#DrupalSecurity
LightNews LightNews
thedroptimes.bsky.social
Drupal security updates span OAuth, webhook handling and Symfony dependencies, with fixes addressing authentication, request validation and underlying framework risks that Drupal teams should review.

www.thedroptimes.com/73245/drupal...

#Drupal #DrupalSecurity #Symfony
Security poster featuring a blue checkmark, orange warning symbol and connected-system icons beneath the headline “The Patch Is Installed. What Remains?” about Drupal and Symfony security updates.
November 6, 2026 at 4:19 PM
thedroptimes.bsky.social
Drupal core security releases rely on a coordinated workflow spanning private issue handling, testing, packaging and publication. The article examines that process alongside the funding needed to sustain the people doing the work.

www.thedroptimes.com/73155/drupal...

#DrupalSecurity #OpenSource
Security poster showing a vulnerability report progressing through review stages to a protected software package, with the headline “A Security Fix Isn't Yet an Installable Update.”
November 3, 2026 at 1:56 PM
dynamosys.bsky.social
Drupal is cutting security support for minor releases from 12 months to 8, starting in 2027. Being on Drupal 11 isn’t the whole answer: check which release your site runs, when its support ends, and whether your maintenance plan covers the move.

#Drupal #DrupalSecurity #WebsiteMaintenance
Drupal’s 8-Month Security Support Starts in 2027 | Dynamosys
Drupal is shortening security support for minor releases in 2027. See the dates that matter and how to plan updates, testing, and your maintenance budget.
www.dynamosys.com
November 5, 2026 at 9:43 PM
thedroptimes.bsky.social
Drupal’s security support window for minor releases is extending to eight months, giving site owners more time to plan upgrades while keeping supported branches covered for security fixes.

www.thedroptimes.com/73252/drupal...

#Drupal #DrupalSecurity #DrupalCore
Drupal security poster showing a calendar, padlock shield and a change from 12 months to 8 months of minor-release security support, under the headline “The Upgrade Window Is Shrinking.” | Beginning in 2027, standard Drupal core minor releases will receive eight months of security coverage instead of twelve, shortening the time available for site owners to upgrade between minor versions.
November 6, 2026 at 3:53 PM
dynamosys.bsky.social
Updated your npm packages for Node2Shell? The fix is in Node.js itself (22.23.4, 24.22.1 or 26.12.1), and containers, CI images and DDEV each carry their own copy. Here's what to check, Drupal sites included.

#NodeJs #DrupalSecurity #SecurityUpdates #WebsiteMaintenance
Node2Shell: Check the Node.js Runtime, Not Just npm | Dynamosys
Node2Shell (CVE-2026-111497) is fixed in Node.js 22.23.4, 24.22.1 and 26.12.1. Find every runtime that needs it, from containers to DDEV and Drupal builds.
www.dynamosys.com
November 3, 2026 at 6:11 PM
thedroptimes.bsky.social
Drupal core security work depends on both contributor effort and sustainable funding. The article examines how contribution credit and sponsorship can better recognise and support the people maintaining Drupal’s security.

www.thedroptimes.com/73001/drupal...

#Drupal #DrupalSecurity #OpenSource
Graphic highlighting increased recognition for Drupal core maintenance and security contributions, illustrated with interconnected nodes and geometric blocks.
October 29, 2026 at 9:31 AM
dynamosys.bsky.social
A Drupal Commerce flaw is being exploited. Update to 3.3.13 or 8.x-2.41, then review your orders: the patch doesn't check past ones.
#DrupalCommerce #DrupalSecurity #ECommerce #SecurityUpdates #WebsiteMaintenance
Drupal Commerce Alert: Update and Audit Orders | Dynamosys
Drupal Commerce has an actively exploited security flaw. Check affected versions, install the fixes, and review orders and payments for inconsistencies.
www.dynamosys.com
October 29, 2026 at 6:19 PM
thedroptimes.bsky.social
The Drupal Association’s PHP2Shell post-patch audit looks beyond applying the fix, focusing on what teams should verify afterward to rule out compromise, persistence, or other signs of exploitation.

www.thedroptimes.com/72999/drupal...

#Drupal #DrupalSecurity #PHP2Shell
PHP2Shell security graphic with a broken timeline, highlighting exploitation attempts detected before public disclosure and the need for post-patch audits.
October 23, 2026 at 1:51 PM
thedroptimes.bsky.social
Drupal’s 21 October contrib security batch includes 34 advisories across 31 projects, led by a Highly critical RCE in Ffmpeg Image Toolkit. Seven advisories are Critical, with fixes varying by project and configuration.

www.thedroptimes.com/72975/drupal...

