Drupal security updates

Security-fix and disclosure events for Drupal. Targets recurring searches like “Drupal security updates” with timeline evidence — not a marketing changelog.

23 timeline events on record.

Oct 14, 2026
Follow-up for SA-CORE-2026-016: update performance tests.
Dependency remediation
Follow-up for SA-CORE-2026-016: update performance tests.
Open related record
Oct 14, 2026
fix: SA-CORE-2026-016
Confirmed security fix
fix: SA-CORE-2026-016 By: erictee2802 By: hai27ii2o By: benjifisher By: jurgenhaas By: larowlan By: mingsong By: mohit_aghera By: neclimdul By: plopesc By: poker10 By: prudloff By: cilefen By: longwave By: xjm (cherry picked from commit 4fec58fb57c828b97d3565d97a0676c6bace51f1)
Open related record
Oct 14, 2026
fix: SA-CORE-2026-015
Confirmed security fix
fix: SA-CORE-2026-015 By: dev-winty By: benjifisher By: catch By: dcam By: fathershawn By: larowlan By: mcdruid By: mohit_aghera By: xjm By: akalata By: drumm By: greggles By: longwave By: neclimdul By: poker10 By: ram4nd (cherry picked from commit e5bda07db8b26c1ccafcab17a1066…
Open related record
Oct 14, 2026
fix: SA-CORE-2026-014
Confirmed security fix
fix: SA-CORE-2026-014 By: mcdruid By: ogalland-tob By: catch By: larowlan By: longwave By: xjm By: akalata By: bramdriesen By: greggles By: hestenet By: poker10 By: prudloff (cherry picked from commit ef786b7afce257c980f5d093cb08a5d4a8df86ba)
Open related record
Jul 15, 2026
SA-CORE-2026-012 by hai27ii2o, danielveza, larowlan, mingsong, neclimdul, greggles, longwave, xjm
Confirmed security fix
SA-CORE-2026-012 by hai27ii2o, danielveza, larowlan, mingsong, neclimdul, greggles, longwave, xjm
Open related record
Jul 15, 2026
SA-CORE-2026-011 by prudloff, fathershawn, catch, larowlan, longwave, xjm
Confirmed security fix
SA-CORE-2026-011 by prudloff, fathershawn, catch, larowlan, longwave, xjm
Open related record
Jul 15, 2026
SA-CORE-2026-010 by offensive-ai, benjifisher, kim.pepper, mohit_aghera, catch, larowlan, poker10, xjm
Confirmed security fix
SA-CORE-2026-010 by offensive-ai, benjifisher, kim.pepper, mohit_aghera, catch, larowlan, poker10, xjm
Open related record
Jun 17, 2026
SA-CORE-2026-008 by 0xhamy, ama62, askibinski, ayalon, betah4k, gabesullice, john morahan, michaelwinser, nbanderso, offensive-a, plach, qquynh, unknownhad, larowlan, longwave, mcdruid, phenaproxima, seanb, benjifisher, cilefen, damienmcken
Confirmed security fix
SA-CORE-2026-008 by 0xhamy, ama62, askibinski, ayalon, betah4k, gabesullice, john morahan, michaelwinser, nbanderso, offensive-a, plach, qquynh, unknownhad, larowlan, longwave, mcdruid, phenaproxima, seanb, benjifisher, cilefen, damienmckenna, dokumori, greggles, neclimdul, poke…
Open related record
Jun 17, 2026
SA-CORE-2026-009 by cantina_security, bbrala, kim.pepper, larowlan, damienmckenna, greggles, poker10
Confirmed security fix
SA-CORE-2026-009 by cantina_security, bbrala, kim.pepper, larowlan, damienmckenna, greggles, poker10 (cherry picked from commit aa6c3eb6e1ba358f5e1a5037d3e2b8006972af44)
Open related record
Jun 17, 2026
SA-CORE-2026-007 by melih-acikoz, michaelwinser, willempje2, larowlan, catch, cilefen, greggles, neclimdul, poker10
Confirmed security fix
SA-CORE-2026-007 by melih-acikoz, michaelwinser, willempje2, larowlan, catch, cilefen, greggles, neclimdul, poker10 (cherry picked from commit 93af65c047be13920c583a09e331aed4f2521acd)
Open related record
Jun 17, 2026
SA-CORE-2026-006 by michaelmaturi, larowlan, mohit_aghera, akalata, benjifisher, cilefen, greggles, longwave, mcdruid, poker10, xjm
Confirmed security fix
SA-CORE-2026-006 by michaelmaturi, larowlan, mohit_aghera, akalata, benjifisher, cilefen, greggles, longwave, mcdruid, poker10, xjm (cherry picked from commit 7b0fc80ebfadc8c6aefcad913d64e0263a624297)
Open related record
Jun 17, 2026
SA-CORE-2026-005 by michaelmaturi, bbrala, berdir, larowlan, longwave, mcdruid, akalata, benjifisher, damienmckenna, david strauss, drumm, greggles, hestenet, poker10, ram4nd, xjm
