The Drupal 10 deadline is December 9, 2026. On that date Drupal 10 reaches end of life and stops getting security fixes. As of October 14, that is eight weeks away.
This post is for executive directors and board members at associations and nonprofits. It covers what ends, what keeps working, what the risk is and what to ask your web vendor. It ends with a short brief you can paste into a board packet.
The short version: your website will not switch off on December 9. It will stop getting security fixes. The fix is an upgrade to Drupal 11, and there is no shortcut to Drupal 12. Ask your vendor for a written plan with dates this month, and have the board approve it by October 30.
We explained the deadline for developers in what Drupal 10 end of life means for your site. This version is for the people who approve the work and answer for the risk.
What ends on December 9, and what keeps working
Drupal’s core release schedule states it in one line: "Drupal 10 will reach end of life on December 9, 2026."
Here is what that means in practice.
- The site keeps running. Pages load. Staff can log in and edit. Forms still take submissions.
- Security fixes stop. When a new flaw is found in Drupal 10, there will be no update for it.
- Many add-ons stop too. Some add-on modules tie their own support to Drupal 10’s end of life.
- Nothing visible changes on December 10. The risk builds with each advisory published after that date.
That last point is why the Drupal 10 deadline is easy to put off. Nobody will notice anything on the day. The site will look fine while it falls further behind.
The current Drupal 10 release is 10.6.18, published September 26, 2026. Its release page says 10.6.x gets security support until December 2026. There is no later Drupal 10 branch to move to.
The risk after the Drupal 10 deadline: an advisory with no fix
Here is a concrete example. Webform is the add-on that runs most contact, membership, event and donation forms on Drupal sites.
On September 23, 2026, Webform released security fixes in versions 6.2.12 and 6.3.1. We walked through them in our plain-language Webform advisory guide. Any site on a supported version could install the update and close the problem.
Now look at what the Webform project page says about the 6.2.x line, the one many Drupal 10 sites use: "This branch will receive security support until the Drupal 10 EOL."
So the next time Webform has a serious flaw after December 9, a Drupal 10 site on 6.2.x may have no update to install. The flaw will be public. The fix will exist only for supported versions.
That is the risk to describe to a board: a published weakness in your donation or membership forms that you cannot patch. The site will still look normal.
There is one useful detail here for your vendor. The Webform 6.3.x line works with Drupal 10.3 and later and with Drupal 11. Moving Webform to 6.3 can be one early step in the upgrade.
Drupal 12 slipping does not move the Drupal 10 deadline
Some boards have heard "wait for Drupal 12 and upgrade once." That plan does not hold up.
Drupal 12 was first expected in June 2026, then August. We covered those misses in Drupal 12 has missed three windows. Each time, the Drupal 10 deadline stayed put.
As of October 2026, drupal.org lists a Drupal 12 beta, released September 30. The schedule now plans Drupal 12 for the week of December 7. That is the same week Drupal 10 ends.
Even if Drupal 12 ships on time, it does not help a Drupal 10 site. The next section explains why.
Why you cannot go from Drupal 10 straight to Drupal 12
Drupal 12 will not accept an upgrade from Drupal 10. The Drupal 12 beta release notes say so directly: "Sites should always update to the latest release of Drupal 11 prior to updating to Drupal 12."
The same notes say Drupal’s update system "will refuse to update from Drupal 11.2 or earlier." A Drupal 10 site is further back than that.
In plain terms, every Drupal 10 site has to become a Drupal 11 site first. Waiting for Drupal 12 leaves less time for a step you cannot skip.
The path runs through Drupal 11
The useful question for your vendor is which Drupal 11 version to land on. Drupal 11 has several branches, and they end at different times.
| Version | Latest release, as of October 2026 | Security coverage per drupal.org |
|---|---|---|
| Drupal 10.6.x | 10.6.18, September 26 | Until December 2026 (end of life December 9) |
| Drupal 11.3.x | 11.3.18, September 28 | Until December 2026 |
| Drupal 11.4.x | 11.4.8, September 26 | Until June 2027 |
| Drupal 12 | 12.0.0-beta1, September 30 | Not yet released; planned for the week of December 7 |
Two things stand out. First, Drupal 11.3 ends at the same time as Drupal 10. Landing there buys almost nothing past the Drupal 10 deadline. Second, the Drupal 11.4.8 release page says 11.4.x is covered until June 2027.
