I have a custom module that I think requires Drupal 8.6.x.

Is Drupal core 8.6.18 insecure? Will more 8.6.x versions be released?

  • 5
    TL,DR: 1) Yes. 2) No. For maintenance schedule see drupal.org/core/release-cycle-overview and for security advisories see drupal.org/security and
    – Hudri
    Commented Dec 31, 2019 at 15:24
  • Thanks guys, I took the affected website offline. But, can someone explain to me what is "opinion-based" about this question and it was closed? There is a red banner displayed in Drupal that 8.6.18 has security problems (sounds like a fact to me). I could invest time now to update the problematic module, but a replacement website is already in the starting blocks without Drupal. :P
    – qräbnö
    Commented Jan 1, 2020 at 13:55
  • 1
    Actually, this is not an opinion-based question: It's possible to say if Drupal 8.6.x is secure by looking at the 8.7.x, 8.8.x, or 8.9.x versions released because of security issues. There isn't anything subjective in that. While the question is asking about the 8.6.18 version, the answer is still relevant for future versions, since it points out the release cycle is documented.
    – apaderno
    Commented Jan 11, 2020 at 12:51

1 Answer 1


According to the Drupal core release cycle documentation, the last month for security coverage for 8.6 was November 2019. There is no more planned security coverage for 8.6.

Security releases only last through the next minor release cycle. I.e. 1.0 will receive patch and security releases until 1.1 is released. Then 1.0 will continue to receive security coverage until 1.2 is released. Once 1.2 is released (the second minor release since 1.0), 1.0 is considered unsupported.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.