PHP2Shell CVE-2026-109618 / 109619 · WordPress and Drupal hosts should update PHP now.

Patch guide for your host
DrupalMigration.aiPatch tonight. Migrate to modern, AI-improved.

Patch tonight. Migrate to modern, AI-improved.

Drupal 10 ends December 9, 2026. Here are your three options

Last updated: 2026-10-23 · Shawn Gants

48 days until December 9, 2026 (Pacific time), counted in your browser.

  1. Jan 2025

    Drupal 7 ended

    Passed

  2. Oct 21, 2026

    PHP2Shell patches

    Passed

  3. Dec 9, 2026

    Drupal 10 ends

    Ahead

  4. Dec 31, 2026

    PHP 8.2 security ends

    Ahead

Published dates only. Drupal 7 ended in January 2025. PHP2Shell patches shipped October 21, 2026. Drupal 10 ends December 9, 2026. PHP 8.2 security support ends December 31, 2026.
Answer: Drupal 10 reaches end of life on December 9, 2026. After that date there are no new Drupal 10 releases, security fixes included. Drupal 12 ships the same week (Drupal.org). Acquia ends its Drupal 10 support the same day (Acquia). Your choices: upgrade to Drupal 11, pay for extended support if a vendor offers it, or migrate off Drupal.

48 days left · Request a free Drupal 10 audit

How many sites does this affect?

In the week of Oct 11, 2026, about 276,000 sites reported running Drupal 10.x to Drupal.org. That counts only sites with update reporting turned on, so the real number is higher (Drupal.org usage stats).

The PHP angle

  • Drupal 10.6 supports PHP 8.1–8.4. Drupal 11 needs PHP 8.3+ (Drupal.org).
  • PHP 8.2 ends Dec 31, 2026 (php.net). A D10 site on PHP 8.2 faces two deadlines in the same month.
  • Whatever you choose, PHP2Shell has to be patched now (guide).

Option 1: Upgrade to Drupal 11

Usually the cheapest path if your contributed modules are ready. Run the free Upgrade Status module to size it. Drupal Aid has a good 30-minute walkthrough. You'll still run PHP and face Drupal 12 later.

Option 2: Migrate to Next.js + Supabase

Better when the upgrade report is long, you want member features without PHP sessions, or you're done with major-version projects. How it works →

The site keeps working, but every new Drupal 10 vulnerability after Dec 9 stays open. Acquia: "You must consider Drupal 10.x an insecure and unsupported application framework after December 9, 2026" (Acquia).

Upgrade to Drupal 11 vs migrate: side by side →

FAQ

When exactly does Drupal 10 reach end of life? December 9, 2026 (Drupal.org).

Is there a Drupal 10 LTS? Drupal.org says no new Drupal 10 releases after that date. Check individual vendors for paid support.

Can I upgrade from 10 straight to 12? Drupal's usual path is through the latest minor of each major. Plan for 11 first. <!-- verify against Drupal.org upgrade docs before publishing -->

What PHP version do I need for Drupal 11? 8.3 or newer (Drupal.org).

Request a free Drupal 10 audit

Sources on this page

  1. S02: php.net News Archive 2026: Security advisory + 8.5.12/8.4.27/8.3.36/8.2.35 release notes
  2. S12: Drupal Aid: October 21 Critical PHP Security Update — verified (summary on blog index)
  3. S15: Drupal core release schedule (Drupal 10 EOL Dec 9, 2026; Drupal 12 week of Dec 7, 2026) — verified (search extract)
  4. S16: Acquia: Drupal 10.x End-Of-Life FAQs — verified (search extract)
  5. S18: Drupal.org: PHP requirements (version matrix)
  6. S19: Drupal.org: Usage statistics for Drupal core
  7. S39: Drupal Aid blog index (incl. 'Is Your Drupal 10 Site Ready for Drupal 11? 30-Minute Check')