Drupal to Release Urgent Core Security Updates on May 20, Sites Told to Prepare

Drupal plans to publish a core security release for all supported branches on May 20, 2026, between 5-9 p.m. UTC. The Drupal Security Team urges reserving time for core updates because exploits may be developed within hours or days. Not all configurations are affected, so sites should use the release window to determine whether they need an immediate update, with mitigation details provided in the advisory. Sites should update to the latest supported patch for their Drupal version before the deadline to address upgrade issues. Drupal expects patches for supported branches, including minimum versions of 11.1.9 and 10.4.9, followed by upgrades to newer minor releases soon after. For end-of-life major versions like Drupal 8 and 9, manual patch application may be required, with no guarantee of correct fixes and possible regressions.

"Drupal has issued an alert stating that it intends to release a "core security release" for all supported branches on May 20, 2026, from 5-9 p.m. UTC. "The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days," the maintainers of the PHP-based content management system (CMS) said."

""Not all configurations are affected. Reserve time on May 20 during the release window to determine whether your sites are affected and in need of an immediate update. Mitigation information will be included in the advisory." It's being advised to update to the latest supported patch for the site's version of Drupal before the deadline so that any outstanding upgrade issues can be addressed."

"Ahead of the planned update window - Sites on Drupal 11.1 or 11.0 should update to at least Drupal 11.1.9. Sites on Drupal 10.4, 10.3, 10.2, 10.1, or 10.0 should update to at least Drupal 10.4.9. The idea is that these sites should apply the security update as soon as it is released on May 20, and then upgrade to Drupal 11.3 or 10.6 in the near future."

"For sites still on end-of-life major core versions, such as Drupal 8 and 9, patch files for Drupal 8.9 and 9.5 will need to be applied manually. However, Drupal has warned that there is no guarantee the fixes will work correctly, adding that they may introduce other issues or regressions. "However, they may help mitigate the vulnerability for sites still on "

Read at The Hacker News