal 11 release, the step to 12 is much smaller.
Why security updates matter more now
Running an unpatched CMS was always risky. Several things have made it riskier.
Attackers move fast after disclosure. This isn't new for Drupal. In 2014, after a critical SQL injection fix in Drupal 7 (known as "Drupalgeddon"), the Drupal Security Team reported that automated attacks began compromising unpatched sites within hours of the announcement. What's changed is that this speed is now the norm across the industry. Mandiant's analysis of 2023 vulnerabilities found the average time-to-exploit dropped to five days, down from 32 days in the previous period.
Most web traffic is now automated. According to the 2025 Imperva Bad Bot Report, bots made up 51% of all web traffic in 2024, and malicious bots alone accounted for 37%. The report links the growth to generative AI, which makes it cheaper and easier to build and run attack tooling at scale.
Fingerprinting is cheap. Automated scanners routinely identify which CMS and version a site runs, then try the exploits known to work against it. They don't need to be interested in your organization specifically. They only need your site to match a known weakness.
The October 2026 PHP vulnerabilities are a recent example. The critical PHP flaws patched on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619) are a good reminder of why keeping your website up to date matters. Sites already on a current version could patch within hours, with minimal changes and no downtime. Sites running older versions faced a much harder choice: a rushed multi-version upgrade, a custom workaround, or staying exposed.
The practical conclusion is simple: on a supported version, the window between "vulnerability published" and "your site is patched" can be hours. On an unsupported version, there is no fix you can count on to close it.
What the upgrade actually involves
For most well-maintained sites, a Drupal 10 to 11 upgrade isn't a rebuild. Your content, design, and structure stay. The work is about making sure the code underneath is ready.
The checklist
- Get to Drupal 10.3 or later. Drupal 11 requires a site to be on Drupal 10.3.0 or higher before upgrading. Sites on 10.0 to 10.2 have a preliminary step.
- Audit contributed modules. Check that every module you use has a Drupal 11 compatible release. The Upgrade Status module reports this automatically. Modules without a Drupal 11 version need a replacement, a patch, or removal.
- Fix deprecated code in custom modules and themes. "Deprecated" code is code that still works in Drupal 10 but is removed in Drupal 11. Drupal Rector can fix a large share of it automatically; the rest is manual work.
- Check the platform. Drupal 11 requires PHP 8.3 or later and runs on Symfony 7 (the PHP framework Drupal is built on). Database minimums go up too: MySQL 8.0, MariaDB 10.6, PostgreSQL 16, or SQLite 3.45. Your hosting may need an update before the code does.
- Test. Run the upgrade on a copy of the site first, then test the journeys that matter: forms, search, logins, integrations, and editorial workflows. Automated tests make this much faster and safer.
- Deploy and monitor. Keep a rollback path and watch logs in the days after release.
Not sure where your site stands? Marzee has worked with Drupal for more than a decade. We can audit your site and tell you what the upgrade involves. See the Drupal 10 to 11 upgrade: what it includes, the two packages and how it works. Want to talk about your Drupal site? Get in touch.
Three common scenarios and the right move for each
1. A well-maintained site on Drupal 10.3 or later
Core and modules are updated regularly, custom code is limited, and the hosting runs a recent PHP version.
The right move: run Upgrade Status, fix what it flags, upgrade, and test. This is the smoothest path, and there is no good reason to leave it close to the deadline. Once you're on Drupal 11, keep updating minor releases so the later move to Drupal 12 stays small.
2. A site with many custom modules
The site does a lot of specific things, often built years ago by different people. Some contributed modules may be abandoned.
The right move: start with an audit. List every custom and contributed module, decide what to keep, replace, or remove, and estimate the work before committing to a date. Some custom code can often be replaced by a contributed module or by core functionality, leaving less to maintain.
3. A site still on Drupal 10.0–10.2, or with no active maintainer
Updates haven't been applied for a while, or the agency or developer who built it is no longer around.
The right move: treat this as two projects. First, bring the site up to the latest Drupal 10 release and get it into a maintainable state: working development environment, version control, backups. Then upgrade to Drupal 11. Skipping the first step is how upgrades go over budget.
Still on Drupal 9, 8 or 7?
If your site runs on an older version, it's already unsupported. Drupal 9 reached end of life on 1 November 2023, Drupal 8 on 17 November 2021, and Drupal 7 on 5 January 2025. These sites haven't received community security releases since those dates.
The path forward depends on the version. Sites on Drupal 8 or 9 can be upgraded: they move through Drupal 10 and then to Drupal 11, one major version at a time. Drupal 7 is different. Its architecture is not compatible with modern Drupal, so it requires a migration: content is moved into a new Drupal 11 site, and the functionality and theme are rebuilt.
In every case, the recommended first step is the same: an audit, so you know exactly what you have and what it will take before choosing a plan.
What you get beyond "not being insecure"
Security is the reason you have to upgrade. It's not the only reason you'll be glad you did.
- Recipes. Recipes are packaged sets of configuration (for example, a blog, an events section, or SEO setup) that can be applied to a site in one step. They first appeared in Drupal 10.3 and are central to how Drupal is developing on version 11. For site owners, this means common features can be added faster and more consistently.
- Single Directory Components. A way of building the site's design as self-contained components, each with its markup, styles, and scripts in one place. It makes front-end work easier to maintain and reuse across pages.
- Drupal CMS. Drupal CMS is a ready-to-use version of Drupal aimed at marketers and content teams, with sensible defaults, AI-assisted tools, and a friendlier editing experience. It is built on Drupal 11, so being on 11 keeps that ecosystem within reach.
- A modern platform. PHP 8.3 and Symfony 7 bring performance improvements and longer support windows from the platforms Drupal depends on. Drupal 11 also continues the core performance work started in Drupal 10.
How Marzee can help
Marzee has been building with Drupal and contributing to its community since 2012, for international organizations such as the ILO, NGOs, and business associations. We were named among the Top Clutch Drupal Developers in 2024.
We can audit your site, give you a clear scope and plan for the Drupal 11 upgrade, and carry it out with you. Whether your site is in good shape or has been left alone for a while, we'll tell you honestly what it needs.
See the Drupal 10 to 11 upgrade: what it includes, the two packages and how it works.
Contact us to talk about your Drupal site, or see our services.