Drupal Security retweeted
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
340
4,167
18,558
7,091,233
Thrilled to announce that four provisional members have earned full membership on the Drupal Security Team!
Welcome:
🇫🇷 Pierre Rudloff
🇦🇺 Joseph Zhao
🇧🇪 Bram Driesen
🇺🇸 Swan Kalata
drupal.org/drupal-securit…
#Drupal #OpenSource #Security
Welcome:
🇫🇷 Pierre Rudloff
🇦🇺 Joseph Zhao
🇧🇪 Bram Driesen
🇺🇸 Swan Kalata
drupal.org/drupal-securit…
#Drupal #OpenSource #Security
0
0
12
1,186
Details on the Steward program and how to join are at drupal.org/drupal-securit…
0
0
0
44
The Drupal Security Team estimates that up to 5% of Drupal sites may be vulnerable to this highly critical issue. Furthermore, a majority of Drupal sites may also be affected by the Symfony and Twig security advisories published today, so all sites should update soon.
1
4
7
1,898
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 read more at drupal.org/sa-core-2026-0…
2
9
22
14,610
You can remove the `-recommended` part of that and then do the updates. If you prefer using -recommended in the long run, you could switch back to it later today.
1
0
1
596
Site owners are encouraged to get their sites ready for a release of Drupal core that may affect them. Site owners should make upgrades easier (e.g. update to the most recent release, improve deployment automation, improve automated testing) given the current security climate.
0
1
7
1,433
Upcoming highly critical release on May 20, 2026 - PSA-2026-05-18 Read more: drupal.org/psa-2026-05-18
1
14
18
6,010
The Drupal Security Team now has a Linkedin page. It will be for longer-form content than this channel, so participating in both communities is encouraged. Follow here linkedin.com/showcase/drupa…
1
5
14
1,650
Drupal Security Advisory content is automatically posted to other social/feed services like bsky.app/profile/drupal… and drupal.community/@drupalsecurity
1
0
1
2,533
New Drupal core releases address XSS, access bypass, and a gadget chain hardening. The XSS issue is protected by the Drupal Steward service. Details on all 3 issues available at drupal.org/sa-core-2025-0… drupal.org/sa-core-2025-0… drupal.org/sa-core-2025-0…
0
1
9
1,165
Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002 drupal.org/sa-core-2024-0… Only Drupal 10.0 through 10.2 are affected.
0
2
4
1,598
Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041 dlvr.it/TDP7b6
0
3
1
897
File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040 dlvr.it/TD6pWt
0
3
2
861
Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039 dlvr.it/TD6pWK
0
2
1
749
Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038 dlvr.it/TCqRyz
0
0
1
769
Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037 dlvr.it/TCqRyZ
0
2
2
656
Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036 dlvr.it/TCqRyR
0
1
1
548
Content Entity Clone - Moderately critical - Information Disclosure - SA-CONTRIB-2024-035 dlvr.it/TCqRyP
0
3
1
529