October 2026 - Security-news - lists.drupal.org

Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-222 Project: Zero Point [1] Project machine name: zeropoint Date: 2026-October-21 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <1.30.0 || >=2.0.0 <2.0.1 CVE IDs: CVE-2026-114528 Description: The ZeroPoint theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This vulnerability is mitigated by the requirement that the attacker must be able to create or modify menu link titles, either through menu administration or through content menu settings where permitted. Solution: Install the latest version: * If you use Zero Point 8.x-1.x, upgrade to Zero Point 8.x-1.30 [3]. * If you use Zero Point 2.0.x, upgrade to Zero Point 2.0.1 [4]. Reported By: * Drew Webber (mcdruid) [5] of the Drupal Security Team Fixed By: * Florian Radut (florian) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Drew Webber (mcdruid) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/zeropoint [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/zeropoint/releases/8.x-1.30 [4] https://www.drupal.org/project/zeropoint/releases/2.0.1 [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/florian [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/poker10 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-221 Project: UI Icons [1] Project machine name: ui_icons Date: 2026-October-21 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Affected versions: <1.1.3 || >=2.0.0 <2.0.2 CVE IDs: CVE-2026-114527 Description: This module provides a user interface to select and configure icons, including a form element, a text format filter and several integrations. The module doesn't sufficiently validate icon settings provided by users before they are rendered. Solution: Install the latest version: * If you use the UI Icons 2.0.x module, upgrade to UI Icons 2.0.2 [3] * If you use the UI Icons 1.1.x module, upgrade to UI Icons 1.1.3 [4] UI Icons 1.0.x is not supported. Sites using it should upgrade to UI Icons 1.1.3 or 2.0.2. Reported By: * André Angelantoni (aangel) [5] * Octavio Galland (ogalland-tob) [6] Fixed By: * Jean Valverde (mogtofu33) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Dave Long (longwave) [10] of the Drupal Security Team * Drew Webber (mcdruid) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/ui_icons [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/ui_icons/releases/2.0.2 [4] https://www.drupal.org/project/ui_icons/releases/1.1.3 [5] https://www.drupal.org/u/aangel [6] https://www.drupal.org/u/ogalland-tob [7] https://www.drupal.org/u/mogtofu33 [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/longwave [11] https://www.drupal.org/u/mcdruid [12] https://www.drupal.org/u/poker10 [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-220 Project: Ffmpeg Image Toolkit [1] Project machine name: ffmpeg_image_toolkit Date: 2026-October-21 Security risk: *Highly critical* 20 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Remote Code Execution Affected versions: <1.0.3 CVE IDs: CVE-2026-114523 Description: This module enables you to use ffmpeg for image conversion The module doesn't sufficiently sanitize file names passed to the ffmpeg cli tool. This vulnerability is mitigated by the fact that an attacker must be able to upload images on the site. Solution: Install the latest version: * If you use the Ffmpeg Image Toolkit 1.x, upgrade to Ffmpeg Image Toolkit 1.0.3 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Marcin Grabias (graber) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/ffmpeg_image_toolkit [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/ffmpeg_image_toolkit/releases/1.0.3 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/graber [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Critical PHP update on Wednesday, October 21, 2026 (14:00 UTC) - PSA-2026-10-20
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/psa-2026-10-20 Date: 2026-October-21 Description: PHP has announced a critical PHP security release [1] for Wednesday, October 21, 2026, at 14:00 UTC. We recommend that all Drupal site owners reserve time to ensure their PHP version is updated as soon as the release is available. .... Site owners are responsible for maintaining the security of their hosting platform It is the policy of the Drupal Security Team that site owners are responsible for monitoring and maintaining the security of third-party libraries and any non-Drupal components of the application andhosting platform. In rare cases, the Drupal Security Team will post an informational public service announcement [2] (PSA) such as this one, but the remit of the Drupal Security Team remains limited to code hosted on Drupal.org’s systems. Previous PSAs on third-party code in the Drupal ecosystem include: * External libraries and plugins - PSA-2011-002 [3] * Various Third-Party Vulnerabilities - PSA-2019-09-04 [4] * Third-Party Libraries and Supply Chains - PSA-2024-06-26 [5] * Third-Party Libraries and Supply Chains - PSA-2025-09-17 [6] /This post is likely to be updated as the situation evolves and more information is available./ Coordinated By: * James Gilliland (neclimdul) [7] of the Drupal Security Team * Angie Byron (webchick) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.php.net/archive/2026.php#2026-10-20-1 [2] https://www.drupal.org/security/psa [3] https://www.drupal.org/node/1189632 [4] https://www.drupal.org/psa-2019-09-04 [5] https://www.drupal.org/psa-2024-06-26 [6] https://www.drupal.org/psa-2025-09-17 [7] https://www.drupal.org/u/neclimdul [8] https://www.drupal.org/u/webchick [9] https://www.drupal.org/u/xjm [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218
by security-news＠drupal.org 14 Oct '26

