The Q4 2026 Platform Calendar: The CMS, PHP, .NET and Browser Dates Agencies Need Before January

The busiest week on the Q4 2026 platform calendar is December 7: WordPress 7.2 and Drupal 12 are both scheduled to ship, and Drupal 10 reaches end of life on December 9. Around that week sit .NET 8 and 9 ending November 10, Umbraco 13 ending December 14 and PHP 8.2 losing security support on December 31.

Most agencies track these dates one platform at a time. Account managers need them in one place, in order, with a note on which dates are fixed and which can still move. This piece gives that platform calendar as three monthly tables, then a short section per platform on what to do this quarter. Every date was checked on the vendor’s own page on September 29, 2026.

The short version: treat end-of-life dates on the platform calendar as fixed and release dates as plans. Drupal 10, .NET 8, Umbraco 13 and PHP 8.2 all end on published dates, and none of those depends on a release shipping. WordPress 7.2, Drupal 12 and PHP 8.6 are scheduled, and Drupal 12 has already slipped once. Book the end-of-life work in October. Hold the new-version work loosely until the release candidates land.

How to read this platform calendar

Each row on the platform calendar carries one of two labels.

• Confirmed: a published end-of-life or end-of-support date from the vendor’s lifecycle page. These rarely move.
• Scheduled: a release plan from a project’s roadmap or schedule. Release teams say these can change, and some already have.

The source column links the page each date came from. Browser releases are listed as scheduled because both Google and Mozilla publish them as plans. The Microsoft rows cover the lifecycle dates most likely to touch a small nonprofit, association or school office.

Dates run from October 13, the day this post publishes, to December 31. Recurring security release windows for Drupal are covered in the Drupal section rather than the tables.

October on the platform calendar

November on the platform calendar

December on the platform calendar

Drupal: Drupal 10 ends December 9, and Drupal 12 is still a plan

Drupal 10’s end of life is the firmest date on this platform calendar. The Drupal core release schedule says Drupal 10 "will reach end of life on December 9, 2026," the same week Drupal 12 is due. Security support for 10.6.x and 11.3.x ends that week as well.

Drupal 12 is less certain. The schedule page, last updated August 27, still lists beta 1 for the week of September 14. As of September 29, drupal.org’s release list showed 12.0.0-alpha1 and no beta. We covered the missed windows in our post on the Drupal 12 release slip. The key point from that post holds: Drupal 10’s end date did not move with Drupal 12.

Drupal ships security releases on the third Wednesday of each month. In this quarter that means October 21, November 18 and December 16. December 16 is the first window after Drupal 10’s end of life.

What Drupal agencies should do this quarter

• List every Drupal 10 site and give each an upgrade date before December 9. Our Drupal 10 end-of-life explainer covers what the date means for each site.
• Move to 11.4, not 11.3. Security support for 11.3.x ends the week of December 7.
• Check PHP first. The Drupal PHP requirements page lists PHP 8.3 to 8.5 for Drupal 11. A Drupal 10 site on PHP 8.2 needs a PHP upgrade before or with the core upgrade.
• Use a checklist. Our Drupal 10 to 11 upgrade guide walks through the module audit and deprecation checks.

Plan Drupal 12 testing for the release candidate in the week of November 9, if it ships on time. The PHP requirements page lists PHP 8.5 for Drupal 12, with PHP 8.6 support still under review.

WordPress 7.2: beta October 20, release planned for December 9

The WordPress 7.2 development page lists Beta 1 for October 20 to 22 and RC1 for November 17 to 19. It lists the final release for December 8 to 10. Three more betas and two more release candidates fall in between.

The call for volunteers in August named Wednesday, December 9 as the proposed release day. It also said "all dates are subject to change based on development progress." The September roadmap post says only that 7.2 is set for "early December 2026."

WordPress minor and security releases do not follow this schedule. They can land in any week.

What to do this quarter:

• Test Beta 1 on staging copies of your most customized client sites in late October. Plugin conflicts found in beta are cheaper than ones found in December.
• Hold the upgrade until after the holidays for sites with year-end giving or registration traffic. A December 9 major release lands in the heaviest weeks for many nonprofits.
• Check PHP. WordPress recommends PHP 8.3 or greater. It still runs on 7.4, which the same page describes as end of life.

For context on the last major, see what actually shipped in WordPress 7.1.

Joomla: security fixes only for 5.x from October 13

Joomla 5 bug fixes end on October 13, the same day Joomla 6.2.0 is scheduled. The Joomla roadmap keeps security fixes for 5.x running to October 12, 2027. Joomla 6.2.1 is scheduled for November 24.

Nothing breaks on a Joomla 5 site on October 13. The site simply stops getting fixes for ordinary bugs. Our Joomla 5 support post covers the dates in detail and gives an upgrade plan.

For this quarter, the useful Joomla work is an extension inventory and a PHP check on each host.