#Drupal #DrupalSecurity #Security
Security news graphic showing interconnected software modules, files and user symbols, highlighting 34 Drupal contributed-project advisories, including a highly critical remote code execution vulnerability.
October 22, 2026 at 1:31 PM
dynamosys.bsky.social
PHP2Shell: two critical PHP flaws allow unauthenticated remote code execution, demonstrated on the official Drupal container image. Updating Drupal won't fix them; your PHP runtime needs 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
#PHP #DrupalSecurity #SecurityUpdates #WebsiteMaintenance
PHP2Shell: Why Updating Drupal Isn’t Enough | Dynamosys
PHP2Shell flaws put Drupal sites at risk. See the patched PHP versions, what to ask your host or cloud team, and why updating Drupal is not enough.
www.dynamosys.com
October 22, 2026 at 6:20 PM
thedroptimes.bsky.social
Drupal has issued five October 2026 security advisories, including a critical remote code execution vulnerability in core. Site owners should review affected versions and apply the recommended updates promptly.

www.thedroptimes.com/72860/drupal...

#Drupal #DrupalSecurity #Security
A Drupal security graphic shows a warning symbol beside an interconnected network of software components. The headline stresses that updating Drupal core alone is insufficient, reflecting five security advisories covering two Critical remote code execution flaws and three cross-site scripting vulnerabilities.
October 15, 2026 at 1:17 PM
thedroptimes.bsky.social
Akismet 1.1.0 adds webhook security improvements and a one-way migration path from older Drupal integrations. Teams upgrading should review the migration carefully because the move is not designed to roll back.

www.thedroptimes.com/72827/akisme...

#Drupal #Akismet #DrupalSecurity
A promotional graphic for Akismet 1.1.0 shows Drupal and Akismet branding alongside a configuration interface, security shield and checkmarks. The headline announces security and migration changes, while the supporting text highlights the need to review stored secrets and form protection.
October 15, 2026 at 1:05 PM
dynamosys.bsky.social
Drupal 11.4.10, 11.3.19 and 10.6.19 fix a critical remote code execution flaw. Update now, and check Gin and Entity List separately.
#Drupal #Drupal11 #DrupalSecurity #DrupalCore #SecurityUpdates #WebsiteMaintenance #Cybersecurity
Drupal 11.4.10: Critical Security Update | Dynamosys
Drupal 11.4.10 fixes a critical remote code execution flaw and two XSS vulnerabilities. Check affected versions, related updates, and next steps.
www.dynamosys.com
October 14, 2026 at 7:48 PM
thedroptimes.bsky.social
Drupal will release a critical core security update on 14 October between 16:00 and 21:00 UTC. All supported branches are affected, and site teams should prepare to deploy quickly once fixes land.

www.thedroptimes.com/72811/drupal...

#Drupal #DrupalSecurity #Security
Security announcement graphic showing a critical Drupal core release scheduled for 14 October 2026, with a warning symbol and an illustration of documents representing the forthcoming security update.
October 13, 2026 at 3:44 PM
thedroptimes.bsky.social
The Drupal Security Team published 26 contrib advisories across 25 projects, including a highly critical Block AJAX flaw and seven critical notices. Several fixes also require follow-up steps beyond updating packages.

www.thedroptimes.com/72734/drupal...

#Drupal #DrupalSecurity #OpenSource
Social media card for a The DropTimes report on 26 Drupal contributed-project security advisories. The headline asks, “The Update Is Installed. Is the Fix Complete?” Supporting text explains that some fixes require configuration changes, database updates or manual follow-up after the package is updated. An illustration shows a website interface with an open panel and warning symbol.
October 9, 2026 at 1:48 PM
thedroptimes.bsky.social
Two new guides tackle different operational risks around modern Drupal: DrupalFit focuses on site security, while Pantheon examines reliability and governance in decoupled CMS deployments.

www.thedroptimes.com/72676/drupal...

