All Drupal 8 site owners must upgrade to Drupal 9 to receive security updates and bug fixes. The Drupal Association will also disable testing with unsupported versions of Drupal. Drupal 7’s end-of-life is currently scheduled for November of 2022, and it will receive security updates until then. Drupal 9’s end-of-life is scheduled for November of 2023. For more information on release schedules, see the core release cycle overview.
Security issues that only affect Drupal 8 (and not Drupal 9 or Drupal 7) will be made public and sites are at risk of having these issues exploited if they do not upgrade.
As of November 17, 2021, the Drupal core version 8 series has reached end-of-life. This means that all releases of Drupal 8 core (with 8.y.x version numbers) and Drupal contributed project releases that are compatible with only Drupal 8 will be marked unsupported as they no longer have security team support.
What about Drupal 7 and Drupal 9?
Drupal 8.0.0 was first released on November 9, 2015. The last version was released on November 17, 2021.
Contributed projects like themes and modules will still receive security advisories if they are compatible with either Drupal 7 or 9 and have opted in to security coverage.
