What Actually Happens When Drupal 10 Reaches End of Life

Drupal 10 reaches end of life on December 9, 2026. On December 10, your Drupal 10 site will load exactly as it did the day before. Editors will log in, pages will publish and forms will submit. Nothing switches off.

That's the part that catches people out. End of life isn't an outage. It's the day the safety net comes down: from then on, nobody upstream is watching Drupal 10 for you. According to the official Drupal core release schedule, no new releases of Drupal 10 will be made after that date. Drupal 10.6 is the last minor release, and its security support ends the same week Drupal 12 is scheduled to ship.

Drupal 10 is the most widely used version of Drupal today. We counted more than 112,000 live Drupal 10 sites in October 2026, including more than 9,600 in the top million websites (see Drupal 10 by the numbers). Here's what the date actually changes for the site, for the people who maintain it, and for two sectors with more at stake than most: universities and government.

What it means for the site itself

Day one: nothing visible. The site keeps running on the code it already has. There's no kill switch, no license expiry and no warning banner for your visitors.

The first new vulnerability is the real deadline. Drupal core and its contributed modules get security fixes regularly. After December 9, when the Drupal Security Team finds and fixes a flaw in Drupal 11 or 12, it won't ship a Drupal 10 patch. Worse, the advisory for the supported versions tells attackers exactly where to look. If the same flaw exists in Drupal 10, every Drupal 10 site is now exposed to a published bug with no published fix.

Modules start to drift. Most sites rely on dozens of contributed modules. As maintainers add Drupal 12 support, many will drop Drupal 10 from their supported versions. New fixes and features land on releases that need Drupal 11 or newer, so a Drupal 10 site slowly loses the ability to update its modules at all, including for security.

The hosting underneath moves on. PHP, databases and server software keep releasing new versions and retiring old ones. Drupal 10 won't get compatibility fixes for what comes next, so at some point your host's upgrades and your site's code stop lining up. That usually surfaces as a sudden, urgent problem rather than a planned one.

Scanners and auditors will flag it. Vulnerability scanners, cyber insurance questionnaires and vendor-risk reviews check for end-of-life software. A Drupal 10 site after December 9 will show up in those reports whether or not anything has gone wrong yet.

What it means for developers and engineers

If you're the person who gets the call when something breaks, December 9 changes your job in a few specific ways.

You become the security team. Today, the Drupal Security Team reviews reports, coordinates fixes and publishes advisories. After end of life, nobody does that for Drupal 10. Every new advisory for Drupal 11 or 12 becomes a question you have to answer yourself: does this affect our Drupal 10 code, and can we backport the fix safely?

Composer gets harder, not easier. As contributed modules raise their minimum to Drupal 11, composer update starts holding packages back or failing to resolve. Pinning old versions keeps the build green but freezes the site in place, along with any bugs those versions carry.

The upgrade path is one step at a time. Drupal major upgrades go one version at a time, so a Drupal 10 site moves to Drupal 11 first, and only then to Drupal 12. The 10 to 11 step is small by Drupal standards: the same architecture, mostly module updates and cleanup of deprecated code. The Upgrade Status module tells you what's not ready, and tools like Drupal Rector can automate a lot of the code changes. But custom modules, custom themes and abandoned contributed modules are where the hours go. Our guide to upgrading Drupal 10 to Drupal 12 walks through both steps.

Plan for the platform, not just the code. A modern Drupal upgrade also touches PHP versions, Composer workflows, CI pipelines and hosting configuration. If your deployment process is fragile, the upgrade will find it.

Expect the unplanned work to land on you. When an auditor flags the site or a vulnerability goes public, the timeline stops being yours to set. The engineers who start the upgrade before December 9 choose the schedule. The ones who wait get handed one.

What it means for universities

Higher education runs a lot of Drupal, and a lot of it is on Drupal 10. In our October 2026 scan of 3,571 US college and university homepages, 519 ran Drupal, and 263 of those were on Drupal 10. Add the schools already on Drupal 7, 8 or 9, and 296 college homepages, 57% of the Drupal homepages we found, will be on unsupported versions after December 9. Among R1 research universities, it's 26 of the 50 Drupal homepages.

Those are homepages only, so they're a floor. Campuses rarely run one site. Departments, labs, centers, admissions microsites and event sites often run their own Drupal installs, sometimes on their own schedules. Our research on Drupal 7 in higher education found that nearly 9 in 10 higher-ed Drupal 7 sites were subdomains, not main websites. Drupal 10 is likely to follow the same pattern: the homepage gets upgraded on time, while the sites underneath it quietly fall out of support.

That matters because those sites sit under the university's name and often share its single sign-on and network. Education has one of the higher average breach costs, at $3.80 million according to IBM's Cost of a Data Breach Report 2025, as compiled by IncidentCost.com. And university budget cycles move slowly. If the upgrade isn't already funded, the time to raise it is before the next budget closes, not after an audit finding.

For a deeper look at how end of life plays out on campus, including where unsupported sites hide and what they cost, read our higher education research.

What it means for government agencies

For government, unsupported software on a public website isn't a gray area. CISA lists the use of end-of-life software first among its cybersecurity bad practices, calling it "especially egregious in technologies accessible from the Internet" (CISA). Public websites are internet-facing by definition.

There's an irony in the timing. Many agencies moved off Drupal 7 onto Drupal 10 in the last few years. In our research on Drupal 7 in US government, for example, we found the District of Columbia partway through moving its sites to Drupal 10. Teams that finished a large migration recently now face a second deadline on the platform they just moved to. The good news is that this step is far smaller: Drupal 10 to 11 is an update, not a rebuild.

The challenge in government is rarely the code. It's the process. Upgrades often need a change request, a security review, an updated system authorization or a procurement, and each of those runs on its own clock. An agency that starts now can fit the work into an existing contract or maintenance budget. One that waits for an audit finding or an incident usually ends up paying emergency rates from whatever budget can absorb it, often communications or digital services.

Our government research covers how this played out with Drupal 7: 428 US government sites still running it 21 months after end of life, from the federal courts to city and county websites. Drupal 10 doesn't have to follow the same path.

Your options before (and after) December 9

• Upgrade to Drupal 11 now, then plan the step to Drupal 12. For most sites, this is the shortest and cheapest path.
• Retire what you don't need. Old campaign sites, finished programs and forgotten staging copies don't need upgrading. Archiving them or taking them down removes the risk outright.
• Reconsider the platform if Drupal no longer fits how your team works. A migration to another CMS is a bigger project, but end of life is a natural time to ask the question.
• Put a maintenance plan in place so the next deadline doesn't arrive as a surprise. See Drupal support and maintenance.

Get a second set of eyes on your next steps

Even strong in-house teams benefit from an outside view before a deadline like this one. Is the upgrade really as small as it looks? Which modules will block it? Are there sites on the network nobody has counted? Should this be an upgrade, a cleanup or a bigger rethink?

The right next step depends on your site, your team and your budget, and there's no one-size-fits-all answer. That's where a partner who has guided hundreds of organizations through Drupal upgrades, migrations and end-of-life deadlines can help: someone who has seen what goes wrong and knows how to plan around it. Tell us about your site and we'll help you figure out the best path forward.

Frequently asked questions

Sources

• Drupal.org, Drupal core release schedule
• Drupal.org, Upgrade Status module
• CISA, Bad Practices
• IncidentCost.com (cites IBM Cost of a Data Breach Report 2025)
• Drupal End of Life research: October 2026 scan of 3,571 US college and university homepages (IPEDS directory), and live Drupal version counts