Drupal Security Team Sets Critical Core Release for 14 October

The Drupal Security Team has scheduled a critical core security release for 14 October 2026, between 16:00 and 21:00 UTC. Its 12 October public service announcement says all supported core branches are affected. The vulnerability has a Critical risk rating of 19 out of 25.

Site operators have a short window to prepare before the technical details become public. The Security Team recommends installing the latest supported bug-fix release for each site’s Drupal branch before 14 October. This gives teams time to resolve other update problems ahead of the security release. The team warns that exploits might be developed within hours or days after disclosure.

The affected branches are Drupal 11.4.x, 11.3.x and 10.6.x. Drupal 12.0.0-beta1 is also affected, with new beta releases expected after the supported branches receive their security updates. Versions earlier than 10.6.x, and Drupal 11 versions earlier than 11.3.x, are end-of-life. The Security Team advises sites on those versions to move to supported releases as soon as possible because they lack security coverage.

The published risk string, AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:All, gives more detail than the headline score. Under Drupal's security risk definitions, it describes a vulnerability that anonymous users could exploit, that could expose or modify all non-public data, and that affects all configurations, although exploitation involves a complex, multi-step process. The exploit metric is theoretical, meaning no public exploit code or documentation for developing one was known when the issue was assessed.

The announcement says the issue is protected by Drupal Steward, the virtual patching service for Drupal sites. Sites using Steward are already protected from some known attack vectors, but the Security Team states that this protection will not cover all possible exploits. It advises those sites to upgrade in the near future in case additional attack vectors are discovered.

A previous core security release illustrates why the team urges prompt preparation, although it concerns a different vulnerability. On 20 May 2026, the Security Team released SA-CORE-2026-004, a pre-announced, highly critical SQL injection vulnerability in core, tracked as CVE-2026-9082, that affected sites using PostgreSQL databases. Researchers at runtime security vendor Miggo Security reported building a working exploit with the Claude AI model less than an hour after the patch was published, at a token cost below US$10, although a researcher had to intervene to overcome one syntax obstacle. On 22 May, the Security Team updated the advisory to reflect that exploit attempts were being detected in the wild.

Imperva subsequently reported more than 15,000 attack attempts against almost 6,000 sites in 65 countries, while noting that most of the activity appeared to be probing, according to The Hacker News. The US Cybersecurity and Infrastructure Security Agency (CISA) also added the flaw to its Known Exploited Vulnerabilities catalogue. The October notice rates the new issue as affecting all configurations, unlike the uncommon configuration exposure described in the May advisory. As of the 12 October advance notice, exploitation of the October vulnerability remained theoretical; no exploit against it was disclosed.

The core release also follows a busy period for contributed-project advisories. The Security Team's 21 September public service announcement warned of a critical release for a widely used contributed module, which The DropTimes reported carried a Critical 16/25 score and was not covered by Drupal Steward. The 23 September disclosure produced 36 advisories across 16 projects, including 20 for Webform and a remote code execution vulnerability scored 18/25, as documented in The DropTimes' follow-up coverage. On 9 October, The DropTimes reported a further 26 contributed-project advisories, led by a highly critical Block AJAX flaw.

The October announcement does not identify the vulnerable component, CVE identifiers or fixed version numbers. Under the Security Team's disclosure policy, no further information will be released until the announcement is made. Release details will appear on the Drupal.org security advisory page and its RSS feeds, the #security-team channel in Drupal community Slack, the Security Team's social media accounts and its email list.

Drupal's core update documentation recommends backing up site files and databases, reviewing release notes, testing updates before production deployment and checking site status after updating. In guidance published on 12 October, Drupal agency Droptica adds steps aimed at release day: naming who deploys and approves the update, with a backup person; keeping staging aligned with production; preparing a rollback; and checking logs after deployment for unusual requests, new administrator accounts and unexpected PHP files in the files directory. The agency also notes that core security windows tend to fall in the European afternoon and evening, often after site teams have finished their working day.

Before the 14 October release window, site teams should confirm installed versions, resolve outstanding update problems and arrange deployment cover. Once the releases are available, administrators should review the published advisories and deploy the appropriate fixes promptly.