Drupal’s Critical Window
On 12 October 2026, Drupal announced a 14 October critical core release window of 18:00 to 23:00 Madrid. No fix is available yet.
Affected releases are 11.4.x, 11.3.x, 10.6.x and 12.0.0-beta1; beta fixes follow supported releases. Earlier branches are unsupported.
Drupal advises moving to the latest supported bugfix before the window to resolve upgrade problems first. That bugfix is preparation, not the security fix.
Drupal’s 19/25 risk rating is not CVSS. Exploitation is theoretical, not an observed attack.
No mechanism, CVE, fixed version or full mitigation is public. Drupal Steward covers some known paths, not every possible exploit, and does not replace updating.
Name the team that will assess the advisory and deploy the right branch when Drupal publishes it.
Sources
- Drupal PSA-2026-10-12, published 12 October 2026
- Drupal security advisories
