Security

Faster vulnerability discovery exposes a slower constraint: the human review needed to turn reports into secure releases. ...more

Automated testing now covers confidential merge requests for contributed-project security fixes, where testing was previously unavailable. ...more

Anti-spam choices affect what Drupal sites can screen, where checks occur, and how much friction users encounter. ...more

A single advisory window can demand upgrades, removals, and tighter environment controls. The correct response depends on support status and exposure conditions, not the severity label alone. ...more

A public upload field can turn a trusted domain into infrastructure for content its administrators never approved. ...more

The vulnerabilities depend on different permissions and configurations, but supported sites should still install the appropriate security release. Maintainers of contributed modules that handle HTMX attributes or implement custom stream wrappers should review the accompanying hardening. ...more

The batch presents three response paths to Drupal site teams: uninstall unsupported projects, patch active modules, and review where untrusted or generated content reaches the rendering layers. ...more

Generated code may work on launch day. The harder test is whether a team can review, maintain, and secure it when a platform advisory becomes urgent. ...more

The launch puts a familiar open source security problem in sharper view: vulnerability reports move quickly, but maintainers still carry the burden of triage, trust, and disclosure. ...more

Uploads, chat endpoints, and workflow approvals become security boundaries when Drupal modules accept files or trigger AI-assisted actions from user sessions. ...more

The latest Drupal contributed-project advisories require more than routine version checks. Site teams need to match each update against enabled submodules, exposed filters, AI agent access, payment flows, and unsupported code. ...more

The Drupal Security Team’s 17 June 2026 advisory batch affects supported Drupal 10 and 11 branches and three contributed modules. The most consequential issues involve PHP object injection under rare JSON:API write conditions, server-side request forgery through oEmbed URL discovery, and incomplete validation of MIME types during image uploads. Site teams should treat the batch as an update and configuration check, not as a single universal Drupal exposure, because several critical advisories depend on specific field types, write permissions, or module installations. ...more