[IT-SecNots] [Security-news] Security support for Drupal core minor versions reduced to 8 months - PSA-2026-11-02

[security-news AT drupal.org]

View online: https://www.drupal.org/psa-2026-11-02

Date: 2026-November-02
Description: 
.... Background

Drupal has supported each minor release of Drupal (example: 11.3, 11.4) for
12 months each since the release of Drupal 8.6 in 2018.

Like all open source projects [1], Drupal is enduring a "tsunami" of security
reports [2] due to the prevalence of AI tools, and this has created more work
than the Drupal Security Team, especially with its current levels of funding,
can sustain. For site owners, this introduces risks that security fixes will
take longer to release, which gives more time for malicious actors armed with
LLMs to find attacks.

The Drupal Security Team and Drupal core release managers explored several
options, and ultimately landed on a compromise that brings other benefits
such as better alignment with Symfony upstream releases. We will continue
protecting Drupal sites for at least 4 years on each major version, while
cutting backport work for core security advisories by 30%.

.... Drupal minor versions will receive 8 months of security coverage

Beginning in 2027, Drupal minor versions will receive 8 months of overlapping
security coverage (rather than 12 months). This will apply to all versions
supported in 2027, meaning that:

 * Drupal 11.3 (released December 2025) will still be supported until
   December 2026.
 * Drupal 11.4 (released June 2026) will be supported until April 2027 while
   the old schedule is being phased out.
 * Drupal 12.0 and 11.5 (scheduled for December 2026) will be supported until
   August 2027.
 * Drupal 12.1 and 11.6 (scheduled for June 2027) will be supported until
   February 2028.

Each minor version will have six months of bugfix support followed by two
months of security-only support. The final minor version for each major
receives six months of bugfix support followed by six months of security
support.

.... Major versions are still supported for at least 4 years

While the duration of overlapping support for individual minor versions will
be reduced, major versions of Drupal core will still be supported for at
least four years. This means that:

 * Drupal 10 will still be supported until December 2026.
 * Drupal 11 (released August 2024) will still be supported until December
   2028.
 * Drupal 12 (scheduled for December 2026) will be supported until December
   2030.


Coordinated By: 
 * Benji Fisher (benjifisher) [3] of the Drupal Security Team
 * catch (catch) [4] of the Drupal Security Team
 * Gábor Hojtsy (gábor hojtsy) [5]
 * Greg Knaddison (greggles) [6] of the Drupal Security Team
 * Lee Rowlands (larowlan) [7] of the Drupal Security Team
 * Dave Long (longwave) [8] of the Drupal Security Team
 * James Gilliland (neclimdul) [9] of the Drupal Security Team
 * quietone  (quietone) [10]
 * Angie Byron (webchick) [11] of the Drupal Security Team
 * Jess  (xjm) [12] of the Drupal Security Team
 * Cathy Theys (yesct) [13] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [14]

[1]  
https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records/
[2]  
https://tech.yahoo.com/cybersecurity/articles/open-source-cybersecurity-ai-kind-110500438.html
[3] https://www.drupal.org/u/benjifisher
[4] https://www.drupal.org/u/catch
[5] https://www.drupal.org/u/g%C3%A1bor-hojtsy
[6] https://www.drupal.org/u/greggles
[7] https://www.drupal.org/u/larowlan
[8] https://www.drupal.org/u/longwave
[9] https://www.drupal.org/u/neclimdul
[10] https://www.drupal.org/u/quietone
[11] https://www.drupal.org/u/webchick
[12] https://www.drupal.org/u/xjm
[13] https://www.drupal.org/u/yesct
[14]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3633990

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at