14 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-218 Project: Entity List [1] Project machine name: entity_list Date: 2026-October-14 Security risk: *Critical* 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Remote code execution Affected versions: <3.0.10 CVE IDs: CVE-2026-108099 Description: The Entity List module provides a way to create lists of entities without Views. The module has a remote code execution vulnerability. The vulnerability is not directly exploitable with the module alone, but multiple serious exploit paths exist with other contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality. Solution: Install the latest version: * Upgrade to Entity List 3.0.10 [3]. Reported By: * Lee Rowlands (larowlan) [4] of the Drupal Security Team * Dave Long (longwave) [5] of the Drupal Security Team * Drew Webber (mcdruid) [6] of the Drupal Security Team * Octavio Galland (ogalland-tob) [7] Fixed By: * catch (catch) [8] of the Drupal Security Team * Lee Rowlands (larowlan) [9] of the Drupal Security Team * Dave Long (longwave) [10] of the Drupal Security Team * Marc-Antoine MARTY (martygraphie) [11] * Drew Webber (mcdruid) [12] of the Drupal Security Team * Jess (xjm) [13] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [14] of the Drupal Security Team * Bram Driesen (bramdriesen) [15] of the Drupal Security Team * catch (catch) [16] of the Drupal Security Team * Damien McKenna [17] of the Drupal Security Team * Greg Knaddison (greggles) [18] of the Drupal Security Team * Tim Hestenes Lehnen (hestenet) [19] * Lee Rowlands (larowlan) [20] of the Drupal Security Team * Dave Long (longwave) [21] of the Drupal Security Team * Drew Webber (mcdruid) [22] of the Drupal Security Team * Juraj Nemec (poker10) [23] of the Drupal Security Team * Pierre Rudloff (prudloff) [24] of the Drupal Security Team * Jess (xjm) [25] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [26] [1] https://www.drupal.org/project/entity_list [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/entity_list/releases/3.0.10 [4] https://www.drupal.org/u/larowlan [5] https://www.drupal.org/u/longwave [6] https://www.drupal.org/u/mcdruid [7] https://www.drupal.org/u/ogalland-tob [8] https://www.drupal.org/u/catch [9] https://www.drupal.org/u/larowlan [10] https://www.drupal.org/u/longwave [11] https://www.drupal.org/u/martygraphie [12] https://www.drupal.org/u/mcdruid [13] https://www.drupal.org/u/xjm [14] https://www.drupal.org/u/akalata [15] https://www.drupal.org/u/bramdriesen [16] https://www.drupal.org/u/catch [17] https://www.drupal.org/u/damienmckenna [18] https://www.drupal.org/u/greggles [19] https://www.drupal.org/u/hestenet [20] https://www.drupal.org/u/larowlan [21] https://www.drupal.org/u/longwave [22] https://www.drupal.org/u/mcdruid [23] https://www.drupal.org/u/poker10 [24] https://www.drupal.org/u/prudloff [25] https://www.drupal.org/u/xjm [26] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219
by security-news＠drupal.org 14 Oct '26

14 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-219 Project: Gin Admin Theme [1] Project machine name: gin Date: 2026-July-07 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Affected versions: <4.1.4 || >=5.0.0 <5.0.16 CVE IDs: CVE-2026-110738 Description: Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators. The module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes or the administer menu permission. Solution: Install the latest version: * If you use version 4 of the Gin theme, upgrade to Gin 4.1.4 [3]. * If you use version 5 of the Gin theme, upgrade to Gin 5.0.16 [4]. Reported By: * Pablo López (plopesc) [5] Fixed By: * Jürgen Haas (jurgenhaas) [6] Coordinated By: * catch (catch) [7] of the Drupal Security Team * Damien McKenna [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Dave Long (longwave) [10] of the Drupal Security Team * Mohit Aghera (mohit_aghera) [11], provisional member of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/gin [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/gin/releases/4.1.4 [4] https://www.drupal.org/project/gin/releases/5.0.16 [5] https://www.drupal.org/u/plopesc [6] https://www.drupal.org/u/jurgenhaas [7] https://www.drupal.org/u/catch [8] https://www.drupal.org/u/damienmckenna [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/longwave [11] https://www.drupal.org/u/mohit_aghera [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016
by security-news＠drupal.org 14 Oct '26

