Back Securityaffairs.Co

Drupal is rolling out an emergency security update on May 20. You cannot miss it

Securityaffairs.Co •Pierluigi Paganini • May 19, 2026

Drupal Is Pushing an Emergency Security Update Tomorrow. If You Run a Drupal Site, This Is Not One to Miss. Something significant is coming out of the Drupal project tomorrow, and the way the announcement is worded should be enough to get any site administrator’s attention. The Drupal Security Team has confirmed it will release […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Drupal Core Update Released to Address High-Risk Vulnerability Drupal has announced a critical security update for its core CMS, scheduled for release on May 20, 2026. The update addresses a significant vulnerability that could be exploited within hours of disclosure. Administrators of Drupal versions 8 and 9 are strongly advised to upgrade to version 10.6 or higher. The update will also provide patches for versions 11.1.x and 10.4.x, despite them being out of support. Not all configurations are affected, but admins should verify their systems' status upon release. The Drupal Security Team has not disclosed technical details about the vulnerability, urging caution against potential misinformation. Sites using Drupal Steward are already protected against known attack vectors, though updates are still recommended. Administrators should monitor the official security portal for the update and apply it immediately once available. 7 sources 74

Extracted Entities

Platforms (1)

Drupal