#Drupal #DrupalSecurity #DecoupledDrupal
Editorial graphic for The Drop Times about two new eBooks examining Drupal security and decoupled CMS operations. The headline asks, “What Gets Harder After Drupal Goes Live?” Supporting text says the guides explore security gaps and operational complexity that can emerge once a site reaches production. The design features the covers of DrupalFit’s “Top Security Risks in Drupal Websites” and Pantheon’s “Decoupled, Governed, and Stable,” alongside an eBook illustration.
October 8, 2026 at 10:00 AM
thedroptimes.bsky.social
Researcher Matan Kotick says Claude found and validated a Critical SQL injection in the amazee[.]ai Private AI Provider in about ten minutes. Drupal’s advisory confirms CVE-2026-87936 and the affected code path.

https://bit.ly/4haV1cf
##Drupal #DrupalSecurity #Claude #DrupalAI
TDT security card asks “How Far Did Claude Get In Ten Minutes?” and says it did not stop at finding vulnerable code, in an analysis of Drupal advisory SA-CONTRIB-2026-134 and its fixes.
September 17, 2026 at 6:36 PM
thedroptimes.bsky.social
Drupal core security updates fix a CKEditor 5 XSS vulnerability. A user who can create or edit content may target someone who later opens it through CKEditor, including privileged administrators.

Update to 10.6.17, 11.3.17, or 11.4.7.

https://bit.ly/4hxDe0j
##DrupalSecurity #CKEditor #WebSecurity
Drupal Core Security Update Fixes CKEditor XSS in Content Editing Workflow
Sites on Drupal 10.5.x and Drupal 11.2.x or earlier are outside security coverage, making a move to a supported branch part of the response.
bit.ly
September 17, 2026 at 7:16 PM
thedroptimes.bsky.social
Larger Drupal security-advisory batches may reflect cheaper AI-assisted vulnerability discovery, not suddenly worse contrib code. The initiative reported 30+ issues and contributions to 10+ advisories and CVEs in six weeks.

https://bit.ly/4yM9JOo
##Drupal #DrupalSecurity #DrupalAI #OpenSource
Digital Matters Links Larger Drupal Advisory Batches to AI-Assisted Discovery
Large advisory batches can resemble a sudden decline in contributed-project security. Digital Matters argues that Drupal’s recent numbers should instead be read alongside changes in how vulnerabilities are being discovered.
bit.ly
September 17, 2026 at 12:49 PM
thedroptimes.bsky.social
Drupal’s September 2 security batch includes 16 advisories across 14 contrib projects. Five are Critical, covering issues including account takeover, access bypass, and XSS. Corrective releases are available.

https://bit.ly/46awHCs
##Drupal #DrupalSecurity #SecurityAdvisory
TDT security card on 16 Drupal contributed-project advisories, including five Critical flaws and 12 access-bypass disclosures.
September 7, 2026 at 7:14 PM
thedroptimes.bsky.social
Sixteen Drupal contributed projects were marked unsupported for security reasons across ten weeks.

There is no supported patched release; Drupal advises affected sites to uninstall them.

https://bit.ly/3UbH2LK
##Drupal #DrupalSecurity #OpenSource
TDT security card on 16 Drupal contributed projects marked unsupported across five advisory dates in ten weeks, with uninstalling advised where no supported fix is available.
August 24, 2026 at 6:26 PM
xavie.mirmon.co.uk
Any thoughts @drupalsecurity??
xavie.mirmon.co.uk Xavier Mirabelli-Montan @xavie.mirmon.co.uk · May 18
Hey @drupalsecurity I am not always getting all the e-mails weds. If I do they are coming very late FYI. What’s the best channel these days
March 24, 2025 at 11:25 AM
xavie.mirmon.co.uk
Hey @drupalsecurity I am not always getting all the e-mails weds. If I do they are coming very late FYI. What’s the best channel these days
March 24, 2025 at 11:24 AM
thedroptimes.bsky.social
Five Drupal contrib security advisories are moderately critical: four access bypasses and one SSRF. Affected sites should check Commerce PayPal, Diff, Entity Share Websub, External Authentication and Quick Tabs.
##Drupal #DrupalSecurity #OpenSource

https://bit.ly/4gb9cOk
TDT security card on five Moderately Critical Drupal advisories covering different access, validation, identity, rendering, and SSRF risks.
August 13, 2026 at 2:17 PM
thedroptimes.bsky.social
Two Drupal contrib security advisories require updates: Entity Browser fixes stored XSS in 8.x-2.16, while Edit in-place field 2.1.1 fixes an access-bypass vulnerability.

https://bit.ly/4q03Bia
##Drupal #DrupalSecurity #CyberSecurity
The Drop Times security card covers stored XSS in Entity Browser and access bypass in Edit In-Place Field, both rated Moderately Critical, with updates to 8.x-2.16 and 2.1.1 shown.
August 7, 2026 at 1:44 PM