Drupal Security

Security

Drupal Security Team Marks 16 Contributed Projects Unsupported in Ten Weeks

Share

× SHARE

The latest three projects have limited reported use, but the pattern extends beyond their reach. For affected site teams, the recurring security response is to uninstall the project rather than install an update. ...more

Read Full Content
Security

Five Drupal Advisories Span Access Bypass and SSRF Risks

Share

× SHARE

Five Moderately Critical labels do not describe one kind of failure. Earlier Drupal disclosures show where payment, identity, and outbound-request risks recur, and where the similarities stop at the advisory classification. ...more

Read Full Content
Discover Drupal

Display Builder Beta 6 Brings UX Refresh and Drupal 11.4 Fixes

Share

× SHARE

Display Builder Beta 6 carries the UX refresh previewed in July, adds Drupal 11.4 compatibility fixes, and replaces a Beta 5 affected by a fresh-install failure. Translation and accessibility work remain before a release candidate. ...more

Read Full Content
Security

UI Patterns XSS Fix Changes How Component Markup Is Handled

Share

× SHARE

A July security update fixed insufficient sanitisation of markup passed to UI Patterns components. Follow-up work moved escaping closer to render time, while UI Patterns 2.0.19 is now the current stable release. ...more

Read Full Content
Security

Security Updates Fix Entity Browser XSS and Edit in-place field Access Bypass

Share

× SHARE

The same severity label does not mean the same exposure. Site maintainers need to distinguish administrator-dependent XSS from a permission-based field-editing bypass when assessing the two updates. ...more

Read Full Content
Security

Drupal Security Advisories Require One Update and Two Uninstalls

Share

× SHARE

Matching scores can conceal the operational difference between a routine update and a dependency that must be removed. ...more

Read Full Content
Security

Drupal Association Reports First Six Weeks of AI Security Initiative

Share

× SHARE

Faster vulnerability discovery exposes a slower constraint: the human review needed to turn reports into secure releases. ...more

Read Full Content
Security

Ten Drupal Contrib Advisories Split Between Fixes and Unsupported Projects

Share

× SHARE

A single advisory window can demand upgrades, removals, and tighter environment controls. The correct response depends on support status and exposure conditions, not the severity label alone. ...more

Read Full Content
Security

Search-Spam Campaigns Exploit Public Uploads on Trusted Domains

Share

× SHARE

A public upload field can turn a trusted domain into infrastructure for content its administrators never approved. ...more

Read Full Content
Security

Drupal Advisories Flag Unsupported Projects, SQL Injection, and AI-Generated HTML

Share

× SHARE

The batch presents three response paths to Drupal site teams: uninstall unsupported projects, patch active modules, and review where untrusted or generated content reaches the rendering layers. ...more

Read Full Content
Security

Drupal Security Advisories Highlight Need for AI Code Governance

Share

× SHARE

Generated code may work on launch day. The harder test is whether a team can review, maintain, and secure it when a platform advisory becomes urgent. ...more

Read Full Content
DrupalFit Case Study Examines Marks & Spencer Cyber Incident

Share

× SHARE

A retail ransomware incident becomes a warning for web teams when the weak point is not a module or server, but the process that grants access. ...more

Read Full Content

Latest

AI Metering 1.0 Adds Cost Tracking and Quota Controls to Drupal AI

31 August 2026
Janna Malikova Wins 2026 Drupal Association At-Large Board Election

31 August 2026
Provider Map Alpha Adds Service-Area Directories to Drupal Without External Map Services

31 August 2026

Follow @thedroptimes