Confirmed security fix
SA-CORE-2026-005 by michaelmaturi, bbrala, berdir, larowlan, longwave, mcdruid, akalata, benjifisher, damienmckenna, david strauss, drumm, greggles, hestenet, poker10, ram4nd, xjm (cherry picked from commit 4bfbbd7e3ed305eb43e18f64a301f71b7d4e5e20)
Open related record
Jun 9, 2026
task: #3522220 Add tests for SA-CORE-2025-003
Confirmed security fix
task: #3522220 Add tests for SA-CORE-2025-003 By: mcdruid By: smustgrave By: nicxvan By: ghost of drupal past By: longwave By: shin24
Open related record
Jun 9, 2026
task: #3593777 Add tests for SA-CORE-2025-001
Confirmed security fix
task: #3593777 Add tests for SA-CORE-2025-001 By: prudloff By: smustgrave By: larsdesigns By: mcdruid By: catch By: greggles By: benjifisher By: longwave By: hestenet
Open related record
Jun 3, 2026
task: #3592099 Add tests for SA-CORE-2021-002
Confirmed security fix
task: #3592099 Add tests for SA-CORE-2021-002 By: prudloff By: smustgrave By: alexpott By: Jasu_M By: mlhess By: pwolanin By: xjm By: samuel.mortenson By: nwellnhof By: effulgentsia By: larowlan By: phenaproxima By: mcdruid
Open related record
May 26, 2026
task: #3592065 Drupal core-recommended pins vulnerable symfony/polyfill-intl-idn version affected by CVE-2026-46644
Confirmed security fix
task: #3592065 Drupal core-recommended pins vulnerable symfony/polyfill-intl-idn version affected by CVE-2026-46644 By: ahmetburkan By: godotislate By: znerol
Open related record
May 20, 2026
SA-CORE-2026-004 by michaelmaturi, longwave, catch, bbrala, mcdruid, larowlan, xjm, benjifisher, poker10, greggles, hestenet, damienmckenna, heine
Confirmed security fix
SA-CORE-2026-004 by michaelmaturi, longwave, catch, bbrala, mcdruid, larowlan, xjm, benjifisher, poker10, greggles, hestenet, damienmckenna, heine (cherry picked from commit ea9524d9c75dd4fcbaf5d4a823c7f571de7d546c)
Open related record
Apr 15, 2026
SA-CORE-2026-002 by hswww, menon, t-chen, benjifisher, cilefen, drumm, greggles, larowlan, longwave, mcdruid, ram4nd, xjm, poker10
Confirmed security fix
SA-CORE-2026-002 by hswww, menon, t-chen, benjifisher, cilefen, drumm, greggles, larowlan, longwave, mcdruid, ram4nd, xjm, poker10 (cherry picked from commit 0cf26c62bc4808e3473a61a93183fbaa1fba278c)
Open related record
Apr 15, 2026
SA-CORE-2026-003 by cantina_security, dries, shirshaw64@gmail.com, larowlan, mcdruid, mingsong, damienmckenna, greggles, poker10, xjm
Confirmed security fix
SA-CORE-2026-003 by cantina_security, dries, shirshaw64@gmail.com, larowlan, mcdruid, mingsong, damienmckenna, greggles, poker10, xjm (cherry picked from commit 8232489c2ded1170f3eb9ad7b68d686fe625ddfc)
Open related record
Apr 15, 2026
SA-CORE-2026-001 by murat_kekic, akalata, benjifisher, drumm, larowlan, mlhess, neclimdul, pandaski, poker10, ram4nd, xjm, prufloff, greggles
Confirmed security fix
SA-CORE-2026-001 by murat_kekic, akalata, benjifisher, drumm, larowlan, mlhess, neclimdul, pandaski, poker10, ram4nd, xjm, prufloff, greggles (cherry picked from commit 8812078f73e6cf172b2b9722882a1a2a0ec00b86)
Open related record
Jan 12, 2026
task: #3562214 Upgrade glob because of CVE-2025-64756
Dependency remediation
task: #3562214 Upgrade glob because of CVE-2025-64756 By: lobodakyrylo By: quietone By: longwave
Open related record
Nov 12, 2025
SA-CORE-2025-008 by damienmckenna, tame4tex, benjifisher, mohit_aghera, larowlan, mingsong, xjm, neclimdul, catch, drumm, poker10
Confirmed security fix
SA-CORE-2025-008 by damienmckenna, tame4tex, benjifisher, mohit_aghera, larowlan, mingsong, xjm, neclimdul, catch, drumm, poker10 (cherry picked from commit 1f32c7c2a6bba06161b66921255a6d9de65aadca)
Open related record
Feb 3, 2025
Issue #3503195 by alexpott, longwave, loopy1492: Twig needs updating for CVE-2025-24374
Confirmed security fix
Issue #3503195 by alexpott, longwave, loopy1492: Twig needs updating for CVE-2025-24374
Open related record