Security-related announcements, such as information on best practices. These posts by the Drupal security team are also sent to the security announcements e-mail list.

PHPmailer 3rd party library -- DRUPAL-SA-PSA-2016-004

Drupal file upload by anonymous or untrusted users into public file systems -- PSA-2016-003

This issue only affects sites that allow file uploads by non-trusted or anonymous visitors, and stores those uploads in a public file system.

Drupal 8.x core release on Monday -- PSA-2016-002

  • Advisory ID: DRUPAL-PSA-2016-002
  • Project: Drupal
  • Version: 8.x
  • Date: 2016-July-17
  • Security risk: TBD
  • Vulnerability: TBD

Drupal contrib - Highly Critical - Remote code execution PSA-2016-001

Drupal core - Critical - Remote installation PSA-2015-001

Drupal Core - Highly Critical - Public Service announcement - PSA-2014-003

This Public Service Announcement is a follow up to SA-CORE-2014-005 - Drupal core - SQL injection. This is not an announcement of a new vulnerability in Drupal.


Subscribe with RSS Subscribe to RSS - Security public service announcements