Organizations staying on a previous Drupal minor release will have roughly two months after its successor arrives before security coverage ends. The tighter window comes as maintainers confront rising vulnerability reports and shrinking release-management funding.