Drupal Releases Three Core Patches With PHP Configuration Updates

Three production-ready maintenance releases for Drupal core became available on 21 October 2026. The updates cover Drupal 11.4.11, 11.3.20 and 10.6.20. According to the official release notes, all three are bug-fix releases suitable for production websites.

The updates include changes to the Apache .htaccess file that site administrators may need to apply manually. Drupal has replaced the deprecated assert.active setting with zend.assertions. The release notes instruct site owners to replace php_value assert.active 0 with php_value zend.assertions 0 where the existing directive is present. The change follows PHP's deprecation of older assertion settings, as documented in a Drupal core change record updated on 20 October 2026.

The .htaccess directive applies to Apache installations using mod_php. Drupal's change record also documents corresponding changes for .user.ini and settings.local.php where deprecated assertion settings are used. The release notes state that zend.assertions=-1 is recommended for production performance when configured through PHP's hosting settings, but cannot be set at runtime in .htaccess.

All three releases update symfony/http-foundation and symfony/yaml to version 7.4.21, guzzlehttp/guzzle to 7.15.2 and composer/composer to 2.10.3. The Drupal 11.4.11 release also lists corrections involving field-purge configuration, batch-processing behaviour affected by query-string parameter order, and migration-plugin documentation.

Drupal 11.4.x will continue receiving security coverage until June 2027, while the 11.3.x and 10.6.x branches are covered until December 2026. Site maintainers can apply the appropriate release through Composer and review the official update instructions for any site-managed configuration changes.