Drupal Security

Republish Drupal Security Advisories & related news. Follow Drupal Security Team. @mlh407 to get RT. DM & mentions not monitored.

[Drupal Security @drupalsecurity]

Drupal Security Advisory content is automatically posted to other social/feed services like https://t.co/8vPvWrMr7t and https://t.co/PlSwn1H8Gp

[The PHP Foundation @ThePHPF]

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.

PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.

[Drupal Security @drupalsecurity]

Thrilled to announce that four provisional members have earned full membership on the Drupal Security Team!
Welcome:
🇫🇷 Pierre Rudloff
🇦🇺 Joseph Zhao
🇧🇪 Bram Driesen
🇺🇸 Swan Kalata
https://t.co/ZMmZCWyK5T

#Drupal #OpenSource #Security

[Drupal Security @drupalsecurity]

@jvandenbroeck Details on the Steward program and how to join are at https://t.co/igPzknzkRy

[Drupal Security @drupalsecurity]

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 read more at https://t.co/Vytld9taHc

[Drupal Security @drupalsecurity]

@sebreghtsjelle You can remove the `-recommended` part of that and then do the updates. If you prefer using -recommended in the long run, you could switch back to it later today.

[Drupal Security @drupalsecurity]

Drupal-related security releases today include those referenced below. You can start updating dependencies from Symfony and doing testing steps now.

[Fabien Potencier @fabpot]

During the last few weeks, the #Symfony core team has been hard at work fixing a long list of vulnerabilities for both #Symfony and #Twig. Today, we're publishing that work in the biggest security patch releases ever. Bare with us and wish us luck 🍀

[Drupal Security @drupalsecurity]

Site owners are encouraged to get their sites ready for a release of Drupal core that may affect them. Site owners should make upgrades easier (e.g. update to the most recent release, improve deployment automation, improve automated testing) given the current security climate.

[Drupal Security @drupalsecurity]

Upcoming highly critical release on May 20, 2026 - PSA-2026-05-18 Read more: https://t.co/lycKhVNaoo

[Drupal Security @drupalsecurity]

The Drupal Security Team now has a Linkedin page. It will be for longer-form content than this channel, so participating in both communities is encouraged. Follow here https://t.co/YHwb90lZIj

[Drupal Security @drupalsecurity]

New Drupal core releases address XSS, access bypass, and a gadget chain hardening. The XSS issue is protected by the Drupal Steward service. Details on all 3 issues available at https://t.co/wZOXzMDwOi https://t.co/3I4QKYrube https://t.co/5n8MVtixr7

[Drupal Security @drupalsecurity]

Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002 https://t.co/Jvj2EgrxRc Only Drupal 10.0 through 10.2 are affected.

[Drupal Security @drupalsecurity]

Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041 https://t.co/xVUsmd1Y7I

[Drupal Security @drupalsecurity]

File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040 https://t.co/05mCWoMLhv

[Drupal Security @drupalsecurity]

Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039 https://t.co/bOR4UAKRvx

[Drupal Security @drupalsecurity]

Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038 https://t.co/SqkQp1CSSI

[Drupal Security @drupalsecurity]

Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037 https://t.co/W3li3M79tB

[Drupal Security @drupalsecurity]

Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036 https://t.co/x2xoKxNKh4

[Drupal Security @drupalsecurity]

Content Entity Clone - Moderately critical - Information Disclosure - SA-CONTRIB-2024-035 https://t.co/OWZ1KwpgMf