NEWS
February 24, 2025
The dates: Drupal 7 support ended 5 January 2025. Drupal 10 end of life on 9 December 2026 lands in the same release window as Drupal 12 and Drupal 11.5. Drupal 10 sites cannot upgrade straight to Drupal 12. Drupal 11 is the next supported step. For teams on either legacy version, 2026 is a deadline year, not a planning year.
For most CTOs, Q4 is a rush to the finish line: closing budgets, freezing code for the holidays, and planning next year's roadmap.
In 2026, that quarter is carrying more than it can hold. Drupal 10's end of life, the Drupal 12 release, and the Drupal 11.5 release all land inside the same week in December. Add the annual holiday code freeze at most enterprises and the predictable Q4 spike in agency demand, and the last quarter of the year is the worst available window for a migration that has to complete before the deadline rather than after it. If you need to migrate Drupal before then, start now.
What Does Waiting to Migrate Drupal Cost?
Waiting costs budget, staff time, and leverage. All three grow each month instead of showing up as one bill in December. Four costs build whether or not anything breaks.
The Innovation Tax
Industry research shows that enterprises spend between 60% and 80% of their IT budgets maintaining old systems. That leaves as little as 20 cents of every dollar for new work, new features, or a stronger market edge. Every month on a legacy Drupal version deepens that gap.
The Talent Gap
Senior Drupal architects are in short supply. Agencies that build Drupal migration projects book Q3 and Q4 work months in advance, and teams that wait usually pay more for rush timelines. That premium is the clearest cost of waiting, because it shows up in quotes during the quarter.
The Productivity Drain
Research from CodeScene estimates that developers spend up to 42% of their time on technical debt. That is about two full workdays each week lost to code that should have been updated. An earlier update gives that time back to your engineering team in the same fiscal year.
The Update Payoff
Updating to Drupal 11 is not only about avoiding risk. Current Drupal versions offer better caching, a cleaner deployment path, and access to the Drupal AI module ecosystem, which is not available on unsupported branches. Teams that move before the deadline get those gains in a planned release, not in an emergency.
What Are the Compliance Risks of Running Unsupported Drupal?
Unsupported software is a control gap that auditors flag, and it grows more serious the longer a known flaw goes unpatched. Teams still running Drupal 7 have had no security patches since January 2025.
Drupal 10 faces a sooner deadline than many teams think. Individual Drupal 10 minor releases lose security coverage before the branch itself does, and Drupal 10.6.0 is the final minor in the series. Check which 10.x minor your site runs, because a site two minors behind is exposed now, not in December.
Compliance exposure: For teams subject to GDPR, HIPAA, or PCI-DSS, unsupported software is not always a violation. But it is a documented control gap. It shows up in audit findings, weakens your case after an incident, and can block procurement and vendor security reviews.
Image
What Changes on 10 December 2026?
Your site keeps running. That is the part most stakeholders get wrong in both directions: nothing switches off, and nothing is fine either. What stops is the flow of fixes.
- No more Drupal 10 core releases. The branch is closed, so security advisories affecting it are not patched.
- Contributed modules follow. Maintainers move their Drupal 10-compatible branches to supported versions, and coverage fades over time instead of ending on one date
- Procurement and audit consequences arrive on their own schedule. A rule that requires supported software does not care that the site is still serving pages.
The practical effect is that risk starts on 10 December and does not announce itself. There is no outage to escalate, which is why these migrations slip
Should You Migrate to Drupal 11 or Wait for Drupal 12?
Migrate to Drupal 11. Drupal does not support skipping major versions, so a Drupal 10 to 11 migration is required before Drupal 12 regardless of timing. Drupal 11 is the next supported step either way.
The next step depends on where you are now: Drupal 7 and Drupal 9 sites need a migration project to Drupal 11, Drupal 10 sites upgrade to Drupal 11 and then 11.5, and Drupal 11 sites should land on 11.5 before considering Drupal 12.
| Your current version | Status | Next supported step |
|---|---|---|
| Drupal 7 | End of life since January 2025. Unpatched. | A migration project to Drupal 11, not an upgrade |
| Drupal 9 | Already past end of life | Drupal 11, starting now |
| Drupal 10 | Supported until 9 December 2026 | Drupal 11, then 11.5 when it ships |
| Drupal 11 | Current and supported | Drupal 11.5, which ships the same week as Drupal 12 |
For teams already on Drupal 11, landing on 11.5 is the lower-risk move before considering the major version jump. For teams on Drupal 10, waiting for Drupal 12 does not reduce the work. It only shortens the runway.
When Do You Need to Start?
Now, if the site must be live on a supported version before 9 December 2026. From Q3 2026, the remaining runway is about sixteen weeks, and much of it is holiday freeze and agency time that is already booked.
A realistic sequence for an enterprise Drupal 10 site is: a readiness audit to count custom modules and check contributed dependencies, a scoped upgrade, testing against real traffic, then cutover outside the freeze.
The audit matters because deprecation debt is often the variable that doubles the timeline, and it is what makes a Drupal migration estimate meaningful. Sites moving from Drupal 7 or 9 are rebuilds, not upgrades, and should be scoped separately.
Organizations that finish before Q4 reclaim budget, avoid the demand spike, and enter 2027 ready for Drupal 12. Organizations that start in Q4 will be competing for capacity in the same quarter as everyone else who waited.
Vardot builds and migrates enterprise Drupal platforms as a Drupal Diamond Certified Partner, with 200+ platforms launched, a 4.9/5 Clutch rating across verified reviews, and standing among the top 20 Drupal contributors worldwide.
Find out what your migration actually involves before scoping the budget.
Book a Migration Readiness AuditFAQs
Drupal 10 security support ends on December 9, 2026. After that date, any newly discovered vulnerabilities will not receive patches, leaving sites exposed. For enterprises subject to GDPR, HIPAA, or PCI-DSS, operating on unsupported software crosses from a technical gap into an active compliance risk.
It depends on your starting point. Drupal 7 migrations, which are full rebuilds, not upgrades, typically require 7 to 12 months, depending on site complexity. Drupal 10 to 11 upgrades are less technically complex and generally take 2 to 4 months.
Industry research shows enterprises spend 60–80% of IT budgets maintaining legacy systems. Separately, estimates suggest developers lose up to 42% of their time, roughly two full workdays per week, managing technical debt.
The recommended starting point is a migration readiness audit; from there, the priority is selecting and signing a migration partner in Q1. Organizations that haven't started that process by mid-year are unlikely to complete migration before the December deadline.
Join the conversation +
Related blogs
May 4, 2015
November 25, 2018