[IT-SecNots] [Security-news] Upcoming critical contributed project security release on September 23, 2026 - PSA-2026-09-21

[security-news AT drupal.org]

View online: https://www.drupal.org/psa-2026-09-21

Date: 2026-September-21
Security risk: *Critical* 16 ∕ 25
AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [1]
Description: 
There will be a security release for a widely used contributed module on
*September 23, 2026 between 17:00 and 21:00 UTC*.

We are announcing this release in advance because the affected contributed
module is used on a significant portion of Drupal sites, and the upcoming
release will include a significant number of advisories. The advisory with
the highest risk score for the release is currently rated as *critical*.

Drupal core is not affected.

.. Advisories may be published in batches (a few at a time)

The current rate of advisories may require changes to our practices going
forward:

 * The security team may publish advisories individually, at different times
   inside the window.
 * We will try to publish batches grouped by module.
 * We will announce in Slack when all planned releases for the day are
   complete.
 * We will release mailing list emails about the security updates together at
   the end of the window, to reduce the risk of site owners updating multiple
   times while advisories are still being published.

These changes are intended to make the process easier for the team and to
make communication from the team easier to follow.

.. No special release procedures

The planned update does not require special release procedures.

Coordinated By: 
 * Bram Driesen (bramdriesen) [2] of the Drupal Security Team
 * Damien McKenna (damienmckenna) [3] of the Drupal Security Team
 * Greg Knaddison (greggles) [4] of the Drupal Security Team
 * Dave Long (longwave) [5] of the Drupal Security Team
 * Moshe Weitzman (moshe weitzman) [6] of the Drupal Security Team
 * Pierre Rudloff (prudloff) [7] of the Drupal Security Team
 * Jess  (xjm) [8] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [9]

[1] https://www.drupal.org/security-team/risk-levels
[2] https://www.drupal.org/u/bramdriesen
[3] https://www.drupal.org/u/damienmckenna
[4] https://www.drupal.org/u/greggles
[5] https://www.drupal.org/u/longwave
[6] https://www.drupal.org/u/moshe-weitzman
[7] https://www.drupal.org/u/prudloff
[8] https://www.drupal.org/u/xjm
[9]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3624755

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at