Drupal Core

The vulnerabilities depend on different permissions and configurations, but supported sites should still install the appropriate security release. Maintainers of contributed modules that handle HTMX attributes or implement custom stream wrappers should review the accompanying hardening. ...more

The latest Drupal 11.4 patch closes a routing regression that had remained visible after the previous bugfix release. The update also gives site teams a concise set of core fixes to review as the 11.4 branch settles after its initial release. ...more

Drupal core now has a CLI path that modules can target, but most production workflows still belong to Drush. ...more

Generated code may work on launch day. The harder test is whether a team can review, maintain, and secure it when a platform advisory becomes urgent. ...more

Drupal’s compiled CSS pipeline exists partly to bridge browser gaps. Container style queries now offer a possible path to simpler theme CSS once core’s support policy catches up. ...more

Routine site work changes in this minor release: installs run faster, key dependency updates can move sooner, and core gains the first stage of an extensible command line. ...more

Release timing is often treated as calendar work, but the 11.4.0 delay exposed a dependency problem beneath the schedule. The fix changes how selected Composer dependencies can move when security updates land. ...more

Drupal core committer Théodore Biadala has pointed large Drupal-using organisations to the Triptych Project, a standards proposal that would add three HTML capabilities: PUT, PATCH, and DELETE methods, button actions without forms, and partial page replacement. The request seeks non-binding support letters for a grant application led by Alexander Petros and Carson Gross, while framing the proposal as a possible way to reduce custom JavaScript and simplify parts of Drupal’s form handling, BigPipe behaviour, admin interfaces, and contributed modules. The source post does not include Drupal implementation examples, so the potential impact remains directional rather than measured. ...more

The Drupal Security Team’s 17 June 2026 advisory batch affects supported Drupal 10 and 11 branches and three contributed modules. The most consequential issues involve PHP object injection under rare JSON:API write conditions, server-side request forgery through oEmbed URL discovery, and incomplete validation of MIME types during image uploads. Site teams should treat the batch as an update and configuration check, not as a single universal Drupal exposure, because several critical advisories depend on specific field types, write permissions, or module installations. ...more

F5 Labs’ Sensor Intel report adds sensor-level evidence to the CVE-2026-9082 response, documenting how scanners probed Drupal JSON:API endpoints after disclosure rather than revisiting the advisory itself. Its useful contribution is the traffic pattern: 576 attempts from nine source IPs, common node endpoint rotation, correct JSON:API headers, blind SQL injection confirmation checks, and web application firewall evasion patterns that can help defenders tune monitoring beyond simple patch-status checks. ...more

Drupal 11.4.0-rc1 is available for pre-stable testing ahead of the scheduled Drupal 11.4.0 release. The release candidate is not supported for production sites, but it gives contributors, maintainers, translators, and site teams a defined window to test compatibility, review changes, and report issues before the next Drupal 11 minor release is finalised. ...more

Drupal.org’s core release schedule, updated on 4 June 2026, confirms the main 2026 planning dates for Drupal 11, Drupal 12, and Drupal 10. Drupal 11.4.0 is listed for the week of 22 June 2026 UTC, while Drupal 12.0.0 and Drupal 11.5.0 are scheduled for the week of 7 December 2026 UTC. Drupal 10 reaches end of life on 9 December 2026, making the schedule useful for upgrade planning rather than a new release announcement. ...more