December 2026: Drupal 10.6, Drupal 11.3 and PHP 8.2 Lose Support

December 2026 brings three deadlines that affect a large share of Drupal sites in production. During the week of December 7, Drupal 10.6 and Drupal 11.3 stop receiving security fixes, and on December 9 Drupal 10 reaches the end of its life. On December 31, it is PHP 8.2's turn.

A site on those versions will keep working after those dates, but if a new flaw appears there will be no official update to fix it. We saw this in October with PHP2Shell: sites on unsupported versions needed manual patches and temporary measures.

Which Drupal and PHP Versions Lose Support, and When

According to the official Drupal release schedule and PHP's, these are the dates:¹

That same week in December, Drupal 12.0.0 and Drupal 11.5.0 are released.² Versions 10.4, 10.5 and 11.2 are already unsupported, so sites still running them are already exposed.³

What Losing Support Means

The site keeps working, but the security team stops publishing advisories, patches and new releases for that branch.

This has three practical effects:

• If a vulnerability is discovered after the deadline, the fix is released only for supported versions.
• Hosting providers move first. Acquia, for example, retired PHP 8.2 from its platform on October 1, 2026, three months before the official end, and moved sites still on that version to PHP 8.4.⁴
• The jump gets longer. Drupal 12 only accepts upgrades from Drupal 11.3 or later, so a site on Drupal 10 has to go through Drupal 11 first.⁵

What to Do Depending on Your Site's Version

The first step is the same for everyone: confirm which version of Drupal and PHP each site runs on. From there, the path depends on the case:

• If you are on Drupal 11.3, update to Drupal 11.4, which is supported until June 2027. It is a minor update within the same major version.
• If you are on Drupal 10, first update to 10.6.20, which includes the October security fixes, and plan the migration to Drupal 11. Keep in mind that Drupal 11 requires PHP 8.3 or higher, so the migration usually includes a PHP upgrade as well.
• If you are on PHP 8.2, move to a supported version. PHP 8.3 gets patches until December 2027, PHP 8.4 until December 2028 and PHP 8.5 until December 2029.⁶ Before switching, test the site in a staging environment: some modules may need adjustments.
• If you are still on Drupal 7, your site has had no support since January 2025, and it is worth migrating it as soon as possible.

A major version migration usually takes weeks. If you start it in December, the site will spend some time without support.

What This Means for Organizations in Colombia

In Colombia, running a migration in December is hard: the month coincides with the close of the fiscal year at public agencies, with collective vacations at many companies and universities, and with reduced teams until January.

That is why it makes sense to make decisions in November:

1. Take inventory of your sites, with the Drupal and PHP version of each one.
2. Prioritize the ones that handle user data, payments or government procedures.
3. If the migration requires a contract or budget, include it in the corresponding fiscal year. For many agencies, the 2026 fiscal year is already closing.
4. Ask your hosting provider what they will do about PHP 8.2 and on what date.

Need Help with the Upgrade?

If you don't know which version of Drupal or PHP your site runs on, or you need to plan the change before December, we can review it with you. Get in touch or learn about our Drupal support and maintenance and Drupal as a Service offerings.

Sources

1. Drupal.org, Core release schedule. ↩
2. The Drop Times, 2026 dates for Drupal 11.4, Drupal 12 and the end of Drupal 10. ↩
3. Pantheon, Drupal 10 end of life by minor version. ↩
4. Acquia, PHP 8.2 retirement on its platform. ↩
5. The Drop Times, Drupal 12 upgrade guide. ↩
6. endoflife.ai, PHP 8.2 to 8.5 support dates. ↩

Published by Angie Vera, Seed EM · November 2026.