Drupal Security Team Schedules Critical Patch for September 23
Drupal administrators must prepare for a critical security update targeting a widely used contributed module scheduled for release on September 23, 2026.
Drupal security teams scheduled a critical update for September 23, 2026, between 17:00 and 21:00 UTC. This patch targets a widely installed contributed module.
You need to plan maintenance now. The release addresses multiple security concerns, including at least one critical vulnerability, and contains a significant number of advisories.
Review your current module inventory before the window opens. Because exposure is broad and the security impact is high, you should schedule time for updates during or shortly after the specified release window to coordinate deployment across your environments.
Technical teams must monitor the Drupal security advisories page on release day for specific instructions regarding the patch and necessary remediation steps.