Drupal 10 End of Life Date, Risks and Next Steps

Drupal 10 reaches end of life on December 9, 2026, which is the same week that Drupal 12 is set to ship. That is the latest possible deadline and for most teams it is not the one that counts.

Your real cutoff depends on which minor version you run. Drupal 10.6.x is the only Drupal 10 line still getting security fixes, and that coverage ends the week of December 7, 2026. Sites on 10.5.x lost security support in June 2026. Sites on 10.4.x have been unsupported since December 2025. Those older sites are live and unpatched right now.

So, if you are an enterprise IT leader, digital director or an agency team on Drupal 10 and need a defensible plan to protect your website, this article is for you. We will discuss the real dates, what actually changes after end of life, a straight answer on moving to Drupal 11 versus waiting for Drupal 12, the infrastructure dependency check most teams skip and how to scope the upgrade.

When Drupal 10 actually reaches end of life 

Drupal 10 reaches end of life on December 9, 2026. After that date, Drupal's security team stops issuing advisories, patches and new core releases for the whole version. There will be no more fixes, even if a serious flaw shows up the very next day.

Right now, that one date is getting all the attention but it hides the part that matters more. Drupal ships a new major version every two years, and Drupal 10's end of life is timed to land the same week that Drupal 12 arrives. So, the version you are running today is following a shorter timeline of its own.

Each minor version gets about a year of coverage: roughly six months of normal bug-fix support until the next minor ships, then a further six months of security-only coverage. Two minor versions are security-supported at any one time, so the security clock on your version runs out when the release after next ships – not when the very next one does.

10.4.x stopped receiving security fixes in December 2025 and 10.5.x in mid-2026. Only 10.6.x still has coverage, and it runs out this December.

To find your version, run drush status from the command line and check the core version it reports. On a Pantheon site, open the Status Report in your dashboard for the same answer. You can confirm every date above against Drupal's official core release schedule.

The bottom line is, if your minor version has already lost support, the December headline is not your deadline. Your deadline passed months ago, and every day since has been unpatched time.

What happens to your site after December 9, 2026

Your Drupal 10 site keeps running after December 9, 2026. Pages still load, content still publishes and visitors notice nothing. What stops is security work from Drupal's core team. No more advisories, no more patches, no more fixes even when a real flaw turns up.

The problem is, the risk does not hit all at once. It builds. HeroDevs tracked what happened after Drupal 7 reached end of life and found that between two and six vulnerabilities per month kept surfacing in widely used contributed modules during the first year, many of them high severity. The site that felt fine in month one carries a longer list of open holes by month six, and none of them have an official fix.

For regulated organizations, the clock starts on day one. Frameworks like PCI DSS, HIPAA, GDPR, FedRAMP and SOC 2 expect software that is supported and patched on a documented schedule. Running an unsupported core makes that story hard to defend in an audit, even if nothing has gone wrong yet.

A managed platform softens some of this. Pantheon blocks a good share of common attacks at the infrastructure layer, so a Drupal 10 site there is better shielded than one on bare hosting. However, that just buys time. It does not replace the missing patches.

Third parties do sell extended security support for teams stuck mid-migration, covering core and contributed modules under a documented service level agreement. No Drupal 10 program has been announced yet, so treat paid coverage as a maybe, not a plan.

What’s important to remember is that waiting does not hold your risk steady. It raises it. Software keeps changing, and small updates done often take far less effort than one giant catch-up later. The sooner you move, the smaller the job.

Should you upgrade to Drupal 11 or wait for Drupal 12

Upgrade to Drupal 11 now. You cannot skip it. Drupal's upgrade policy requires moving through each major version in order, so there is no path that jumps straight from Drupal 10 to Drupal 12.

Important note: Deciding to wait for Drupal 12 does not remove the Drupal 11 step. It just leaves you less time to do it, since you still have to land on Drupal 11 on the way. Drupal 10 was built as the long-term support line that carries sites right up until Drupal 12 arrives, and the ride there runs through Drupal 11.

The old worry that Drupal 11 is too raw does not hold anymore. It launched on August 2, 2024, and has collected close to two years of patches and minor releases. By now the contributed module ecosystem has caught up, and the release line is well tested in production.

Moving to Drupal 11 is not a throwaway effort either. Drupal 11.0.0 shares the same public APIs and features as recent Drupal 10.3 releases, with the main difference being that old deprecated code was stripped out. The step from Drupal 11 to Drupal 12 is expected to work the same clean way.

Drupal 11 stays supported until Drupal 13 ships, following the same two-year rhythm. No Drupal 13 date is set yet, so read that as breathing room rather than a countdown.

Drupal 7 is a different case. There is no in-place upgrade from Drupal 7, so moving off it is a migration – a rebuild on a fresh site using the Migrate API – and that migration can target a current release directly, including Drupal 11. Some teams still migrate to Drupal 10 first as a more settled path, but landing on Drupal 10 before Drupal 11 is a choice, not a requirement.

How to plan your Drupal 10 to 11 upgrade

Planning a Drupal 10 to 11 upgrade starts with scoping, not code. The job at this stage is to find the blockers and size the work before anyone runs a command. For the step-by-step Composer walkthrough, Pantheon's guide on upgrading to Drupal 11 has the executable depth.

