View online: https://www.drupal.org/psa-2026-11-02 Date: 2026-November-02 Description: .... Background Drupal has supported each minor release of Drupal (example: 11.3, 11.4) for 12 months each since the release of Drupal 8.6 in 2018. Like all open source projects [1], Drupal is enduring a "tsunami" of security reports [2] due to the prevalence of AI tools, and this has created more work than the Drupal Security Team, especially with its current levels of funding, can sustain. For site owners, this introduces risks that security fixes will take longer to release, which gives more time for malicious actors armed with LLMs to find attacks. The Drupal Security Team and Drupal core release managers explored several options, and ultimately landed on a compromise that brings other benefits such as better alignment with Symfony upstream releases. We will continue protecting Drupal sites for at least 4 years on each major version, while cutting backport work for core security advisories by 30%. .... Drupal minor versions will receive 8 months of security coverage Beginning in 2027, Drupal minor versions will receive 8 months of overlapping security coverage (rather than 12 months). This will apply to all versions supported in 2027, meaning that: * Drupal 11.3 (released December 2025) will still be supported until December 2026. * Drupal 11.4 (released June 2026) will be supported until April 2027 while the old schedule is being phased out. * Drupal 12.0 and 11.5 (scheduled for December 2026) will be supported until August 2027. * Drupal 12.1 and 11.6 (scheduled for June 2027) will be supported until February 2028. Each minor version will have six months of bugfix support followed by two months of security-only support. The final minor version for each major receives six months of bugfix support followed by six months of security support. .... Major versions are still supported for at least 4 years While the duration of overlapping support for individual minor versions will be reduced, major versions of Drupal core will still be supported for at least four years. This means that: * Drupal 10 will still be supported until December 2026. * Drupal 11 (released August 2024) will still be supported until December 2028. * Drupal 12 (scheduled for December 2026) will be supported until December 2030. Coordinated By: * Benji Fisher (benjifisher) [3] of the Drupal Security Team * catch (catch) [4] of the Drupal Security Team * Gábor Hojtsy (gábor hojtsy) [5] * Greg Knaddison (greggles) [6] of the Drupal Security Team * Lee Rowlands (larowlan) [7] of the Drupal Security Team * Dave Long (longwave) [8] of the Drupal Security Team * James Gilliland (neclimdul) [9] of the Drupal Security Team * quietone (quietone) [10] * Angie Byron (webchick) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team * Cathy Theys (yesct) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://github.blog/security/supply-chain-security/inside-the-advisory-datab... [2] https://tech.yahoo.com/cybersecurity/articles/open-source-cybersecurity-ai-k... [3] https://www.drupal.org/u/benjifisher [4] https://www.drupal.org/u/catch [5] https://www.drupal.org/u/g%C3%A1bor-hojtsy [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/larowlan [8] https://www.drupal.org/u/longwave [9] https://www.drupal.org/u/neclimdul [10] https://www.drupal.org/u/quietone [11] https://www.drupal.org/u/webchick [12] https://www.drupal.org/u/xjm [13] https://www.drupal.org/u/yesct [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....