"The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days," the Drupal maintainers said.
Release window: May 20, 2026 — 5–9 p.m. UTC
Drupal has announced a planned "core security release" for all supported branches on May 20, 2026, scheduled between 5 and 9 p.m. UTC. The project is asking site owners to reserve that window so they can determine whether their installations are affected and apply fixes immediately. Drupal said mitigation information will be included in the advisory that accompanies the release.
Supported branches that will receive patches
Patches are expected to be published for the currently supported minor branches of Drupal core. The Drupal Security Team listed the following branches by name: 11.3.x, 11.2.x, 10.6.x and 10.5.x. Site operators running one of those supported versions were told to "update to the latest patch release for the given branch now" so that any outstanding upgrade issues can be addressed before the security window.
Advice for sites on end-of-life minor and major versions
Drupal signaled unusual breadth to this update by making releases for some end-of-life minor branches as well: maintainers will provide 11.1.x and 10.4.x releases for sites running those older minor core versions. The exact nature of the vulnerability is not described in the notice, but Drupal characterized the situation as serious enough to warrant those extra releases.
In concrete terms, the project advised:
- Sites on Drupal 11.1 or 11.0 should update to at least Drupal 11.1.9.
- Sites on Drupal 10.4, 10.3, 10.2, 10.1, or 10.0 should update to at least Drupal 10.4.9.
- Sites on any version of Drupal 9 are advised to update to 9.5.11.
- Sites on any version of Drupal 8 should update to Drupal 8.9.20.
- Drupal 7 is not affected by this issue, Drupal said.
Drupal's recommendation is to apply the security update as soon as it is released on May 20 and then upgrade in the near future to one of the supported branches (Drupal 11.3 or 10.6).
Manual patches and limitations for Drupal 8 and 9
For sites that remain on end-of-life major core versions, such as Drupal 8 and 9, Drupal will provide patch files for the most recent end-of-life releases (Drupal 8.9 and 9.5) that "will need to be applied manually." The announcement cautioned that there is no guarantee the fixes will work correctly for these older major releases and warned they "may introduce other issues or regressions."
Drupal urged a more definitive path for such sites: "We strongly recommend Drupal 8 or 9 sites update to at least Drupal 10.6 soon." The project also noted that Drupal 8 and 9 contain numerous other, previously disclosed, security vulnerabilities that will not be addressed by either Drupal Steward or the best‑effort patch files.
What this means for technologists, affected enterprises, and site owners
- Technologists and security teams should reserve the May 20 release window and prepare for immediate triage, because Drupal explicitly warns that exploits "might be developed within hours or days" of publication.
- Affected enterprises and procurement leaders should confirm which branch and patch level each site runs, apply the recommended pre-window upgrades (for example, 11.1.9 or 10.4.9 where applicable), and plan to apply the security release as soon as it is published.
- Operators of sites on end-of-life major releases (Drupal 8 and 9) will need to weigh the temporary mitigation of manually applied 8.9 or 9.5 patch files against the warning that those fixes are not guaranteed and could introduce regressions — Drupal recommends upgrading to 10.6 instead.
Immediate steps site maintainers should take
Drupal's notice makes three practical, time-sensitive asks: (1) update now to the latest supported patch for the branch you run so you can resolve upgrade issues ahead of the window; (2) reserve May 20, 2026, 5–9 p.m. UTC to check advisories and apply the security release immediately if your configuration is affected; and (3) for sites on older or end-of-life branches, apply the vendor-provided patch files manually if you cannot upgrade right away, while understanding these are best‑effort mitigations.
Drupal's advisory supplies precise version targets and a firm clock for action. Site owners and security teams who follow those specifics will have the best chance of avoiding a scramble if proof-of-concept exploits appear shortly after publication.