14 Oct '26

View online: https://www.drupal.org/sa-core-2026-016 Project: Drupal core [1] Project machine name: drupal Date: 2026-July-13 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108514 Description: The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission. Solution: Install the latest version: *Drupal 11* * If you use Drupal 11.4.x, update to Drupal 11.4.10 [3]. * If you use Drupal 11.3.x, update to Drupal 11.3.19 [4]. * Drupal 11.2.x and below are end-of-life and do not receive security coverage. *Drupal 10* * If you use Drupal 10.6.x, update to Drupal 10.6.19 [5]. * Drupal 10.5.x and below are end-of-life and do not receive security coverage. Drupal 8 [6] and Drupal 9 [7] have both reached end-of-life. Reported By: * Eric Tee (erictee2802) [8] * haii haii (hai27ii2o) [9] Fixed By: * Benji Fisher (benjifisher) [10] of the Drupal Security Team * Jürgen Haas (jurgenhaas) [11] * Lee Rowlands (larowlan) [12] of the Drupal Security Team * Mingsong (mingsong) [13] * Mohit Aghera (mohit_aghera) [14], provisional member of the Drupal Security Team * James Gilliland (neclimdul) [15] of the Drupal Security Team * Pablo López (plopesc) [16] * Juraj Nemec (poker10) [17] of the Drupal Security Team * Pierre Rudloff (prudloff) [18] of the Drupal Security Team Coordinated By: * cilefen (cilefen) [19] of the Drupal Security Team * Lee Rowlands (larowlan) [20] of the Drupal Security Team * Dave Long (longwave) [21] of the Drupal Security Team * James Gilliland (neclimdul) [22] of the Drupal Security Team * Juraj Nemec (poker10) [23] of the Drupal Security Team * Pierre Rudloff (prudloff) [24] of the Drupal Security Team * Jess (xjm) [25] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [26] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/drupal/releases/11.4.10 [4] https://www.drupal.org/project/drupal/releases/11.3.19 [5] https://www.drupal.org/project/drupal/releases/10.6.19 [6] https://www.drupal.org/psa-2021-06-29 [7] https://www.drupal.org/psa-2023-11-01 [8] https://www.drupal.org/u/erictee2802 [9] https://www.drupal.org/u/hai27ii2o [10] https://www.drupal.org/u/benjifisher [11] https://www.drupal.org/u/jurgenhaas [12] https://www.drupal.org/u/larowlan [13] https://www.drupal.org/u/mingsong [14] https://www.drupal.org/u/mohit_aghera [15] https://www.drupal.org/u/neclimdul [16] https://www.drupal.org/u/plopesc [17] https://www.drupal.org/u/poker10 [18] https://www.drupal.org/u/prudloff [19] https://www.drupal.org/u/cilefen [20] https://www.drupal.org/u/larowlan [21] https://www.drupal.org/u/longwave [22] https://www.drupal.org/u/neclimdul [23] https://www.drupal.org/u/poker10 [24] https://www.drupal.org/u/prudloff [25] https://www.drupal.org/u/xjm [26] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015
by security-news＠drupal.org 14 Oct '26

