Drupal Cuts Security Support for Minor Releases to Eight Months: The New End Dates

Drupal security support for each core minor release is dropping from 12 months to 8. The Drupal Security Team announced the change on Monday, November 2, 2026, in PSA-2026-11-02. Drupal 11.4 now loses coverage in April 2027, not June.

The change matters most to sites that take one minor update a year. That habit worked under the old rule. Now a site has to take each minor release, about every six months. If it does not, it loses Drupal security support.

The short version: each core minor now gets six months of bug fixes, then two months of security fixes only. Drupal 11.4 is covered until April 21, 2027. Drupal 12.0 and 11.5 are covered until August 2027. Major versions still get at least four years. Plan for two minor updates a year, and budget for them.

This post covers what the PSA says and gives a table of end dates. It explains what the change means for maintenance plans. It ends with the November 4 advisory batch, which shows how busy the Security Team is. All dates are as of the morning of November 5, 2026.

What the PSA says about Drupal security support

Drupal’s PSA says each minor release has been supported "for 12 months each since the release of Drupal 8.6 in 2018," and the old schedule is now being phased out. "Each minor version will have six months of bugfix support followed by two months of security-only support," the PSA says.

The last minor of each major version gets longer. "The final minor version for each major receives six months of bugfix support followed by six months of security support," according to the PSA.

Drupal’s release process overview has already been updated to match. "Each minor version is supported for eight months, with bug and security fixes for the first six months, and security fixes only for the last two months," the overview now reads.

Major versions keep their long window. The PSA says "major versions of Drupal core will still be supported for at least four years," so Drupal security support for a major is unchanged.

Why Drupal says it made the change

The PSA gives the volume of incoming reports as the main reason. It says Drupal is facing a "tsunami" of security reports, which it ties to the spread of AI tools. It says that volume is more work than the Security Team can sustain at its current level of funding.

The PSA also names the risk of slow fixes. Delays give "more time for malicious actors armed with LLMs to find attacks," it says.

Fewer supported branches means fewer places to apply each fix. The PSA says the change cuts "backport work for core security advisories by 30%." It also points to other benefits, "such as better alignment with Symfony upstream releases."

We covered the earlier side of this story in our post on how the Drupal AI Security Initiative made finding bugs cheap. The new PSA is about the workload that came after.

Drupal security support end dates under the new rule

The table lists Drupal security support end dates from the PSA and Drupal’s core release schedule. Release months for future versions are scheduled, not final.

Drupal 11.4 is a transition case. "Drupal 11.4 (released June 2026) will be supported until April 2027 while the old schedule is being phased out," the PSA says. The schedule page gives the exact day as April 21, 2027 (UTC).

One page has not caught up. The Drupal 11.4.11 release notes still say "Drupal 11.4.x will receive security coverage until June 2027," which is now out of date. Plan for April 21. The PSA and the schedule are newer.

Drupal 12.0 and 11.5 "will be supported until August 2027," per the PSA. Drupal 12.1 and 11.6 get the same eight months, ending February 2028.

What eight months means in practice

Drupal ships a new minor about every six months, in June and December on the current schedule. With 12 months of coverage, a site could skip a minor and update once a year. Our reading of the new dates is that this no longer works.

Take Drupal 12.0. It ships the week of December 7, 2026, and its Drupal security support ends in August 2027. Drupal 12.1 is scheduled for the week of June 14, 2027. That leaves about two months to move from 12.0 to 12.1 before coverage ends.

So the practical rule is simple. To keep Drupal security support, take every minor update, within a couple of months of its release. Sites on a once-a-year cycle will spend part of each year without security fixes.

Staying on the latest minor matters more now. Security fixes go to supported branches only. A site one minor behind has a short runway. A site two minors behind is unsupported.

Composer constraints need a look. Your composer.json may pin drupal/core-recommended to one minor. Then routine updates stop at that minor’s last patch. Use a constraint that lets you move to the next minor on purpose, then test it.

Contrib modules follow core. Each core minor can bring deprecations that modules need to handle. Check that your key modules support the next minor before you schedule the update.

Budget and maintenance planning for agencies and site owners

For associations, nonprofits and universities, shorter Drupal security support is mostly a planning change. A minor update is far smaller than a major upgrade. But it is still a release to test, and now there are two a year.

These steps help.

• Put two minor updates a year in the plan. June and December releases point to update windows around July and January. The deadline is two months after each release.
• Check support contracts. If an agency or host maintains your site, confirm the agreement covers two core minor updates a year.
• Keep a staging copy current. Testing goes faster when a copy of the live site is ready.
• Write down your test list. Logins, forms, dues and donation pages, search and editor workflows are common. Reuse the list every six months.
• Track the Drupal 11 end date. Drupal 11 is supported until December 2028. Plan the Drupal 12 upgrade well before that.

Release dates can move while support deadlines stay put. Our Drupal 12 beta slip post covers one recent case.

The November 4 advisories show the pace

Two days after the PSA, on November 4, 2026, Drupal published 24 module advisories. That count comes from drupal.org’s contributed project advisory list. Nine are rated Critical. Fourteen are Moderately critical and one is Less critical. These are module advisories, not core, but they show the volume the Security Team is handling.

Here are the nine Critical advisories. Fixed versions come from each advisory page.

• Simple OAuth (OAuth2) & OpenID Connect, access bypass. SA-CONTRIB-2026-296 lists 6.1.4, 6.0.10 and 5.2.6.
• REST & JSON API Authentication for Drupal, access bypass. SA-CONTRIB-2026-298 lists 3.2.1.
• Content Synchronizer, remote code execution. Fixed in 4.1.1.
• GroupEx PRO (Daxko) integration, PHP object injection. Fixed in 2.2.1.
• Commerce Product Alternative, access bypass. Fixed in 1.0.1.
• Highlight Js syntax highlighter, cross-site scripting. Fixed in 1.3.1.
• Workflow Notifications, access bypass. Fixed in 3.0.3.
• S3 File System CORS Upload, access bypass. Fixed in 8.x-1.3.
• Reset Password Email/SMS OTP, access bypass. Fixed in 1.0.5.

Several common modules were in the batch at a lower rating. Scheduler, Mime Mail and Forum Access are each rated Moderately critical. Their advisories list Scheduler 8.x-1.7, 2.2.3 and 2.3.1, Mime Mail 2.0.4 and Forum Access 2.0.3.

Module updates follow the steps in our October 7 advisory triage post. Check which listed modules you run, update the Critical ones first, then the rest. Our CVSS guide explains the risk scores. Our Drupal Commerce post shows what happens when attackers move before sites update.

Frequently Asked Questions