WebBuilding

Software and platforms

Drupal

Summary

Drupal is a free, open-source content management system written in PHP. Dries Buytaert started it as a student project at the University of Antwerp in Belgium and released version 1.0.0 on January 15, 2001. As of October 22, 2026, W3Techs found it on 0.6% of all websites. The current major version is Drupal 11, and Drupal 12 is scheduled for December 2026.

Web Building Encyclopedia · Software and platforms · Last reviewed October 22, 2026 · 7 min read

What Drupal is

Drupal is free, open-source software for building and running websites. It is a content management system (CMS): a program that keeps a site’s pages, images and other content in a database and lets people edit them in a web browser.1

Drupal.org describes the software as modular. Features are added by installing modules (add-on code), themes (designs) and distributions (ready-made bundles of both).1 As of October 22, 2026, Drupal.org listed more than 56,000 modules.2

Drupal is written in PHP, the programming language that runs on the web server.3 Current versions store content in a MySQL, MariaDB, PostgreSQL or SQLite database.4

The code is licensed under the GNU General Public License, version 2 or later (GPLv2 or later). Drupal.org treats modules and themes as derivative works, so anyone who distributes one must use the same license.5 There are no license fees.1

Dries Buytaert, who started Drupal, still serves as its project lead.6 The Drupal name is a registered trademark that he holds.1 The nonprofit Drupal Association supports the project and runs Drupal.org on behalf of the community.7

As of October 22, 2026, the web survey company W3Techs detected Drupal on 0.6% of all websites and on 0.9% of the websites whose CMS it could identify.8 Drupal.org names government agencies in the United States, London and France, media companies such as the BBC and NBC, and the University of Oxford among its users.1

Origins at the University of Antwerp

Drupal began in a student dorm. In 2000, Dries Buytaert and Hans Snijder, students at the University of Antwerp in Belgium, set up a wireless link between their dorms so that eight students could share Snijder’s ADSL internet connection.9

Buytaert then built a small news site with a message board for the group. It became a place to try out ideas such as moderation, syndication (sharing content as feeds), rating and a shared login across sites.9

The name came from a typing mistake. Buytaert meant to register dorp.org, after the Dutch word for village, but typed “drop” and kept it. Drupal is the English pronunciation of the Dutch word druppel, which means drop.9

In January 2001 he released the software behind drop.org so that others could use it, under the name Drupal.9 He later dated version 1.0.0 to January 15, 2001.10 His own biography says he studied computer science at Antwerp from 1996 to 2000 and later earned a PhD at Ghent University.6

The logo, a smiling water drop called the Druplicon, came from the community. Kristjan Jansen joined two sideways drops into an infinity sign for the eyes, and Steven Wittens worked on the final version.9

Growth, Acquia and the long life of Drupal 7

Drupal found high-profile users early. According to Acquia, supporters of Howard Dean’s 2003 US presidential campaign built their online platform on it, which showed that Drupal could be customized and run at scale.11

In 2007 Buytaert and Jay Batson founded Acquia, a company that helps organizations build sites on Drupal. Acquia calls itself the top corporate contributor to Drupal’s development.11 Buytaert was its chief technology officer for many years and is now its executive chair.6

Drupal 7.0 was released on January 5, 2011.12 Ten days later Buytaert marked Drupal’s tenth birthday, noting that version 1.0.0 had come out on January 15, 2001.10

Drupal 7 had a long support life. After a final extension, its security support ended on January 5, 2025, fourteen years after release.1314 Drupal.org lists two paid vendors, HeroDevs and Tag1 Consulting, that still offer security support for sites that cannot move yet.13

Many have not moved. As of October 22, 2026, W3Techs found 29.0% of the Drupal sites it detected still on version 7, more than on any other version. Version 10 followed at 28.7% and version 11 at 22.4%.15

Drupal 8 and the new upgrade model

Drupal 8.0.0, released on November 19, 2015, was a near rewrite. It adopted well-known PHP libraries from outside the project, including Symfony2 components, the Composer package manager, the Guzzle HTTP client and the Twig template engine.16

The release announcement said more than 3,300 people had made over 16,000 commits to Drupal 8 core during nearly five years of work.16 New features included editing in place on the page, content modeling with entities, fields and Views, configuration management for moving changes from a test site to a live one, and built-in web services.16

The rewrite had a cost for site owners. Moving from Drupal 6 or 7 meant migrating content into a new system rather than running an update, and the Migrate module for that job was still marked experimental in 8.0.0.1617 Support for Drupal 6 ended on February 24, 2016, three months after Drupal 8 arrived.14

Drupal then changed how major versions work. Drupal 9 was built inside Drupal 8: old code was marked as deprecated, and Drupal 9.0.0 matched the last Drupal 8 release apart from that removed code and updated dependencies. Drupal.org called it “the easiest major upgrade in a decade.”17 It came out on June 3, 2020.14 Buytaert wrote that more than 4,500 people had contributed to Drupal core in the roughly four and a half years before that release.18

