A highly critical Drupal core security release affecting all supported branches of Drupal is scheduled for 20 May 2026 between 17:00 and 21:00 UTC, according to an advance notice published by the Drupal Security Team. The advisory also includes unusual mitigation support for unsupported Drupal 8, Drupal 9, Drupal 10.4, and Drupal 11.1 branches, reflecting the potential severity of the issue. Site owners and administrators have been urged to reserve emergency maintenance time to evaluate whether their configurations are affected and apply updates immediately where required, because exploit code could emerge shortly after public disclosure.
...more