Security

Security

Security

Drupal Security Team Warns of Critical Contributed Module Security Release on 23 September

Share

× SHARE

The affected project remains unnamed, and the first advisory may not be the last one published that evening. The practical question is what operators can prepare before the module itself is disclosed. ...more

Read Full Content
Security

Digital Matters Links Larger Drupal Advisory Batches to AI-Assisted Discovery

Share

× SHARE

Large advisory batches can resemble a sudden decline in contributed-project security. Digital Matters argues that Drupal’s recent numbers should instead be read alongside changes in how vulnerabilities are being discovered. ...more

Read Full Content
Security

Drupal Core Security Update Fixes CKEditor XSS in Content Editing Workflow

Share

× SHARE

Sites on Drupal 10.5.x and Drupal 11.2.x or earlier are outside security coverage, making a move to a supported branch part of the response. ...more

Read Full Content
Security

Researcher Says Claude Found and Validated Critical Drupal SQL Injection in About Ten Minutes

Share

× SHARE

A broad Drupal security prompt led Claude from code review to a validated proof of concept in about ten minutes, according to the researcher who reported the vulnerability. ...more

Read Full Content
Security

Chrome 153 Starts Two-Week Release Cycle with 230 Security Fixes and an Exploited V8 Flaw

Share

× SHARE

Drupal teams now have a shorter interval between major Chrome milestones to catch interface and JavaScript regressions before the supported browser window advances. ...more

Read Full Content
Security

Drupal Security Team Publishes 20 Contributed-Project Advisories, 11 for SAML SSO

Share

× SHARE

Updating alone is not enough for every affected site. One module introduces a new permission requirement, while another has no fixed release and should be uninstalled. ...more

Read Full Content
Security

WordPress REST Probes Appear in Drupal Site Logs

Share

× SHARE

Internet-facing sites routinely receive probes for software they do not run. The useful signal is how each layer of the stack handles and records that unsolicited traffic. ...more

Read Full Content
Security

OpenAI Includes Open-Source Maintainers in $1 Billion Daybreak Access Commitment

Share

× SHARE

Resource-constrained maintainers can now seek subsidised cyber access, but OpenAI has not published criteria showing how independent open-source projects will qualify. ...more

Read Full Content
Security

Drupal Issues 16 Contributed-Project Advisories, Including Five Critical Flaws

Share

× SHARE

Critical ratings are only part of the triage. Project reach varies sharply, and one advisory requires administrators to clean stored data after updating. ...more

Read Full Content
Security

Drupal Security Advisories Cover Information Disclosure, Access Bypass and Cross-Site Scripting

Share

× SHARE

Sites that missed the 26 August security batch still have a clear task: identify affected contrib versions and apply the available fixes. ...more

Read Full Content
Security

LiteLLM Supply-Chain Findings Highlight External Dependencies in Drupal AI Workflows

Share

× SHARE

Drupal AI integrations can depend on services whose runtimes, build pipelines and credentials sit outside the site's Composer-managed code. The LiteLLM incident shows how that external trust boundary can become part of the security picture. ...more

Read Full Content
Security

StepSecurity Says It Tracked 56 Open-Source Supply-Chain Compromises in 12 Months

Share

× SHARE

The incidents put familiar build-time assumptions under scrutiny for Drupal teams that rely on Composer and automated CI. ...more

Read Full Content

Latest

How to Use AI Coding Agents on Drupal Projects with AGENTS.md, Tests and MCP

29 October 2026
X to Drupal: QED42 Migrates 646 Pages From Webflow to Drupal 11

29 October 2026
Drupal Commerce Access Bypass Actively Exploited as Drupal Issues 39 Advisories

29 October 2026

Follow @thedroptimes