#PHP 8.2 security support ends December 31, 2026. Moving a #Drupal site to PHP 8.3 rarely breaks your own code. It breaks the tools around it, and some of those failures report success. drupalaid.com/blog/php-8-3-r…

#Drupal security day: 31 contrib advisories. Most urgent: • ffmpeg_image_toolkit 1.0.3 (highly critical) • custom_formatters 4.2.1 • monster_menus 9.5.6 • ui_icons 2.0.2 • abc 2.0.1 • black_hole 2.0.1 • zero_point 2.0.1 • dopup 1.0.7 Plus 23 moderately critical.

#Drupal security updates are out today, three of them: • Drupal core Includes a critical RCE fix. Go to 11.4.10 / 11.3.19 / 10.6.19 • Entity List (critical) Remote code execution, fixed in 3.0.10 • Gin Admin Theme Script injection, fixed in 4.1.4 / 5.0.16

#Drupal security updates are out today: 25 contrib advisories in one drop!!! 7 are rated Critical, mostly access bypass flaws plus one PHP object injection. 16 are moderately critical and 1 is less critical. drupal.org/security

#Drupal security releases today cover 16 contributed modules. Four of them carry critical fixes: webform 6.3.1 (20 advisories in one release!!!!) cloud 7.0.1 project_browser 2.1.5 tawk_to 3.0.4 The other 12 are moderately or less critical. No core release.

#Drupal core security update out today (SA-CORE-2026-013). A flaw in the bundled CKEditor library lets anyone who can edit content plant script that runs for editors and admins using the WYSIWYG editor. Fixed in 11.4.7, 11.3.17 and 10.6.17.

#Drupal security releases: 10 today, 5 critical. ai_provider_amazeeio 1.4.3 csp_log 1.0.2 term_glossary 4.6.0 ultimate_table_field 2.0.1 cas_server 2.1.3 feed_block 3.0.2 key_auth 2.2.4 safedelete 1.0.88 miniorange_saml 3.2.0 patreon: unsupported Don't run these? Nothing to do.

#Drupal security releases landed today. 14 advisories... 4 of them critical: calculate_working_days 2.0.3 otp_verification 2.4.0 jsonapi_role_access 2.0.2 unpublished_node_permissions 1.8.0 Ten more are moderately critical.

#Drupal put out 14 contributed module security advisories today!!! Thirteen moderately critical, one less critical. Access bypass, cross-site scripting, information disclosure and cookie forgery. Nothing for core. drupal.org/security

#Drupal marked three contributed projects unsupported today in security advisories. No fixes are coming for any of them. • Gammu SMS Daemon • Link content parser • Screenshot All rated critical, all versions affected. Running one of these? Start planning your way off it.

#Drupal published 5 contributed module security advisories today: • Commerce PayPal 2.1.3 • Diff 2.1.1 • Entity Share Websub 1.1.2 • External Authentication 2.0.13 • Quick Tabs 4.3.1 All moderately critical. Four access bypasses, one SSRF. No core release.

#Drupal advisories this week. Only one has a patch. • Token Content Access 3.1.2 Token checks leaked timing clues, so a valid one could be guessed. • Disable Login Page • Powerful Surveys Both unsupported now. Uninstall, no fix is coming.

#Drupal security releases today: • i18n_sso 1.8.0 (critical) • core 10.6.13/11.3.14/11.4.4 • photoswipe 3.0.4 • ui_patterns 2.0.17 • media_folders 1.0.8 • webform_rest 4.1.0 • search_api_autocomplete 1.12.0 • ai_seo 1.1.3 • eca 3.1.4/2.1.20

#Drupal core security update is out Moderately critical fix cross-site scripting + information disclosure. Every Drupal 10 & 11 site is affected. Update core to 10.6.13 (D10) or 11.4.4 (D11).

#Drupal module updates for security: • salesforce • geolocation • paragraphs • wisski • commerce_realex • ai_agents • ai • ai_provider_openai • admin_feedback • plotly_js Time to update.

Security update just dropped for #Drupal core! Update to 10.5.12/10.6.11/11.2.14/11.3.12 if you're on Drupal 10/11.

Fresh #Drupal security patches: • Examples for Developers (examples) → 4.0.6 • Tagify (tagify) → 1.2.52 If you use these modules on Drupal 10/11, now's a good time to update.

Security fixes out for #Drupal modules: • Anti-Spam by CleanTalk (cleantalk) → 9.7.1 • Commerce Core (core) → 3.3.6 • TacJS (tacjs) → 6.8.0 • LocalGov Workflows (localgov_workflows) → 1.6.0 Update if you're using any of these on Drupal 10/11/9.

New #Drupal security fix: Drupal AlternativeCommerce (Basket) (basket). Update to 2.1.17 if you're on Drupal 10/11. No action needed if you don't use this module.

Critical #Drupal core release - affects every Drupal site, including EOL D8/D9 (yes, Drupal backported it. That's how serious it is.) Update now: • 10.6 → 10.6.9 • 11.3 → 11.3.10