Drupal 10.0.0 followed on December 15, 2022. It required PHP 8.1, moved to Symfony 6.2 and the CKEditor 5 text editor, and made Claro the replacement for the removed Seven admin theme.19

Drupal 11.0.0 was released on August 2, 2024.14 Its 11.4.0 release of July 1, 2026 is the recommended version for new sites, with security support until June 2027. That release removed the ready-made Article and Page content types from the standard install, so new sites now set up the content types they need, and deprecated the Contact, History and Telephone modules, which are to move out of core into separately maintained projects.20

The newest release as of October 22, 2026 was 11.4.11, a bug fix release published on October 21, 2026.21

Drupal CMS and easier site building

In January 2025 the project began shipping a second product aimed at marketers, content creators and site builders. Drupal CMS 1.0 came out on January 15, 2025, Drupal’s 24th birthday, about eight months after Buytaert announced the Starshot initiative behind it.22

Drupal CMS is Drupal core plus ready-made features. It includes recipes, which are preconfigured packages for features such as a blog or events, and tools for privacy consent, SEO, analytics, search and AI-assisted site building.22

Drupal CMS 2.0, announced on January 28, 2026, made Drupal Canvas the default editor. Canvas lets editors drag components onto a page and edit them with a live preview. The release also added a first site template, Byte, a marketing site for a software-as-a-service product, and optional AI tools that draft pages from a text prompt and suggest image alt text for a person to approve.23

Drupal CMS 2.0 runs on Drupal core 11.3, which the announcement says serves 26% to 33% more requests on the same setup than before.23

The next major version, Drupal 12, is scheduled for the week of December 7, 2026. Drupal 10 reaches end of life that same week, on December 9.14 Drupal 12.0 lists PHP 8.5 as its only supported PHP version.3 It also raises the minimum database versions to MariaDB 10.11 and PostgreSQL 18, up from 10.6 and 16 in Drupal 11, while keeping MySQL 8.0 and SQLite 3.45.4

Drupal also works with other open-source CMS projects. It is a member of the Open Website Alliance, with the community organizations behind Joomla, TYPO3 and WordPress.24

Security record

Drupal’s security team publishes advisories on Drupal.org and scores each one from 0 to 25 for risk, with 20 to 25 labeled highly critical.25

On October 15, 2014, advisory SA-CORE-2014-005, rated 25 out of 25, fixed a SQL injection flaw in Drupal 7, a bug that lets an attacker slip database commands into an ordinary request.26 A follow-up two weeks later said automated attacks had begun compromising unpatched Drupal 7 sites within hours of the announcement.27

The security team told owners to assume that any Drupal 7 site not patched by 11 p.m. UTC on October 15, seven hours after the announcement, had been compromised. It warned that updating to Drupal 7.32 would not remove back doors that attackers had already left.27

On March 28, 2018, advisory SA-CORE-2018-002 (CVE-2018-7600) fixed a remote code execution flaw, a bug that lets an outsider run their own code on the server, in Drupal 7 and 8. It was rated 24 out of 25.28

On October 14, 2026, SA-CORE-2026-014 (CVE-2026-108097), rated critical at 19 out of 25, fixed a remote code execution flaw in the core Field UI module. It affected Drupal 8.9 and later, including the supported Drupal 10 and 11 lines and early Drupal 12 test releases. Core alone did not expose it, but the advisory said contributed modules opened several ways in, at least one of which needed no login.29

A week later the PHP2Shell flaws in PHP itself put Drupal sites at risk regardless of Drupal’s own code. Wiz Research, one of the groups that found them, showed attacks with no login against the latest Drupal, WordPress and Joomla container images.30 Drupal’s security team told owners on October 21, 2026 that updating PHP was “the only complete mitigation.”31 The fixed PHP versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.32

Timeline

  1. Drupal's security team urges site owners to install the critical PHP update for the PHP2Shell flaws31
  2. SA-CORE-2026-014 fixes a critical remote code execution flaw in the Field UI module29
  3. Drupal 11.4.0 released; it becomes the recommended version for new sites20
  4. Drupal CMS 2.0 makes the Drupal Canvas visual editor the default23
  5. Drupal CMS 1.0 released on Drupal's 24th birthday22
  6. Drupal 7 reaches end of life after a final extension13
  7. Drupal 11.0.0 released14
  8. Drupal 10.0.0 released with Symfony 6.2 and CKEditor 519
  9. Drupal 9.0.0 released, billed as the easiest major upgrade in a decade17
  10. SA-CORE-2018-002 fixes a remote code execution flaw rated 24 out of 2528
  11. Drupal 8.0.0 released, built on Symfony components16
  12. SA-CORE-2014-005 SQL injection fix; automated attacks follow within hours27
  13. Drupal 7.0 released12
  14. Dries Buytaert and Jay Batson found Acquia11
  15. Drupal 1.0.0 released10

What it means for your website

Drupal is free to download, but running it means choosing hosting, a developer and an upkeep plan. A few points matter most for owners.

