Upcoming critical contributed project security release on September 23, 2026 - PSA-2026-09-21

• Updated 2026-09-22, 12:00 UTC, to document that the advisories in the release might be possible for more common configurations, and that other projects may have advisories.
• Updated 2026-09-21, 19:00 UTC, to document that this is not covered by Drupal Steward.

There will be a security release for a widely used contributed module on September 23, 2026 between 17:00 and 21:00 UTC.

We are announcing this release in advance because the affected contributed module is used on a significant portion of Drupal sites, and the upcoming release will include a significant number of advisories.

The advisory with the highest risk score for the release is currently rated as critical. Other, less severe advisories in the release may be accessible to anonymous users, or result from default configurations.

Other contributed projects may also release advisories on the same date, possibly with more severe vulnerabilities. Drupal core is not affected.

Drupal Steward information

These releases will not be covered by Drupal Steward.

Advisories may be published in batches (a few at a time)

The current rate of advisories may require changes to our practices going forward:

• The security team may publish advisories individually, at different times inside the window.
• We will try to publish batches grouped by module.
• We will announce in Slack when all planned releases for the day are complete.
• We will release mailing list emails about the security updates together at the end of the window, to reduce the risk of site owners updating multiple times while advisories are still being published.

These changes are intended to make the process easier for the team and to make communication from the team easier to follow.

No special release procedures

The planned update does not require special release procedures.