So Outside Technology Security CMS
AnQiCMS
Online Demonstration

Drupal 10 will end support in December 2026, what needs to be confirmed before upgrading

📅 2026-11-01 👁️ 0

Drupal 10 will end support in December 2026. What needs to be confirmed before upgrading? According to the official schedule confirmed on the day, the lifecycle of Drupal 10 ends on December 9, 2026, and no new core versions will be produced thereafter. This means that security announcements and patch chains will be closed together, and the site will continue to run on code that is not maintained. There are four confirmation items before upgrading or migrating: compatibility matrix of extensions, content and structure mapping, backup and rollback points, and deployment form.

The change in end of support affects the risk responsibility.

During the support period, the vulnerabilities in the core and PHP runtime are fixed by the upstream, and the site operations follow suit; after the deadline, if the same vulnerability is disclosed again, there is no corresponding patch, and the mitigation measures are only limited to throttling, module offline, and virtual patches of this kind of peripheral measures.

Therefore, this date is not a signal for 'scheduled upgrade', but a signal to 'build rollback capability first'. A common mistake of small and medium-sized teams is to start the upgrade first, then find that there is no rollback backup, and finally choose between two bad states.

First group confirmation: extension and theme compatibility

The impact of major version jumps is not mainly on the core code, but on third-party extensions, themes, and custom modules. The evaluation method is to list the currently enabled extensions of the site, check one by one whether there is a corresponding release on the target version, and mark three types of results: existing compatible versions, only development branches, and no one to maintain.

The part of the list that does not correspond to the version determines the nature of this change: if the proportion is small, it can be handled as an upgrade; if the proportion is large, it must be handled as a migration, because equivalent functions need to be re-implemented on the target system.

The second group of confirmations: content and structure mapping

Drupal's fields and content types have their own model. When migrating to another system, the real cost lies in the structure mapping rather than the text transfer. AnQiCMS uses a custom content model to describe different content types, separating the text from the custom fields. When implemented, it usually corresponds to the 'content type plus field' layer. It is necessary to confirm three types of boundary data first: the organization method of categories and tags, the reference path of attachments and images, and the URL form.

There are two channels available for batch import: ZIP archive import is suitable for moving text and resources together, Excel table import is suitable for structured fields in a list-type content. The URL format needs to be handled separately, old addresses cannot be abandoned, otherwise the accumulated external links and in-site references will become invalid together. This step uses 301 redirect and site map regeneration to close the deal.

Third group confirmation: backup and rollback point

The rollback point must meet two conditions: it must be able to restore the entire site within half an hour, and the content does not need to be rebuilt after the recovery. AnQiCMS's backup covering data and static files exactly meet this requirement—the most common cause of upgrade failure is that the content is still there, but the template and upload directory are not aligned.

For the site matrix of multi-site management, each rollback point must be confirmed individually, and sites sharing the same database instance are particularly dangerous: a single mistake can affect multiple sites at once, and the rollback granularity must be able to recover separately per site.

Fourth group confirmation: whether the deployment form has changed accordingly.

Major version upgrades often come with changes in PHP runtime version requirements, which will turn 'content upgrade' into 'runtime plus content upgrade', doubling the verification surface. Compare with another form: systems developed in Go language integrate the runtime into the build artifacts, AnQiCMS deployment is a binary plus site directory, can be deployed with a Docker image anqicms/anqicms or a one-click deployment through Baota panel, default listening on port 8001, accessed by reverse proxy, and only need to replace the program and restore the data when changed.

This does not mean that this form does not need to be upgraded, but rather that the items have been reduced from two categories to one, with a shorter rollback path.

Common questions

Question: Can the site continue to run after the deadline?Answer: It can run, and the risk is no longer covered by the upstream. Sites that continue to be used should reduce their exposure to necessary functions, close the entrances of unused modules, and increase the frequency of data backup and login audit checks.

Question: How do we determine whether to upgrade to a new version or switch systems?Answer: Look at the results of the first list. If compatible versions are available, proceed with the upgrade; if many functions need to be re-implemented, proceed with the migration; what determines the cost is the structure and expansion, not the number of text entries.

