Security public service announcements: End of Drupal 6 vendor support – PSA-2022-03-09

Drupal CMS
Date: 
2022-March-09
Description: 

Drupal 6 LTS vendor-provided support will end on October 22, 2022.

On February 24th, 2016, Drupal 6 was marked end-of-life (EOL). The Drupal 6 Long-Term-Support (LTS) program added more than 6 years of additional coverage for program participants and the community.

On behalf of the community the Drupal Security Team would like to thank all the vendors that participated in this program: Tag1, Acquia, and myDropWizard.

After the Drupal 6 LTS program ends, security issues for Drupal 6 may be disclosed in public, and zero-days (i.e, security vulnerabilities being exploited in the wild without advanced warning) may occur. Patches for Drupal 6 security issues will no longer be provided by any vendor. Drupal 6.x Update Status module data and package distribution may be disabled or removed as Drupal.org prepares to update to newer infrastructure.

Solution: 

If you are still maintaining a Drupal 6 site, we recommend migrating to Drupal 7 or Drupal 9 before the program ends. Learn more about upgrading from Drupal 6 to Drupal 9.