Drupal has issued an alert stating that it intends to release a “core security release” for all supported branches on May 20, 2026, from 5-9 p.m. UTC.
“The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days,” the maintainers of the PHP-based content management system (CMS) said.
“Not all configurations are affected. Reserve time on May 20 during the release window to determine whether your sites are affected and in need of an immediate update. Mitigation information will be included in the advisory.”
It’s being advised to update to the latest supported patch for the site’s version of Drupal before the deadline so that any outstanding upgrade issues can be addressed.
Patches are expected to be available for the following supported branches of Drupal core –
- 11.3.x
- 11.2.x
- 10.6.x
- 10.5.x
“Sites on one of these supported versions should update to the latest patch release for the given branch now in preparation for the security window,” Drupal said.
The exact nature of the security issue being addressed is unknown at this stage, but it’s expected to be severe given that Drupal is providing 11.1.x and 10.4.x releases for sites running end-of-life minor core versions. Ahead of the planned update window –
- Sites on Drupal 11.1 or 11.0 should update to at least Drupal 11.1.9.
- Sites on Drupal 10.4, 10.3, 10.2, 10.1, or 10.0 should update to at least Drupal 10.4.9.
The idea is that these sites should apply the security update as soon as it is released on May 20, and then upgrade to Drupal 11.3 or 10.6 in the near future.
For sites still on end-of-life major core versions, such as Drupal 8 and 9, patch files for Drupal 8.9 and 9.5 will need to be applied manually. However, Drupal has warned that there is no guarantee the fixes will work correctly, adding that they may introduce other issues or regressions.
“However, they may help mitigate the vulnerability for sites still on these old major versions until they upgrade to a supported release,” Drupal said.
“We strongly recommend Drupal 8 or 9 sites update to at least Drupal 10.6 soon. Drupal 8 and 9 include numerous other, previously disclosed, security vulnerabilities that will not be addressed by either Drupal Steward or the best-effort patch files.”
Drupal also noted that Drupal 7 is not affected by the issue. Sites on any version of Drupal 9 are advised to update to 9.5.11, and those on any version of Drupal 8 should update to Drupal 8.9.20.
