In case you missed PSA-2026-11-02 ( https://www.drupal.org/psa-2026-11-02 ): starting in 2027, each Drupal core minor version gets 8 months of security coverage instead of the 12 we've had since 8.6. The Security Team's reason is the flood of AI-generated security reports they can't keep up with on current funding. Fewer supported branches means less backporting.

The part that matters day to day: with a new minor every six months, when 11.6 / 12.1 comes out in June 2027, 11.5 / 12.0 only has two months of support left (until August 2027).

And Drupal 10 reaches EOL on December 9, the same week Drupal 12 (PHP 8.5 minimum) is released.

I'm migrating a few sites from 10 to 11 right now. Core isn't the issue. What eats the time is deprecated APIs in custom code, contrib modules several releases behind, the odd abandoned module, and patches in composer.json that no longer apply. Upgrade Status and Rector help, but the sites that were kept up to date are a completely different experience from the ones nobody touched for two years.

I wrote a longer post on what this means for site owners and what a maintenance budget should realistically cover now: https://menetray.com/en/blog/eight-months-drupal-shortens-security-support-and-your-site-cant-wait-year-anymore

Are your clients actually budgeting for regular updates, or are you still doing big catch-up jobs every couple of years?