Drupal Aid

Drupal Support and Maintenance Services. We provide Unlimited support, proactive monthly maintenance, and small jobs. Visit us at

[Drupal Aid @drupalaid]

#PHP 8.2 security support ends December 31, 2026.

Moving a #Drupal site to PHP 8.3 rarely breaks your own code. It breaks the tools around it, and some of those failures report success.

https://t.co/FqEIOYIQJZ

[Drupal Aid @drupalaid]

#Drupal security day: 31 contrib advisories. Most urgent:

• ffmpeg_image_toolkit 1.0.3 (highly critical)
• custom_formatters 4.2.1
• monster_menus 9.5.6
• ui_icons 2.0.2
• abc 2.0.1
• black_hole 2.0.1
• zero_point 2.0.1
• dopup 1.0.7

Plus 23 moderately critical.

[Drupal Aid @drupalaid]

#Drupal security updates are out today, three of them:

• Drupal core
Includes a critical RCE fix. Go to 11.4.10 / 11.3.19 / 10.6.19

• Entity List (critical)
Remote code execution, fixed in 3.0.10

• Gin Admin Theme
Script injection, fixed in 4.1.4 / 5.0.16

[Drupal Aid @drupalaid]

#Drupal security updates are out today: 25 contrib advisories in one drop!!!

7 are rated Critical, mostly access bypass flaws plus one PHP object injection.

16 are moderately critical and 1 is less critical.

https://t.co/1bT0XSZIjc

[Drupal Aid @drupalaid]

#Drupal security releases today cover 16 contributed modules. Four of them carry critical fixes:

webform 6.3.1 (20 advisories in one release!!!!)
cloud 7.0.1
project_browser 2.1.5
tawk_to 3.0.4

The other 12 are moderately or less critical. No core release.

[Drupal Aid @drupalaid]

#Drupal core security update out today (SA-CORE-2026-013).

A flaw in the bundled CKEditor library lets anyone who can edit content plant script that runs for editors and admins using the WYSIWYG editor.

Fixed in 11.4.7, 11.3.17 and 10.6.17.

[Drupal Aid @drupalaid]

#Drupal security releases: 10 today, 5 critical.

ai_provider_amazeeio 1.4.3
csp_log 1.0.2
term_glossary 4.6.0
ultimate_table_field 2.0.1
cas_server 2.1.3
feed_block 3.0.2
key_auth 2.2.4
safedelete 1.0.88
miniorange_saml 3.2.0
patreon: unsupported

Don't run these? Nothing to do.

[Drupal Aid @drupalaid]

#Drupal security releases landed today.

14 advisories...

4 of them critical:
calculate_working_days 2.0.3
otp_verification 2.4.0
jsonapi_role_access 2.0.2
unpublished_node_permissions 1.8.0

Ten more are moderately critical.

[Drupal Aid @drupalaid]

#Drupal put out 14 contributed module security advisories today!!!

Thirteen moderately critical, one less critical.

Access bypass, cross-site scripting, information disclosure and cookie forgery. Nothing for core.

https://t.co/1bT0XSZatE

[Drupal Aid @drupalaid]

#Drupal marked three contributed projects unsupported today in security advisories. No fixes are coming for any of them.

• Gammu SMS Daemon
• Link content parser
• Screenshot

All rated critical, all versions affected. Running one of these? Start planning your way off it.

[Drupal Aid @drupalaid]

#Drupal published 5 contributed module security advisories today:

• Commerce PayPal 2.1.3
• Diff 2.1.1
• Entity Share Websub 1.1.2
• External Authentication 2.0.13
• Quick Tabs 4.3.1

All moderately critical. Four access bypasses, one SSRF. No core release.

[Drupal Aid @drupalaid]

#Drupal advisories this week. Only one has a patch.

• Token Content Access 3.1.2
Token checks leaked timing clues, so a valid one could be guessed.

• Disable Login Page
• Powerful Surveys
Both unsupported now. Uninstall, no fix is coming.

[Drupal Aid @drupalaid]

#Drupal security releases today:
• i18n_sso 1.8.0 (critical)
• core 10.6.13/11.3.14/11.4.4
• photoswipe 3.0.4
• ui_patterns 2.0.17
• media_folders 1.0.8
• webform_rest 4.1.0
• search_api_autocomplete 1.12.0
• ai_seo 1.1.3
• eca 3.1.4/2.1.20

[Drupal Aid @drupalaid]

#Drupal core security update is out

Moderately critical fix cross-site scripting + information disclosure.

Every Drupal 10 & 11 site is affected. Update core to 10.6.13 (D10) or 11.4.4 (D11).

[Drupal Aid @drupalaid]

#Drupal module updates for security:
• salesforce
• geolocation
• paragraphs
• wisski
• commerce_realex
• ai_agents
• ai
• ai_provider_openai
• admin_feedback
• plotly_js

Time to update.

[Drupal Aid @drupalaid]

Security update just dropped for #Drupal core!

Update to 10.5.12/10.6.11/11.2.14/11.3.12 if you're on Drupal 10/11.

[Drupal Aid @drupalaid]

Fresh #Drupal security patches:
• Examples for Developers (examples) → 4.0.6
• Tagify (tagify) → 1.2.52

If you use these modules on Drupal 10/11, now's a good time to update.

[Drupal Aid @drupalaid]

Security fixes out for #Drupal modules:
• Anti-Spam by CleanTalk (cleantalk) → 9.7.1
• Commerce Core (core) → 3.3.6
• TacJS (tacjs) → 6.8.0
• LocalGov Workflows (localgov_workflows) → 1.6.0

Update if you're using any of these on Drupal 10/11/9.

[Drupal Aid @drupalaid]

New #Drupal security fix:

Drupal AlternativeCommerce (Basket) (basket).

Update to 2.1.17 if you're on Drupal 10/11.

No action needed if you don't use this module.

[Drupal Aid @drupalaid]

Critical #Drupal core release - affects every Drupal site, including EOL D8/D9 (yes, Drupal backported it. That's how serious it is.)

Update now:
• 10.6 → 10.6.9
• 11.3 → 11.3.10