Security public service announcements: Upcoming critical contributed project security release on September 23, 2026 - PSA-2026-09-21

There will be a security release for a widely used contributed module on September 23, 2026 between 17:00 and 21:00 UTC.

We are announcing this release in advance because the affected contributed module is used on a significant portion of Drupal sites, and the upcoming release will include a significant number of advisories. The advisory with the highest risk score for the release is currently rated as critical.

Drupal core is not affected.

Advisories may be published in batches (a few at a time)

The current rate of advisories may require changes to our practices going forward:

• The security team may publish advisories individually, at different times inside the window.
• We will try to publish batches grouped by module.
• We will announce in Slack when all planned releases for the day are complete.
• We will release mailing list emails about the security updates together at the end of the window, to reduce the risk of site owners updating multiple times while advisories are still being published.

These changes are intended to make the process easier for the team and to make communication from the team easier to follow.

No special release procedures

The planned update does not require special release procedures.