View online: https://www.drupal.org/psa-2026-10-12 Date: 2026-October-12 Security risk: *Critical* 19 ∕ 25 AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:All [1] Description: There will be a *Drupal core security release* for all supported branches on *October 14, 2026 between 16:00 and 21:00 UTC*. (To see this in your local timezone, refer to the Drupal Core Calendar [2].) Based on our analysis this vulnerability rates at 19/25 on our risk calculator. The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days. *We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before October 14*, so that you can address any other upgrade issues before the security window. This issue is being protected by Drupal Steward [3]. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered. .... Affected versions All currently supported versions of Drupal core are affected, including: * Drupal 11.4.x * Drupal 11.3.x * Drupal 10.6.x Drupal 12.0.0-beta1 is also affected. New beta releases will be provided following the security updates for the supported branches. All versions of Drupal prior to 10.6.x, as well as all versions of Drupal 11 prior to 11.3.x, are end-of-life and no longer supported. Sites on those versions should update as soon as possible to avoid this and other publicly disclosed vulnerabilities. .... Disclosure policy Neither the Security Team nor any other party is able to release any more information about this vulnerability until the announcement is made. Security release announcements will appear on the Drupal.org security advisory page [4], which has RSS feeds. The announcement will also be made public on: * The #security-team channel of the Drupal community Slack [5] * Bluesky [6] * Mastodon [7] * X (formerly Twitter) [8] * LinkedIn [9] * By email for those who have subscribed to our email list. (To subscribe to the email list: log in on Drupal.org, go to your user profile page and subscribe to the security newsletter on the Edit » My newsletters tab.) Coordinated By: * Bram Driesen (bramdriesen) [10] of the Drupal Security Team * catch (catch) [11] of the Drupal Security Team * Damien McKenna (damienmckenna) [12] of the Drupal Security Team * Greg Knaddison (greggles) [13] of the Drupal Security Team * Lee Rowlands (larowlan) [14] of the Drupal Security Team * Dave Long (longwave) [15] of the Drupal Security Team * Drew Webber (mcdruid) [16] of the Drupal Security Team * Michael Hess (mlhess) [17] of the Drupal Security Team * Juraj Nemec (poker10) [18] of the Drupal Security Team * Jess (xjm) [19] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [20] [1] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [2] https://calendar.google.com/calendar/r?cid=drupalcorecalendar@association.dr... [3] https://new.drupal.org/steward [4] https://www.drupal.org/security [5] https://www.drupal.org/slack [6] https://bsky.app/profile/drupalsecurity.bsky.social [7] https://drupal.community/@drupalsecurity [8] https://x.com/drupalsecurity [9] https://www.linkedin.com/showcase/drupal-security-team/ [10] https://www.drupal.org/u/bramdriesen [11] https://www.drupal.org/u/catch [12] https://www.drupal.org/u/damienmckenna [13] https://www.drupal.org/u/greggles [14] https://www.drupal.org/u/larowlan [15] https://www.drupal.org/u/longwave [16] https://www.drupal.org/u/mcdruid [17] https://www.drupal.org/u/mlhess [18] https://www.drupal.org/u/poker10 [19] https://www.drupal.org/u/xjm [20] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....