Critical Drupal Core Update Released to Address High-Risk Vulnerability

Drupal has announced a critical security update for its core CMS, scheduled for release on May 20, 2026. The update addresses a significant vulnerability that could be exploited within hours of disclosure. Administrators of Drupal versions 8 and 9 are strongly advised to upgrade to version 10.6 or higher. The update will also provide patches for versions 11.1.x and 10.4.x, despite them being out of support. Not all configurations are affected, but admins should verify their systems' status upon release. The Drupal Security Team has not disclosed technical details about the vulnerability, urging caution against potential misinformation. Sites using Drupal Steward are already protected against known attack vectors, though updates are still recommended. Administrators should monitor the official security portal for the update and apply it immediately once available.

Key Points: • A critical security update for Drupal is set for release on May 20, 2026. • Administrators must upgrade to Drupal version 10.6 or higher to mitigate risks. • Patches will be provided for unsupported versions due to the severity of the vulnerability.