@drupalsecurity

Republish Drupal Security Advisories & related news. Follow Drupal Security Team. @mlh407 to get RT. DM & mentions not monitored. https://xitter.cf/t.co/BswJZrKuK4

 Web
drupal.org/security
Joined April 2009
  • Tweets1.7K
  • Following23
  • Followers14.3K
1Media
Drupal Security Advisory content is automatically posted to other social/feed services like bsky.app/profile/drupalsecur… and drupal.community/@drupalsecu…
1
1
1
2,518
Drupal Security retweeted
The PHP Foundation@ThePHPFOct 20
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
344
4,176
1,253
18,612
7,039,288
Thrilled to announce that four provisional members have earned full membership on the Drupal Security Team! Welcome: 🇫🇷 Pierre Rudloff 🇦🇺 Joseph Zhao 🇧🇪 Bram Driesen 🇺🇸 Swan Kalata drupal.org/drupal-security-t… #Drupal #OpenSource #Security

Welcoming Four New Full Members to the Drupal Security Team

The Drupal Security Team is pleased to announce that four provisional members have been added as full members of the team: Pierre Rudloff (prudloff), Joseph Zhao (pandaski), Bram Driesen (bramdries...

drupal.org
12
1,170
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 read more at drupal.org/sa-core-2026-004

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

drupal.org
2
9
2
22
14,595
The Drupal Security Team estimates that up to 5% of Drupal sites may be vulnerable to this highly critical issue. Furthermore, a majority of Drupal sites may also be affected by the Symfony and Twig security advisories published today, so all sites should update soon.
1
4
7
1,887
Drupal-related security releases today include those referenced below. You can start updating dependencies from Symfony and doing testing steps now.
Fabien Potencier@fabpotMay 20
During the last few weeks, the #Symfony core team has been hard at work fixing a long list of vulnerabilities for both #Symfony and #Twig. Today, we're publishing that work in the biggest security patch releases ever. Bare with us and wish us luck 🍀
1
9
25
10,239
Upcoming highly critical release on May 20, 2026 - PSA-2026-05-18 Read more: drupal.org/psa-2026-05-18

Upcoming highly critical release on May 20, 2026 - PSA-2026-05-18

drupal.org
1
14
6
18
6,000
Site owners are encouraged to get their sites ready for a release of Drupal core that may affect them. Site owners should make upgrades easier (e.g. update to the most recent release, improve deployment automation, improve automated testing) given the current security climate.
1
7
1,427
The Drupal Security Team now has a Linkedin page. It will be for longer-form content than this channel, so participating in both communities is encouraged. Follow here linkedin.com/showcase/drupal…

Drupal Security Team | LinkedIn

Drupal Security Team | 634 followers on LinkedIn. Drupal Security Team facilitates coordinated vulnerability disclosure of security issues for software from drupal.org. | A channel for news from the...

linkedin.com
1
5
14
1,647
New Drupal core releases address XSS, access bypass, and a gadget chain hardening. The XSS issue is protected by the Drupal Steward service. Details on all 3 issues available at drupal.org/sa-core-2025-001 drupal.org/sa-core-2025-002 drupal.org/sa-core-2025-003

Drupal core - Critical - Cross site scripting - SA-CORE-2025-001

drupal.org
1
9
1,162
Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002 drupal.org/sa-core-2024-002 Only Drupal 10.0 through 10.2 are affected.

Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002

drupal.org
2
1
4
1,591
Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041 dlvr.it/TDP7b6

Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041

drupal.org
3
1
896
File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040 dlvr.it/TD6pWt

File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040

drupal.org
3
2
860
Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039 dlvr.it/TD6pWK

Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039

drupal.org
2
1
748
Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038 dlvr.it/TCqRyz

Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038

drupal.org
1
768
Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037 dlvr.it/TCqRyZ

Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037

drupal.org
2
2
655
Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036 dlvr.it/TCqRyR

Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036

drupal.org
1
1
547
Content Entity Clone - Moderately critical - Information Disclosure - SA-CONTRIB-2024-035 dlvr.it/TCqRyP

Content Entity Clone - Moderately critical - Information Disclosure - SA-CONTRIB-2024-035

drupal.org
3
1
528
Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2024-034 dlvr.it/TCqRy2

Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2024-034

drupal.org
3
2
552
Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033 dlvr.it/TCVC0z

Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033

drupal.org
1
3
762
Load more