Building Sentinel Connector: Drupal security patching on autopilot, with evidence of what's running in production. Drupal since 2008, co-founder TrueCMS.
Australia/Melbourne
Joined April 2009
- Tweets1K
- Following70
- Followers75
- Likes107
Where does your Drupal security information come from?
Sentinel’s Data sources page shows the external lists behind its checks, when each was last refreshed and whether it’s up to date.
#Drupal #CyberSecurity
4
Managing several Drupal sites?
Sentinel’s updated dashboard brings security updates, unsupported software, connection issues and actions waiting for review into one view.
See what needs attention and get to the next action faster.
#Drupal
4
Choose what goes into your next Drupal update.
With Sentinel Patching, select the modules, themes and libraries to update. Major-version upgrades stay under human control: Autopilot pauses for review and deployment.
#Drupal #DrupalSecurity
6
Drupal 10 reaches end of life on 9 December, under four weeks away. From 2027, core minor versions get 8 months of security support, not 12. How quickly could you list every client site still on 10.x, or on a minor about to lose support, from what's running in production?
1
11
What to ask your provider before Drupal 10 ends: truecms.au/insights/drupal-1…
Release schedule: drupal.org/about/core/polici…
Minor support cut to 8 months: drupal.org/psa-2026-11-02
2
Most security patch delays aren't technical. The fix is ready, then waits on permission, UAT and a release window. Agree in advance: critical fix, agreed checks pass, deploy, notify. Approving the hours isn't enough; the release needs authority too. truecms.au/insights/security…
1
6
Migration guide: truecms.au/insights/govcms8-…
Release notes: github.com/truecms/design-sy…
Unified package: npmjs.com/package/@truecms/d…
10
When a security fix ships, what’s your definition of done?
For agency fleets, “merged” and “deployed” are real milestones — and still leave room for a stalled release, a worker that kept the old build, or one site that missed the train.
A useful last step is verifying the patched version is what’s serving in production. That’s the gap Sentinel Connector is built around.
7
New in Sentinel: re-check all your Drupal sites against the latest releases and security advisories from one button, with live progress. Available on paid plans, once every 15 minutes.
sentinelconnector.io
#Drupal
1
52
Drupal's busiest security season in years. A highly critical Commerce bypass under active exploitation. PHP2Shell on CISA KEV.
The fixes exist. The hard part is proving they're running in production.
The ticket says Done. The server often disagrees.
143
"Core alone isn't exploitable" is the line getting quoted from SA-CORE-2026-014, the Drupal Field UI RCE fixed on 14 Oct.
Read the next sentence too: multiple serious exploit paths exist with contrib modules, and at least one needs no login. 1/5
1
46
Three-step exposure check:
1. Is core below the fixed release for your branch? (Status report or drush status)
2. Is Field UI enabled? drush pm:list --status=enabled | grep field_ui
3. If both are yes, update now, or uninstall field_ui today until you can. 4/5
1
5
Uninstalling field_ui is the advisory's own mitigation. It removes the admin screens for managing fields, not your fields or content.
Then patch, and confirm the version on production, not just in the repo.
drupal.org/sa-core-2026-014 5/5
2
"We're on PHP 8.3" isn't an answer. 8.3.36 is.
The PHP2Shell fixes (CVE-2026-109618, CVE-2026-109619) shipped in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Knowing the branch isn't enough. You need the full patch version. 1/5
2
77
After updating, restart PHP-FPM and any long-running workers. A patched package on disk does nothing while the old processes keep serving requests. 4/5
1
21