One prerequisite comes first. Your site must be on Drupal 10.3 or later before Drupal 11 will install, so make the core current before anything else.

The trap that stalls large projects is rarely the code. The upgrade stops moving because the corporate infrastructure team has not standardized on PHP 8.3 across older environments, and that sign-off can sit in a queue for weeks. File the dependency request with infrastructure at the earliest, before a developer even opens Composer.

Drupal 11 also raises the platform floor, requiring:

• PHP 8.3 or higher.
• MySQL 8.0 or higher, or MariaDB 10.6 or higher.
• PostgreSQL 16 if you run Postgres.

The full list of database, Symfony and frontend versions are available on the Drupal system requirements page.

Your first practical move is the Upgrade Status module. It scans the site and returns a per-module report that flags incompatible modules, deprecated API calls in custom code and environment gaps. Better still, run it inside your CI tooling so deprecations surface early and fold into normal sprints instead of one painful crunch near the deadline.

Then plan around the core modules pulled from Drupal 11, mentioned below. Each one needs a contributed replacement or a clean removal before you upgrade.

• Actions UI
• Activity Tracker
• Book
• Forum
• Statistics
• Tour

For contributed modules that work fine but have not formally declared Drupal 11 support, the Lenient Composer Plugin installs them without faking compatibility.

Pantheon’s Multidev can be especially useful here. It spins up an isolated branch environment that mirrors your live site (and can enforce a different PHP version requirement), so the Upgrade Status report and every trial run happen against a real clone rather than a rough local copy.

Managing Drupal upgrades across a portfolio of sites

Most upgrade advice assumes you run one site. Universities, agencies and government departments rarely do. The real challenge is 20, 50 or 200 sites all needing the same move to Drupal 11 inside the same window, and one-at-a-time simply does not fit the calendar.

The fix is to stop treating each site as its own project. With Upstreams, you maintain a single codebase template and push it out to every site that shares it. The Drupal 10 to 11 work happens once at the source and flows across the whole fleet, so you are not repeating the same steps two hundred times.

Testing scales the same way. Multidev gives each site an isolated staging environment that matches live, so you can run the upgrade and confirm it works before anything ships to visitors.

Autopilot keeps the fleet current in the meantime. Minor updates and security patches still have to land between now and your major upgrade, and Autopilot applies them with visual regression testing on every run, so nothing breaks quietly.

To be precise, though, Autopilot does not perform the Drupal 10 to 11 jump itself. That major upgrade stays a developer task through Composer. What Autopilot does is clear the routine maintenance off your team's plate so engineering hours go toward the major move instead of patch babysitting.

At Pantheon, this is a proven pattern, not a pitch. Explore how Perforce brought its multisite operations onto Pantheon to get outage and security risk under control at scale.

Is Drupal still the right choice for enterprise sites

Yes, Drupal 10 and 11 are still strong choices for enterprise sites. They handle the things large organizations actually need, including multi-site governance, complex content workflows at scale, fine-grained access control, enterprise multilingual support and integration with ERP and CRM systems. Two capabilities matter more every year. Role-based access control and structured content give Drupal a real edge as teams wire their sites into AI and headless setups, because clean, permissioned data is exactly what those systems feed on.

The usage data backs this up. Drupal holds roughly 6 to 7 percent share among the 10,000 highest-traffic websites, and W3Techs publishes ongoing comparison data on how Drupal and WordPress split by traffic tier.

For most teams, the math favors staying on Drupal. For a content-heavy enterprise site with custom workflows, a full move to WordPress, or another CMS, rarely costs less than a Drupal 10 to 11 upgrade. The calculus only shifts for simpler sites or teams whose real strength sits on another platform.

There is also a stability argument. Software-as-a-service content platforms get bought and reshaped on someone else's timeline, and the recent wave of consolidation among commercial CMS vendors is a reminder of that risk. Drupal stays open, free to license and under your control.

Here is where the question actually turns. Drupal stays the right choice as long as your infrastructure keeps pace with its release cycle. Teams that let every site drift two minor versions behind eventually decide the platform is too hard to maintain, but that is an operations problem, not a Drupal problem. Pantheon's Drupal hosting is built around keeping that lifecycle on track.

Planning your move off Drupal 10

The move off Drupal 10 gets easier the moment it stops being abstract. Here is what to do this week.

1. Confirm your current minor version. Run drush status or open the Status Report in your dashboard.
2. File a ticket with your infrastructure team to confirm PHP 8.3 and database version compliance, since that sign-off is the piece most likely to slow you down.
3. Install the Upgrade Status module and run the compatibility report so you know what stands between you and Drupal 11.
4. Set a target upgrade window well before December 9, 2026, and much sooner if you are on 10.5.x.

If your site is on 10.4.x or 10.5.x, you have already lost security support. Update to 10.6.x now as a stopgap to get patched again, then plan the Drupal 11 upgrade properly rather than rushing it.

Every week you wait adds unpatched time and makes the eventual jump heavier. Start the checklist today, and turn the December deadline into a plan instead of a scramble. If you would rather solve the operating model behind all of this and not just this one upgrade, see how Pantheon's Drupal hosting keeps the whole lifecycle on track.