Drupal Security

Security

Drupal Security Team Warns of Critical Contributed Module Security Release on 23 September

Share

× SHARE

The affected project remains unnamed, and the first advisory may not be the last one published that evening. The practical question is what operators can prepare before the module itself is disclosed. ...more

Read Full Content
Security

Digital Matters Links Larger Drupal Advisory Batches to AI-Assisted Discovery

Share

× SHARE

Large advisory batches can resemble a sudden decline in contributed-project security. Digital Matters argues that Drupal’s recent numbers should instead be read alongside changes in how vulnerabilities are being discovered. ...more

Read Full Content
Security

Drupal Core Security Update Fixes CKEditor XSS in Content Editing Workflow

Share

× SHARE

Sites on Drupal 10.5.x and Drupal 11.2.x or earlier are outside security coverage, making a move to a supported branch part of the response. ...more

Read Full Content
Security

Researcher Says Claude Found and Validated Critical Drupal SQL Injection in About Ten Minutes

Share

× SHARE

A broad Drupal security prompt led Claude from code review to a validated proof of concept in about ten minutes, according to the researcher who reported the vulnerability. ...more

Read Full Content
Security

Drupal Security Team Publishes 20 Contributed-Project Advisories, 11 for SAML SSO

Share

× SHARE

Updating alone is not enough for every affected site. One module introduces a new permission requirement, while another has no fixed release and should be uninstalled. ...more

Read Full Content
Security

WordPress REST Probes Appear in Drupal Site Logs

Share

× SHARE

Internet-facing sites routinely receive probes for software they do not run. The useful signal is how each layer of the stack handles and records that unsolicited traffic. ...more

Read Full Content
Security

OpenAI Includes Open-Source Maintainers in $1 Billion Daybreak Access Commitment

Share

× SHARE

Resource-constrained maintainers can now seek subsidised cyber access, but OpenAI has not published criteria showing how independent open-source projects will qualify. ...more

Read Full Content
Security

Drupal Issues 16 Contributed-Project Advisories, Including Five Critical Flaws

Share

× SHARE

Critical ratings are only part of the triage. Project reach varies sharply, and one advisory requires administrators to clean stored data after updating. ...more

Read Full Content
Security

Drupal Security Advisories Cover Information Disclosure, Access Bypass and Cross-Site Scripting

Share

× SHARE

Sites that missed the 26 August security batch still have a clear task: identify affected contrib versions and apply the available fixes. ...more

Read Full Content
Security

StepSecurity Says It Tracked 56 Open-Source Supply-Chain Compromises in 12 Months

Share

× SHARE

The incidents put familiar build-time assumptions under scrutiny for Drupal teams that rely on Composer and automated CI. ...more

Read Full Content
Discover Drupal

Built for TDT, Now Used Beyond It: The Journey of a Drupal Module

Share

× SHARE

A weekend fix built for The DropTimes now supports sites its maintainer may never see, bringing the responsibilities of public module maintenance into focus. ...more

Read Full Content
Security

Actively Exploited MLflow Flaw Can Expose Cloud Credentials

Share

× SHARE

AI services operating beside a Drupal site can create their own attack surface, even when Drupal itself is fully updated. ...more

Read Full Content

Latest

Drupal AI 1.5.0 Moves Five Submodules Into Standalone Projects

16 October 2026
Drupal 12 Release Team Plans to Bundle Disruptive Code Changes Ahead of RC1

16 October 2026
PNW Drupal Summit Speakers Take on Live Chat, Accessibility and HTMX

16 October 2026

Follow @thedroptimes