Security

Banks often commission fixes for the same open-source libraries. OSERA is testing a shared way to fund and verify that work. ...more

A Composer symlink flaw affects versions that still satisfy Drupal 11's minimum requirement. The fix is available in Composer 2.10.3 and 2.2.30. ...more

Cyber hygiene starts with knowing what an organisation owns and who maintains it. That makes fragmented public web estates a governance problem, not only a patching problem. ...more

Drupal AI integrations can depend on services whose runtimes, build pipelines and credentials sit outside the site's Composer-managed code. The LiteLLM incident shows how that external trust boundary can become part of the security picture. ...more

AI services operating beside a Drupal site can create their own attack surface, even when Drupal itself is fully updated. ...more

Unsupported CMS branches can turn a security patch into a major-version project. The 18 August releases show how support status changes the remediation burden across mixed CMS estates. ...more

File-upload permissions become more consequential when a CMS hands untrusted content to external media processors. ...more

The 8.9 login-screen flaw is remotely reachable without an authenticated account, yet its path to code execution still depends on social engineering and active victim interaction. ...more

The striking number is only part of the result. NOVA also reports thousands of access-control, injection, path-traversal, and dependency-related findings that conventional crash-focused automation is less suited to uncover. ...more

Eight additional Drupal GovCon respondents focus on the controls, human decisions, and content structures that keep digital systems usable when automation and changing discovery meet production reality. ...more

For Drupal teams running automated or agent-driven workflows, the key question is who decides when execution pauses for approval. FlowDrop now lets administrators set that policy independently of a processor's side-effect declaration. ...more

The vulnerabilities depend on different permissions and configurations, but supported sites should still install the appropriate security release. Maintainers of contributed modules that handle HTMX attributes or implement custom stream wrappers should review the accompanying hardening. ...more