Drupal security support is getting shorter

Drupal announced last night that from 2027 each minor version of core (11.4, 11.5 etc) will only get 8 months of security support versus the 12 months it had previously.

The reason is AI. Lots of people are now pointing AI tools at open source code looking for security holes, and the Drupal Security Team is getting far more reports than it can deal with. This is affecting all open source projects, not just Drupal.

What's changing

A new minor version comes out every six months, in June and December. Each one now gets six months of bug fixes and then two months of security fixes only. So when a new minor comes out you've got about two months to get onto it. Before, it was more like six.

Here are the dates that matter:

Major versions aren't affected. Drupal 11 is still supported until December 2028 and Drupal 12 until December 2030.

What it means if you have a Drupal site

You can't really leave a Drupal site alone for long any more. Skip an upgrade or two and quite quickly you'll be running a version that isn't getting security fixes.

If you're on Drupal 10 it's more pressing, as that runs out of support in December.

What to do

Check what version you're on (Reports > Status report in the admin). If it's Drupal 10 or 11.3, get an upgrade booked before December. If it's 11.4 you've got until April. After that, plan on two upgrades a year, one early in the year and one in late summer.

If someone else looks after your site, it's worth checking their support covers this.

We do this routinely for our clients anyway, so for them not much changes. But if you've got a Drupal site that's fallen a bit behind, we're happy to help :)

Source: Drupal.org PSA-2026-11-02