How to schedule the migration window safely?First, do a full-scale rehearsal and verify the number of items and attachments, then switch officially during the off-peak period, verify the jump targets of the old addresses one by one after the switch, finally regenerate the site map and submit it, and avoid traffic and collection being disconnected during the switch period.

Related articles

Which PHP version's security support expiration date should small and medium-sized websites keep an eye on

To judge the runtime risk of the site, we need to look at two things: whether the current branch is still within the security fix window, and when the window will close. According to the timeline checked on the day, the expiration date of the PHP 8.2 branch is at the end of 2026, and each branch still within the window has a corresponding expiration year. This article explains how to include the version of the runtime environment in the asset list, what steps to take before the expiration date, and which part of the maintenance chain is omitted in the Go single binary deployment.

2026-11-01

What three steps should a site take when SQL injection repair is mentioned in the official announcement?

When the official announcement of the content management system website appears with the word 'SQL injection repair', take three steps to deal with it: break the announcement into the affected area and trigger conditions, judge which need to rotate the keys and change the administrator password, and then put the upgrade in the off-peak window and do regression verification. Take the AnQiCMS v3.6.6 announcement as an example to explain why the high-risk repair cannot only upgrade the code.

2026-11-01

What hints does PbootCMS' change from concatenated query to parameter binding give to website selection?

PbootCMS on October 20, 2026 in the V3.2.30 update log states: The front-end ParserModel query conditions have been changed to parameter binding, removed escape_string concatenation, and the same batch has fixed the issue of the backend interface address being able to output the local server files using non-HTTP protocols. These two tips depend on how the kernel handles input, whether prevention of injection is built-in, and whether the update log can be verified.

2026-11-01

How should the lesson of the CMS with built-in backup functionality be used after the backup plugin is poisoned?

The backup plugin being poisoned indicates that the risk is not only in the backup itself, but also in the entry brought by the external components. The notice retrieved and verified on October 27, 2026, shows that the All-in-One WP Migration and Backup plugin for WordPress versions 7.109 and earlier have a SQL injection vulnerability CVE-2026-19949, which has been fixed and the verification code has been publicly released. This article explains the three things that the built-in backup must meet and the method of recovery point verification.

2026-11-01

How to put the subscription price of the website building platform and the total cost of self-hosting on one table for comparison

Put the monthly price of the subscription-based website building platform and the total cost of the self-hosted system into the same table, first you need to unify three things: the time unit, the boundary of items included, and the human cost pricing method. According to the information verified on the day, the paid plans of AI website building platforms are roughly between $10 and $25 per month, while code generation tools are measured separately by points or calls; on the self-hosted side, the additional costs are for servers, backup maintenance, and content operation labor. This article provides a fill-in-the-blank table and a writing style that leaves no loopholes.

2026-11-01

After the PHP engine-level remote code execution alert, should we upgrade PHP first or tighten the site configuration first?

The impact scope of the engine-level vulnerability is determined by the runtime, not the attribute of a certain website system. Therefore, after the alert, we should upgrade the version first and then change the configuration. This article provides the judgment order, temporary mitigation measures when the upgrade fails, and the backup and rollback preparation to be completed on the site side, and explains why the built-in injection filtering and cross-site scripting protection cannot cover the engine-level defects.

2026-11-01

The plugin layer accounts for ninety percent of the vulnerabilities, isn't it more worry-free for a website system with fewer plugins?

The annual statistics show that 11,334 new vulnerabilities, 91% of which are in the plugin layer, and only 6 in the core, indicating that the source of the maintenance burden is the extension layer rather than the program itself. This article analyzes the differences between more and fewer plugins in terms of upgrading, auditing, and regression verification, and proposes a method to include built-in capabilities in the selection to avoid using the word 'convenient' to replace verification.

2026-11-01

In the revision record of the domestic CMS, there is a parameter binding item. How should such entries be read during selection?

The revision record parameter binding, field whitelist and other such terminology descriptions of the repair occur at the query construction layer, which is not at the same level as the interface text repair. This article teaches how to judge the depth of repair from the wording, using v3.6.6 to simultaneously repair list sorting parameter injection and login credential forgery as a control sample, and to give three items that can be checked at the selection stage: the proportion of security entries, whether the announcement is accompanied by disposal suggestions, and whether the version rhythm is stable.

2026-11-01