We’ve been building Drupal websites since Drupal 6. We’ve worked through the big platform changes, the complicated migrations, and the upgrades that looked straightforward until a custom module had something to say about it. And that something to say was never anything good!
So when we talk about Drupal 10 reaching its end of life, we bring a little perspective and a clear recommendation: get your upgrade moving.
Drupal 10 officially reaches end of life on December 9, 2026. After that date, the Drupal project will stop releasing updates for Drupal 10, including security patches. If your business runs on Drupal 10, now is the time to make sure you have a plan.
What does “end of life” actually mean?
Your website won’t suddenly stop working on December 9. Visitors can still browse your pages, submit forms, and interact with your content. Look, we still have one of our favorite client's website running on Drupal 6. I dont mention the name, and they are well aware of the risks, but we cant stop using the analogy of the 2010 Honda Accord with 200k miles on it. It works and we'll deal with it if something happens. It's their choice and the consequences are understood.
What changes with the "end of life" designation is the support behind it. Once official security coverage ends, you can no longer count on Drupal 10 receiving fixes for newly discovered vulnerabilities.
That distinction matters. A website can look perfectly healthy while the software behind it becomes increasingly exposed. “Everything still works” tells you very little about whether everything is still secure.
Also, the December deadline doesn’t mean every older Drupal 10 release remains supported until then. Earlier minor versions have already lost security coverage, so staying current matters while you prepare for the major upgrade.
Drupal upgrades have come a long way
If your last Drupal upgrade involved a major rebuild, we understand why another version change might give you pause.
Since Drupal 8, the upgrade experience has moved closer to the continuity people have developing with WordPress: maintaining and evolving an existing website through successive releases. That said, anyone who worked through Drupal 8 to Drupal 9 knows there was often considerably more involved than clicking a few buttons.
Custom code, contributed modules, themes, and integrations still need attention. The complexity depends on what your website does and how consistently it has been maintained.
For a well-maintained Drupal 10 website, moving to Drupal 11 can generally build on your existing investment. Your upgrade assessment should establish what needs updating, what needs replacing, and what needs careful testing.
AI adds urgency to staying current
There has always been risk in running unsupported software. What’s changing is the speed and scale at which attackers can work.
AI can help malicious actors research vulnerabilities, develop attacks, and automate parts of their operations. The UK’s National Cyber Security Centre expects AI to increase threats against systems that haven’t received security fixes and further shorten the time between a vulnerability becoming public and attackers exploiting it.
For website owners, the practical takeaway is simple: the time available to react is getting tighter.
A strong security history is valuable, but keeping that protection requires ongoing maintenance. Planning your upgrade gives your team room to work before a deadline or security incident starts making decisions for you.
PHP2Shell is a reminder to look beyond Drupal
The recent PHP2Shell vulnerabilities reinforced another important point: website security extends beyond the CMS.
In October 2026, PHP released emergency security updates addressing two critical vulnerabilities that could allow attackers to execute code remotely without logging in. These issues affected the underlying PHP runtime—the software that powers Drupal and many other web applications.
That means a Drupal upgrade and a PHP security update are separate responsibilities. Moving to a newer Drupal version doesn’t, by itself, establish that your hosting environment has received the necessary PHP fixes.
Your maintenance plan needs to account for the whole environment: Drupal core, contributed modules, custom code, PHP, and the infrastructure supporting it.
A good upgrade starts with a good plan
At BigTuna Interactive, we approach upgrades with the same ownership mindset we bring to ongoing website management. We want to understand what your business depends on, address compatibility issues early, and give testing the attention it deserves.
An upgrade plan should cover:
- Readiness: Review modules, custom code, themes, integrations, and hosting requirements.
- Development: Complete the upgrade in a separate environment where changes can be reviewed.
- Quality assurance: Test the layouts, forms, permissions, editorial workflows, and business integrations your team relies on.
- Launch: Coordinate deployment, backups, rollback preparation, and checks after release.
A homepage loading successfully is only one part of the picture. Your sales inquiries still need to reach Salesforce. Your editors still need to publish content. Your customers still need to complete the tasks they came for.
Those details deserve deliberate testing.
Experienced developers. More capable QA.
We’re also using AI to strengthen how our team works, including our quality assurance process.
AI augmentation gives our experienced developers additional support during review and testing. We still own the decisions, evaluate the results, and remain accountable for the work.
Having built Drupal sites since Drupal 6, we know where experience makes a difference. Combining that experience with increasingly capable tools has made us more confident than ever in the quality of our upgrade process.
Get your Drupal 10 upgrade on the calendar
With December 9 approaching, your next step should be a clear assessment of your website and a realistic upgrade schedule.
The sooner you understand the work involved, the more control you have over the budget, testing, and launch.
Running Drupal 10? Let’s map out your upgrade. BigTuna Interactive can assess your site, identify the dependencies, and help you move forward with confidence.
