Drupal has issued an alert stating that it intends to release a “core security release” for all supported branches on May 20, 2026, from 5-9 p.m. UTC.
“The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days,” the maintainers of the PHP-based content management system (CMS) said.
“Not all configurations are affected. Reserve time on May 20 during the release window to determine whether your sites are affected and in need of an immediate update. Mitigation information will be included in the advisory.”
It’s being advised to update to the latest supported patch for the site’s version of Drupal before the deadline so that any outstanding upgrade issues can be addressed.
Patches are expected to be available for the following supported branches of Drupal core –
- 11.3.x
- 11.2.x
- 10.6.x
- 10.5.x
“Sites on one of these supported versions should update to the latest patch release for the given branch now in preparation for the security window,” Drupal said.
The exact nature of the security issue being addressed is unknown at this stage, but it’s expected to be severe given that Drupal is providing 11.1.x and 10.4.x releases for sites running end-of-life minor core versions. Ahead of the planned update window –
- Sites on Drupal 11.1 or 11.0 should update to at least Drupal 11.1.9.
- Sites on Drupal 10.4, 10.3, 10.2, 10.1, or 10.0 should update to at least Drupal 10.4.9.
The idea is that these sites should apply the security update as soon as it is released on May 20, and then upgrade to Drupal 11.3 or 10.6 in the near future.
For sites still on end-of-life major core versions, such as Drupal 8 and 9, patch files for Drupal 8.9 and 9.5 will need to be applied manually. However, Drupal has warned that there is no guarantee the fixes will work correctly, adding that they may introduce other issues or regressions.
“However, they may help mitigate the vulnerability for sites still on these old major versions until they upgrade to a supported release,” Drupal said.
“We strongly recommend Drupal 8 or 9 sites update to at least Drupal 10.6 soon. Drupal 8 and 9 include numerous other, previously disclosed, security vulnerabilities that will not be addressed by either Drupal Steward or the best-effort patch files.”
Drupal also noted that Drupal 7 is not affected by the issue. Sites on any version of Drupal 9 are advised to update to 9.5.11, and those on any version of Drupal 8 should update to Drupal 8.9.20.
Source link
Disclaimer
We strive to uphold the highest ethical standards in all of our reporting and coverage. We blogs.grocliq.com want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It’s possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.
Website Upgradation is going on for any glitch kindly connect at [email protected]