14 Oct '26

View online: https://www.drupal.org/sa-core-2026-015 Project: Drupal core [1] Project machine name: drupal Date: 2026-September-17 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108515 Description: The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities. Solution: Install the latest version: *Drupal 11* * If you use Drupal 11.4.x, update to Drupal 11.4.10 [3]. * If you use Drupal 11.3.x, update to Drupal 11.3.19 [4]. * Drupal 11.2.x and below are end-of-life and do not receive security coverage. *Drupal 10* * If you use Drupal 10.6.x, update to Drupal 10.6.19 [5]. * Drupal 10.5.x and below are end-of-life and do not receive security coverage. Drupal 8 [6] and Drupal 9 [7] have both reached end-of-life. Reported By: * dev-winty [8] Fixed By: * Benji Fisher (benjifisher) [9] of the Drupal Security Team * catch (catch) [10] of the Drupal Security Team * David Cameron (dcam) [11] * Shawn Duncan (fathershawn) [12] * Lee Rowlands (larowlan) [13] of the Drupal Security Team * Drew Webber (mcdruid) [14] of the Drupal Security Team * Mohit Aghera (mohit_aghera) [15], provisional member of the Drupal Security Team * Jess (xjm) [16] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [17] of the Drupal Security Team * Benji Fisher (benjifisher) [18] of the Drupal Security Team * Neil Drumm (drumm) [19] of the Drupal Security Team * Greg Knaddison (greggles) [20] of the Drupal Security Team * Dave Long (longwave) [21] of the Drupal Security Team * James Gilliland (neclimdul) [22] of the Drupal Security Team * Juraj Nemec (poker10) [23] of the Drupal Security Team * Ra Mänd (ram4nd) [24] * Jess (xjm) [25] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [26] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/drupal/releases/11.4.10 [4] https://www.drupal.org/project/drupal/releases/11.3.19 [5] https://www.drupal.org/project/drupal/releases/10.6.19 [6] https://www.drupal.org/psa-2021-06-29 [7] https://www.drupal.org/psa-2023-11-01 [8] https://www.drupal.org/u/dev-winty [9] https://www.drupal.org/u/benjifisher [10] https://www.drupal.org/u/catch [11] https://www.drupal.org/u/dcam [12] https://www.drupal.org/u/fathershawn [13] https://www.drupal.org/u/larowlan [14] https://www.drupal.org/u/mcdruid [15] https://www.drupal.org/u/mohit_aghera [16] https://www.drupal.org/u/xjm [17] https://www.drupal.org/u/akalata [18] https://www.drupal.org/u/benjifisher [19] https://www.drupal.org/u/drumm [20] https://www.drupal.org/u/greggles [21] https://www.drupal.org/u/longwave [22] https://www.drupal.org/u/neclimdul [23] https://www.drupal.org/u/poker10 [24] https://www.drupal.org/u/ram4nd [25] https://www.drupal.org/u/xjm [26] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Drupal core - Critical - Remote code execution - SA-CORE-2026-014
by security-news＠drupal.org 14 Oct '26

14 Oct '26

View online: https://www.drupal.org/sa-core-2026-014 Project: Drupal core [1] Project machine name: drupal Date: 2026-October-14 Security risk: *Critical* 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Remote code execution Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108097 Description: A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality. The vulnerability can be mitigated by uninstalling the core Field UI module (field_ui), which will provide protection while sites are updated. .. Drupal Steward protection: This issue is being protected by Drupal Steward [3]. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered. Solution: Install the latest version: *Drupal 11* * If you use Drupal 11.4.x, update to Drupal 11.4.10 [4]. * If you use Drupal 11.3.x, update to Drupal 11.3.19 [5]. * Drupal 11.2.x and below are end-of-life and do not receive security coverage. *Drupal 10* * If you use Drupal 10.6.x, update to Drupal 10.6.19 [6]. * Drupal 10.5.x and below are end-of-life and do not receive security coverage. Drupal 8 [7] and Drupal 9 [8] have both reached end-of-life. Release packaging may still be in progress for this security announcement. If you are unable to access a release, wait 30-45 minutes and then check again. Reported By: * Drew Webber (mcdruid) [9] of the Drupal Security Team * Octavio Galland (ogalland-tob) [10] Fixed By: * catch (catch) [11] of the Drupal Security Team * Lee Rowlands (larowlan) [12] of the Drupal Security Team * Dave Long (longwave) [13] of the Drupal Security Team * Drew Webber (mcdruid) [14] of the Drupal Security Team * Jess (xjm) [15] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [16] of the Drupal Security Team * Bram Driesen (bramdriesen) [17] of the Drupal Security Team * catch (catch) [18] of the Drupal Security Team * Greg Knaddison (greggles) [19] of the Drupal Security Team * Tim Hestenes Lehnen (hestenet) [20] * Lee Rowlands (larowlan) [21] of the Drupal Security Team * Dave Long (longwave) [22] of the Drupal Security Team * Drew Webber (mcdruid) [23] of the Drupal Security Team * Juraj Nemec (poker10) [24] of the Drupal Security Team * Pierre Rudloff (prudloff) [25] of the Drupal Security Team * Jess (xjm) [26] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [27] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/steward [4] https://www.drupal.org/project/drupal/releases/11.4.10 [5] https://www.drupal.org/project/drupal/releases/11.3.19 [6] https://www.drupal.org/project/drupal/releases/10.6.19 [7] https://www.drupal.org/psa-2021-06-29 [8] https://www.drupal.org/psa-2023-11-01 [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/ogalland-tob [11] https://www.drupal.org/u/catch [12] https://www.drupal.org/u/larowlan [13] https://www.drupal.org/u/longwave [14] https://www.drupal.org/u/mcdruid [15] https://www.drupal.org/u/xjm [16] https://www.drupal.org/u/akalata [17] https://www.drupal.org/u/bramdriesen [18] https://www.drupal.org/u/catch [19] https://www.drupal.org/u/greggles [20] https://www.drupal.org/u/hestenet [21] https://www.drupal.org/u/larowlan [22] https://www.drupal.org/u/longwave [23] https://www.drupal.org/u/mcdruid [24] https://www.drupal.org/u/poker10 [25] https://www.drupal.org/u/prudloff [26] https://www.drupal.org/u/xjm [27] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Upcoming critical Drupal core release on October 14, 2026 - PSA-2026-10-12
by security-news＠drupal.org 12 Oct '26

