For anyone responsible for a Drupal website
Drupal 10 stops getting security fixes on 9 December 2026
If your website runs on Drupal 10, this page explains what changes on that date, why it matters beyond the website itself, and what to do about it. It's written for the person who is responsible for the site rather than the person who builds it.
What happens on the day
Nothing visible. Your site will work on 10 December exactly as it did on 8 December.
What changes is behind the scenes. Drupal's security team publishes fixes for the versions it supports, and from 9 December 2026 Drupal 10 is no longer one of them. The next security hole found in Drupal will be fixed in Drupal 11 and left open in Drupal 10.
Security holes in Drupal are found regularly, and each one is published alongside its fix, so anyone looking for unpatched sites knows exactly what to try. That is why an unsupported site gets riskier every month, rather than staying at the level of risk it had on the day.
Why it matters beyond the website
Cyber Essentials. The scheme's requirements say that software no longer supported by its supplier must be upgraded, removed or isolated, and that high and critical security fixes must be applied within 14 days of release. From 9 December a Drupal 10 site fails the first test, and there are no fixes left to apply for the second. If your organisation holds the certificate, or needs it for a funder or a contract, the website becomes a line on the assessment.
Personal data. Most charity and membership sites hold some: member records, donor details, event bookings, a contact form. Running software with known, unfixed security holes on a site like that is a difficult position to defend if something goes wrong.
Your host and your PHP version. PHP 8.2, which many Drupal 10 sites run on, reaches its own end of life on 31 December 2026, and Drupal 11 needs PHP 8.3 or later. Hosts retire old PHP versions on their own schedule. In practice the Drupal upgrade and the PHP move happen together.
Find out which version you're on
Log in to your site as an administrator and go to Reports, then Status report. The Drupal version is the first line. Or ask whoever looks after the site; they'll know in seconds.
Drupal 11. You're fine. Drupal 11 is expected to stay supported until around the end of 2028. Keep the security updates going.
Drupal 10. You need to move to Drupal 11 before 9 December. On a well kept site that's a few weeks of work: updating or replacing contributed modules, fixing code that Drupal 11 no longer accepts, and moving to PHP 8.3.
Drupal 9 or 8. Those versions have been unsupported since 2023 and 2021. The same move applies, with more to fix on the way.
Drupal 7. Unsupported since January 2025, and there is no upgrade path: Drupal 7 to Drupal 11 is a rebuild. That is a bigger decision, and one where staying on Drupal is a genuine question rather than a given. Worth a conversation before you commit to anything.
What to do now
- Find out which version you're on, today.
- If it's Drupal 10, get the upgrade booked. The date is fixed and everyone with a Drupal 10 site is working to it, so the people who can do the work get booked up.
- Make sure security updates are being applied in the meantime. Drupal 10 gets fixes right up to the date, and a site that's behind on those is at risk today, not in December.
- Check your PHP version at the same time. If it's 8.2 or earlier, plan the move to 8.3 as part of the upgrade.
- If you hold Cyber Essentials, note the renewal date and make sure the upgrade lands before it.
How I can help
I've been building and looking after Drupal sites for UK charities, membership bodies and research organisations since 2009.
The upgrade. Send me the site's address and I'll tell you what the move to Drupal 11 involves and give you a fixed price for doing it. Most cost between £1,500 and £4,000, PHP move included.
Keeping it patched afterwards. A monthly care plan from £350 a site, so the next deadline never sneaks up on you.
Or just email me your site's address and I'll tell you which version it's on and whether there's anything to worry about, no charge and no follow up unless you want one: peter@peterbrady.co.uk
Sources
Drupal core release schedule: drupal.org. Cyber Essentials requirements for IT infrastructure: NCSC. PHP supported versions: php.net. Checked 23 September 2026.