Patch tonight. Migrate to modern, AI-improved.
Still on Drupal 7? Your options after end of life
Last updated: 2026-10-23 · Shawn Gants
Jan 2025
Drupal 7 ended
Passed
Oct 21, 2026
PHP2Shell patches
Passed
Dec 9, 2026
Drupal 10 ends
Ahead
Dec 31, 2026
PHP 8.2 security ends
Ahead
Answer: Drupal 7 reached end of life in January 2025. Drupal.org no longer releases core or contributed security fixes for it (Drupal.org). You have three options: pay for extended support, rebuild on Drupal 11 (there's no in-place upgrade from 7), or migrate off Drupal, for example to Next.js + Supabase. Whatever you choose, patch PHP for PHP2Shell first (php.net).
Why PHP2Shell hits Drupal 7 sites hard
Many D7 sites still run old PHP branches. PHP 8.1 and older get no official PHP releases. The PHP security team published only minimal source backports for 7.4, 8.0 and 8.1 (php.net). If your host can't give you a patched build, CISA advises taking the system offline until it's patched (CISA).
Option 1: Extended security support (stay on D7)
The Drupal Association lists D7 extended-support partners (Drupal.org). Published examples: Tag1 D7ES self-service at $149.99/site/month and premium at $1,499.99/site/month (Tag1 D7ES, verify current pricing). HeroDevs quotes custom pricing (HeroDevs). *Good for:* buying time. *Not good for:* the PHP layer underneath. You still have to patch PHP yourself.
Option 2: Rebuild on Drupal 11
There's no direct upgrade path. Drupal 8 was a rewrite, so the site is rebuilt and the content migrated. Drupal 11 needs PHP 8.3+ (Drupal.org). You'll face a Drupal 12 upgrade later (Drupal 12 releases the week of Dec 7, 2026, per Drupal.org). *Good for:* teams invested in Drupal's editor and modules.
Option 3: Migrate to Next.js + Supabase on Netlify
Since a D7 → D11 move is a rebuild anyway, compare it against a rebuild on a stack without a PHP server. We pull D7 content directly from the database (D7 has no REST API by default), map fields into Postgres tables, rebuild permissions as row-level security, and 301-redirect every old path. How a migration works →
Comparison
| Extended support | Drupal 11 rebuild | Next.js + Supabase | |
|---|---|---|---|
| Fixes PHP2Shell | No (patch PHP separately) | No (patch PHP separately) | Removes PHP from hosting |
| Future major upgrades | Still D7 | D12 and beyond | npm dependency updates |
| Recurring cost | Monthly per site | Hosting + maintenance | Hosting + care plan |
| One-time cost | Low | Rebuild | Rebuild |
FAQ
When did Drupal 7 reach end of life? January 2025 (PSA-2025-01-06) (Drupal.org).
Will my D7 site stop working? No. It keeps running, but new vulnerabilities aren't fixed by Drupal.org.
Is my D7 site affected by PHP2Shell? If its PHP isn't patched, yes. Drupal version doesn't matter (php2shell.uk).
Can D7 go straight to Drupal 11? Not in place. It's a rebuild plus content migration.
How do you get content out of D7? Directly from the MySQL database, with repeatable scripts.
Sources on this page
- S01: CISA: Critical Vulnerabilities in PHP Require Immediate Patching (Oct 21, 2026)
- S02: php.net News Archive 2026: Security advisory + 8.5.12/8.4.27/8.3.36/8.2.35 release notes
- S15: Drupal core release schedule (Drupal 10 EOL Dec 9, 2026; Drupal 12 week of Dec 7, 2026) — verified (search extract)
- S17: Drupal.org: Drupal 7 has reached end of life | PSA-2025-01-06
- S18: Drupal.org: PHP requirements (version matrix)
- S31: Tag1 D7ES Support Plans (Drupal 7 extended security support) — snippet (prices from search summary; page fetch did not render prices)
- S32: HeroDevs Pricing (Never-Ending Support) — snippet
- S40: Drupal.org: Drupal 7 End of Life / extended security support partners — snippet
- S42: php2shell.uk: PHP2Shell and Drupal: is my site affected? (independent guide) — verified (search extract)