12 Oct '26

View online: https://www.drupal.org/psa-2026-10-12 Date: 2026-October-12 Security risk: *Critical* 19 ∕ 25 AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:All [1] Description: There will be a *Drupal core security release* for all supported branches on *October 14, 2026 between 16:00 and 21:00 UTC*. (To see this in your local timezone, refer to the Drupal Core Calendar [2].) Based on our analysis this vulnerability rates at 19/25 on our risk calculator. The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days. *We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before October 14*, so that you can address any other upgrade issues before the security window. This issue is being protected by Drupal Steward [3]. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered. .... Affected versions All currently supported versions of Drupal core are affected, including: * Drupal 11.4.x * Drupal 11.3.x * Drupal 10.6.x Drupal 12.0.0-beta1 is also affected. New beta releases will be provided following the security updates for the supported branches. All versions of Drupal prior to 10.6.x, as well as all versions of Drupal 11 prior to 11.3.x, are end-of-life and no longer supported. Sites on those versions should update as soon as possible to avoid this and other publicly disclosed vulnerabilities. .... Disclosure policy Neither the Security Team nor any other party is able to release any more information about this vulnerability until the announcement is made. Security release announcements will appear on the Drupal.org security advisory page [4], which has RSS feeds. The announcement will also be made public on: * The #security-team channel of the Drupal community Slack [5] * Bluesky [6] * Mastodon [7] * X (formerly Twitter) [8] * LinkedIn [9] * By email for those who have subscribed to our email list. (To subscribe to the email list: log in on Drupal.org, go to your user profile page and subscribe to the security newsletter on the Edit » My newsletters tab.) Coordinated By: * Bram Driesen (bramdriesen) [10] of the Drupal Security Team * catch (catch) [11] of the Drupal Security Team * Damien McKenna (damienmckenna) [12] of the Drupal Security Team * Greg Knaddison (greggles) [13] of the Drupal Security Team * Lee Rowlands (larowlan) [14] of the Drupal Security Team * Dave Long (longwave) [15] of the Drupal Security Team * Drew Webber (mcdruid) [16] of the Drupal Security Team * Michael Hess (mlhess) [17] of the Drupal Security Team * Juraj Nemec (poker10) [18] of the Drupal Security Team * Jess (xjm) [19] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [20] [1] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [2] https://calendar.google.com/calendar/r?cid=drupalcorecalendar@association.d… [3] https://new.drupal.org/steward [4] https://www.drupal.org/security [5] https://www.drupal.org/slack [6] https://bsky.app/profile/drupalsecurity.bsky.social [7] https://drupal.community/@drupalsecurity [8] https://x.com/drupalsecurity [9] https://www.linkedin.com/showcase/drupal-security-team/ [10] https://www.drupal.org/u/bramdriesen [11] https://www.drupal.org/u/catch [12] https://www.drupal.org/u/damienmckenna [13] https://www.drupal.org/u/greggles [14] https://www.drupal.org/u/larowlan [15] https://www.drupal.org/u/longwave [16] https://www.drupal.org/u/mcdruid [17] https://www.drupal.org/u/mlhess [18] https://www.drupal.org/u/poker10 [19] https://www.drupal.org/u/xjm [20] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0