  • Budget for upkeep. Drupal needs web hosting and someone to apply updates. Security release windows usually fall on the third Wednesday of the month.14
  • Check your version now. Drupal 7 lost community security support on January 5, 2025, and Drupal 10 loses it on December 9, 2026.14 Drupal 11.4 is the recommended line for new sites.20 Leaving Drupal 7 is a content migration, not an update; our website migration entry explains what moves and what can break.
  • Keep PHP current. Drupal 11.3 and 11.4 support PHP 8.3 to 8.5.3 After the PHP2Shell disclosure, ask your host to confirm in writing that PHP was updated to one of the fixed releases published on October 21, 2026.3132
  • Install fewer modules. The October 2026 Field UI flaw could be reached through contributed modules even though core alone did not expose it.29 Every module is code you must keep updated, so remove the ones you no longer use.
  • Compare before you choose. In October 2026 W3Techs found Drupal on 0.6% of websites and WordPress on 39.6%.8 If you are picking a platform for a new site, see our builder vs WordPress vs agency guide and our CMS glossary entry.

See also

References

  1. About Drupal. Drupal.org. accessed October 22, 2026.
  2. Modules. Drupal.org. accessed October 22, 2026.
  3. PHP requirements. Drupal.org. accessed October 22, 2026.
  4. Database server requirements. Drupal.org. accessed October 22, 2026.
  5. Licensing. Drupal.org. accessed October 22, 2026.
  6. About Dries Buytaert. Dries Buytaert (dri.es). accessed October 22, 2026.
  7. Drupal Association. Drupal Association. accessed October 22, 2026.
  8. Usage statistics of content management systems. W3Techs. 2026-10-22. accessed October 22, 2026.
  9. Our history. Drupal.org. accessed October 22, 2026.
  10. Happy tenth birthday Drupal. Dries Buytaert (dri.es). 2011-01-15. accessed October 22, 2026.
  11. Drupal celebrates 20 years. Tami Wallace, Acquia. 2024-03-12. accessed October 22, 2026.
  12. drupal 7.0. Drupal.org. 2011-01-05. accessed October 22, 2026.
  13. Drupal 7 End of Life. Drupal.org. accessed October 22, 2026.
  14. Drupal core release schedule. Drupal.org. accessed October 22, 2026.
  15. Usage statistics and market share of Drupal. W3Techs. 2026-10-22. accessed October 22, 2026.
  16. Drupal 8.0.0 released. xjm, Drupal.org. 2015-11-19. accessed October 22, 2026.
  17. Move from Drupal 8 to 9. Drupal.org. accessed October 22, 2026.
  18. Drupal 9.0.0 released. Dries Buytaert (buytaert.net). accessed October 22, 2026.
  19. drupal 10.0.0. Drupal.org. 2022-12-15. accessed October 22, 2026.
  20. drupal 11.4.0. Drupal.org. 2026-07-01. accessed October 22, 2026.
  21. drupal 11.4.11. Drupal.org. 2026-10-21. accessed October 22, 2026.
  22. Drupal CMS 1.0 released. Dries Buytaert (dri.es). 2025-01-15. accessed October 22, 2026.
  23. Drupal CMS 2.0 is here: Visual building, AI, and site templates transform Drupal. Drupal.org. 2026-01-28. accessed October 22, 2026.
  24. WordPress Takes Its Turn Leading the Open Website Alliance. WordPress.org News. 2026-09-21. accessed October 22, 2026.
  25. Security risk levels defined. Drupal Security Team. accessed October 22, 2026.
  26. Drupal Core, SQL Injection, SA-CORE-2014-005. Drupal Security Team. 2014-10-15. accessed October 22, 2026.
  27. Drupal Core, Highly Critical, Public Service announcement, PSA-2014-003. Drupal Security Team. 2014-10-29. accessed October 22, 2026.
  28. Drupal core, Highly critical, Remote Code Execution, SA-CORE-2018-002. Drupal Security Team. 2018-03-28. accessed October 22, 2026.
  29. Drupal core, Critical, Remote code execution, SA-CORE-2026-014. Drupal Security Team. 2026-10-14. accessed October 22, 2026.
  30. PHP2Shell. Wiz Research (Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz). 2026-10-21. accessed October 22, 2026.
  31. Critical PHP update on Wednesday, October 21, 2026 (14:00 UTC), PSA-2026-10-20. Drupal Security Team. 2026-10-21. accessed October 22, 2026.
  32. Security advisory: Critical remote code execution vulnerabilities, update now. The PHP Group. 2026-10-21. accessed October 22, 2026.

Web Building Encyclopedia. First published October 22, 2026. Last reviewed October 22, 2026. Every fact on this page is linked to a source we opened. Spotted an error? Write to [email protected].