So the target is the latest Drupal 11 release, which today means 11.4. That also sets you up for Drupal 12 later, on its own schedule. Our Drupal 10 to 11 upgrade guide covers the technical steps for your team.
These dates move as new releases come out. Ask your vendor to check them on drupal.org the week you sign off.
What to ask your vendor before the Drupal 10 deadline
Most associations run Drupal through an agency or a part-time developer. Your role is to see the plan and hold the vendor to its dates.
Ask for these four things in writing:
- A written plan. Which Drupal 11 version you will land on, and who does each part of the work.
- Dates. When testing starts, when the upgrade goes live, and how much time is left before December 9.
- A module inventory. Every add-on the site uses, whether it has a Drupal 11 version, and what replaces any that do not.
- Testing of key forms. Donate, join or renew, register, apply and contact, tested on the upgraded site before it goes live.
Vendors build the inventory with a free tool called Upgrade Status. It checks a site’s add-ons, custom code and server setup for problems with the next major version of Drupal. Ask for its report. It is the quickest way to see how much work is in front of you.
A vendor who has started will have most of this already. A vendor who has not will need a week or two to produce it. Either answer tells you something.
A decision the board can make by October 30
The board’s decision is about risk and timing. It can be one line, made at the next meeting or by email vote.
By October 30, 2026, the board approves a written Drupal 11 upgrade plan with a go-live date before December 9.
If the vendor says the work cannot finish in time, the board still decides. In that case, the motion records that the organization accepts the risk of an unsupported site for a set period, and sets a firm finish date. Either way, the choice is on the record and owned.
October 30 leaves about six weeks for the work. That is tight for a site with many add-ons or custom code. It is also why the decision should not wait until the Drupal 10 deadline is a week away.
For what the Drupal community is planning next, see our DrupalCon Rotterdam 2026 coverage.
The one-page Drupal 10 deadline brief
Copy this list into your board packet. Fill in the bracketed items with your vendor.
- The Drupal 10 deadline: Drupal 10, the software our website runs on, reaches end of life on December 9, 2026.
- What keeps working: The site stays online. Pages, logins and forms keep working.
- What stops: Security fixes. New flaws found after December 9 will have no update for Drupal 10.
- Why it matters to us: Our donation, membership and event forms run on add-ons whose support ends with Drupal 10, including Webform 6.2.x.
- What does not help: Waiting for Drupal 12. A Drupal 10 site cannot upgrade straight to Drupal 12.
- What we need to do: Upgrade to the latest Drupal 11 release, currently 11.4, which is covered until June 2027.
- Our current version: [Drupal version from vendor]
- Vendor plan: Written plan, dates, module inventory and form testing, due [date].
- Planned go-live: [date, before December 9, 2026]
- Decision requested: Approve the Drupal 11 upgrade plan by October 30, 2026.
Frequently Asked Questions
What is the Drupal 10 deadline?
December 9, 2026. On that date Drupal 10 reaches end of life, and Drupal stops releasing security fixes for it.
Will our website stop working on December 9?
No. The site stays online, and pages, logins and forms keep working. What stops is security fixes for new problems.
What is the real risk of staying on Drupal 10?
The next security advisory may have no fix for your site. Webform 6.2.x, used on many Drupal 10 sites, gets security support only until Drupal 10’s end of life.
Drupal 12 is due in December. Can we wait and upgrade once?
No. Drupal 12 requires a recent Drupal 11 release first. A Drupal 10 site has to move to Drupal 11 either way, and Drupal 10 support ends December 9 regardless.
Which version of Drupal 11 should we move to?
The latest Drupal 11 release, which is 11.4 as of October 2026. Drupal.org lists 11.4.x security coverage until June 2027. Drupal 11.3.x ends in December 2026, like Drupal 10.
How do we find out which version we run?
Ask your vendor. If you have admin access, the Reports section has an Available updates page that lists the Drupal version and add-on versions.
What should we ask our web vendor for?
A written plan, dates, a module inventory and testing of your key forms. Ask for the Upgrade Status report, which shows which add-ons and custom code need work.
What will the upgrade cost?
It depends on how many add-ons and how much custom code your site has. Ask your vendor for a quote tied to the module inventory, with the testing included.
What if the upgrade cannot finish by December 9?
Have the board record that it accepts the risk for a set period, and set a firm finish date. Ask the vendor to watch Drupal security advisories closely until the upgrade is live.