PHP: 8.6 ships November 19, and 8.2 ends December 31

Two PHP dates land six weeks apart. The PHP 8.6 release timetable lists general availability on November 19, after RC4 on October 22 and RC5 on November 5. The timetable notes that RC1 was skipped.

The PHP supported versions page sets December 31, 2026 as the end of security support for PHP 8.2. The same day, PHP 8.4 leaves active support. It keeps security fixes until December 31, 2028.

For most client sites, the practical target this quarter is PHP 8.3 or 8.4. Moving to 8.6 in its first weeks is rarely worth the risk on a production CMS. Our PHP 8.6 overview lists the deprecations that will need attention when you do.

The WordPress side is slower. Notes from a WordCamp US PHP discussion say PHP 7.4 still runs on roughly 18% of sites. No new WordPress minimum was decided.

.NET 8 and Umbraco 13 end five weeks apart

The .NET support policy ends support for .NET 8 and .NET 9 on November 10, 2026. .NET 10 is the current LTS release, supported until November 14, 2028.

Umbraco 13 follows on December 14. The Umbraco support timeline gives the same date for the end of its security phase and its end of life. Umbraco’s version 13 requirements list .NET 8.0.

That order matters on the platform calendar. From November 10 to December 14, an Umbraco 13 site on .NET 8 runs on a runtime Microsoft no longer patches. Umbraco still supports the CMS during that stretch.

Umbraco lists three paths off version 13: upgrade to 17 LTS or later, rebuild on 17 LTS or later, or buy Extended Long-Term Support (XLTS) in 6, 12 or 24 month terms. Umbraco 17 runs on .NET 10 and is supported until November 27, 2028.

What to do this quarter: find every client app on .NET 8 or 9, including Azure Functions still on the in-process model. Microsoft ends that model on the same November 10 date. For Umbraco 13 sites, pick a path in October. An upgrade that starts in December will not finish before the deadline.

Chrome and Firefox now ship every two weeks

Both browsers moved to two-week major releases in September. Google’s announcement started the new cadence with Chrome 153 on September 8. Extended Stable stays on its eight-week cycle. Mozilla started with Firefox 155 on September 1, and its support blog post says the change does not mean twice as many features.

Chrome’s part of the platform calendar has one gap. Chrome 159 is due December 8, three weeks after Chrome 158. Chrome 160 follows on January 5, 2027.

Two contract clauses need a look. A "latest two versions" browser support promise now covers about a month of releases, not two. Version-pinned QA matrices go stale twice as fast. Our browser engines guide argues for testing by engine rather than by version, which suits the faster cadence.

Firefox ESR 140 is already done. Its last scheduled update was 140.17 on September 29, as covered in our Firefox ESR 140 post.

Node.js: a new LTS line on October 28

Node.js 26 enters Active LTS on October 28, per the Node.js release schedule. Node.js 24 moves to maintenance on October 20 and reaches end of life on April 30, 2028. Node.js 22 is in maintenance until April 30, 2027.

This mostly touches build pipelines for themes, headless front ends and block development. The project is also changing how it numbers and supports releases, which we explained in our Node.js release model post. A reasonable target this quarter is Node.js 24 in CI, with a test run on 26 once it reaches LTS.

Microsoft dates that reach small organizations

October 13 is the heaviest Microsoft day on the platform calendar. Office 2021 and Windows 11 Home and Pro 24H2 both end, which we covered in our post on the October 13 Office and Windows dates. The same day, Windows 10 2016 LTSB ends and Windows Server 2012 and 2012 R2 lose Extended Security Update Year 3.

November 10 ends servicing for Windows 11 Enterprise and Education 23H2. Schools and universities on managed Education editions should check which version their fleet runs.

Windows 10 consumer ESU is not a Q4 date. Microsoft’s Windows 10 ESU page now says the program runs until October 12, 2027.

Exchange Online SMTP AUTH: check your contact forms

Many CMS sites send form and notification mail through smtp.office365.com with a username and password. That is Basic authentication for SMTP AUTH.

Microsoft’s updated timeline, posted to the Exchange Team blog in January, sets three steps. Behavior is unchanged through December 2026. At the end of December, Basic authentication for SMTP AUTH is turned off by default for existing tenants, and admins can turn it back on. New tenants created after December will not have it by default. Microsoft plans to announce a final removal date in the second half of 2027.

Those dates come from Microsoft’s message center post MC786329, updated January 27, 2026. Microsoft has not named an exact day, so the platform calendar lists it as end of December.

What to do this quarter:

• Find the sites that send through Microsoft 365: check SMTP plugin and module settings for smtp.office365.com.
• Move them to OAuth where the plugin or module supports it, or to a transactional mail service.
• Test a form submission after the change, and again in early January.

This is the second Microsoft sign-in change on our radar this year, after the SMS MFA retirement.

Frequently Asked Questions