Security public service announcements: Upcoming critical Drupal core release on October 14, 2026 - PSA-2026-10-12

There will be a Drupal core security release for all supported branches on October 14, 2026 between 16:00 and 21:00 UTC. (To see this in your local timezone, refer to the Drupal Core Calendar.) Based on our analysis this vulnerability rates at 19/25 on our risk calculator.

The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days.

We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before October 14, so that you can address any other upgrade issues before the security window.

This issue is being protected by Drupal Steward. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered.

Affected versions

All currently supported versions of Drupal core are affected, including:

• Drupal 11.4.x
• Drupal 11.3.x
• Drupal 10.6.x

Drupal 12.0.0-beta1 is also affected. New beta releases will be provided following the security updates for the supported branches.

All versions of Drupal prior to 10.6.x, as well as all versions of Drupal 11 prior to 11.3.x, are end-of-life and no longer supported. Sites on those versions should update as soon as possible to avoid this and other publicly disclosed vulnerabilities.

Disclosure policy

Neither the Security Team nor any other party is able to release any more information about this vulnerability until the announcement is made. Security release announcements will appear on the Drupal.org security advisory page, which has RSS feeds. The announcement will also be made public on:

• The #security-team channel of the Drupal community Slack
• Bluesky
• Mastodon
• X (formerly Twitter)
• LinkedIn
• By email for those who have subscribed to our email list. (To subscribe to the email list: log in on Drupal.org, go to your user profile page and subscribe to the security newsletter on the Edit » My newsletters tab.)