Security

Unsupported CMS branches can turn a security patch into a major-version project. The 18 August releases show how support status changes the remediation burden across mixed CMS estates. ...more

File-upload permissions become more consequential when a CMS hands untrusted content to external media processors. ...more

The 8.9 login-screen flaw is remotely reachable without an authenticated account, yet its path to code execution still depends on social engineering and active victim interaction. ...more

The striking number is only part of the result. NOVA also reports thousands of access-control, injection, path-traversal, and dependency-related findings that conventional crash-focused automation is less suited to uncover. ...more

Eight additional Drupal GovCon respondents focus on the controls, human decisions, and content structures that keep digital systems usable when automation and changing discovery meet production reality. ...more

For Drupal teams running automated or agent-driven workflows, the key question is who decides when execution pauses for approval. FlowDrop now lets administrators set that policy independently of a processor's side-effect declaration. ...more

The vulnerabilities depend on different permissions and configurations, but supported sites should still install the appropriate security release. Maintainers of contributed modules that handle HTMX attributes or implement custom stream wrappers should review the accompanying hardening. ...more

Drupal site security rarely stops at core and module updates. Canonical’s survey shows why package provenance, Linux maintenance, and patch ownership remain part of delivery risk. ...more

Pune’s Drupal community now has a confirmed programme for its July meetup. The agenda brings together authentication security, production AI agents, and a community discussion on real-world AI use. ...more

Site audit automation now has broader Drush controls and Drupal 12 readiness, but maintainers still need to account for the project’s advisory-policy caveat before treating it as a security baseline. ...more

Teams balancing release speed with security review often carry bot defence, logging, and WAF maintenance inside already crowded delivery workflows. This webinar presents managed edge security as one way to reduce that pressure. ...more