Drupal 10 is a content management system, software for creating and managing website content, built for maintainable enterprise architecture. In 2026 its benefit is proven authoring and API-first delivery, while its risk is end of life on Dec.
9, 2026 with no further security fixes. Marketing, publishing and project teams can still run a sound Drupal 10 site today. New builds and lagging sites need a timed plan to move on, not more custom work on old code.
Table of Contents
- What powers Drupal 10?
- What improved for editors and designers?
- When does API-first make sense?
- Why is late 2026 the turning point?
- How do you leave Drupal 10 safely?
What powers Drupal 10?
Drupal.org states in the 10.0.0 release notes that Drupal 10 is built on Symfony 6.2 and requires PHP 8.1 or higher. Symfony handles routing, dependency injection, events and services. Dependency injection means a service receives what it needs rather than building it.
Drupal.org describes that December 2022 release as a refined Drupal 9 with deprecated code removed. Modules and themes using old Symfony APIs needed upgrades. For owners, that means cleaner core code but real testing for custom work.
What improved for editors and designers?
Drupal.org reports Drupal 10 replaced Bartik with the accessible Olivero front-end theme, Seven with the Claro admin theme, and CKEditor 4 with CKEditor 5. A theme controls site look and layout, while the editor formats text and media. Accessibility means more visitors can perceive and use the pages.
Olivero gives public pages a modern, accessible starting point. Claro simplifies content tasks in the admin screens. CKEditor 5 updates drafting, pasting and media handling for everyday authors.
When does API-first make sense?
The Drupal Association notes in its technical overview that Drupal 10 supports API-first builds through built-in JSON:API and Layout Builder. JSON:API is a standard way for Drupal to send content to other systems. Layout Builder arranges content blocks into page layouts.
That fits a team serving one content hub to a website, a mobile app and a display screen. A university, publisher or membership group can reuse news, events and profiles across channels. Decoupled work adds a separate front-end build to host and maintain, so small brochure sites often stay coupled.
Why is late 2026 the turning point?
Drupal.org states in the core release schedule that Drupal 10 reaches end of life Dec. 9, 2026, after which no new Drupal 10 releases will be made, including security fixes. After that date, bugs and flaws stay open. Planning must treat December as a hard stop.
The Drupal Security Team warned in its Oct. 12, 2026 advisory that versions before 10.6.x and 11 before 11.3.x are unsupported. Supported branches in that notice faced critical RCE and XSS fixes. RCE lets an attacker run code, while XSS lets an attacker inject malicious scripts.
How do you leave Drupal 10 safely?
Drupal.org explains in the upgrade guide that moving from Drupal 10 to Drupal 11 requires Drupal 10.3.0 or later and PHP 8.3 or higher. A minor version is the middle number, such as 10.2 to 10.3.
Old 10.x sites must first update code and hosting. Use this order to avoid a stalled upgrade: Freeze new Drupal 10 custom features and fix hosting PHP first.
- List custom and contributed modules and check Drupal 11 support
- Bring the site to a current Drupal 10 release on PHP 8.1 or higher
- Move hosting to PHP 8.3 or higher, then step to Drupal 11 from 10.3.0 or later
