Security update

A security update is a new release of Drupal core, a module or a theme that fixes a vulnerability. The Drupal Security Team announces it in a security advisory, and the advisory names the fixed release for you to install. Until you do, the site remains exposed to the published problem.

How a security update reaches your site

Someone reports a vulnerability to the Security Team, and the issue stays confidential until the advisory is ready. The advisory is then published with the fix. Core advisories use the prefix SA-CORE, contributed project advisories use SA-CONTRIB, and public service announcements (PSAs) use PSA. A PSA can warn that a release is coming. The team may send one on the Monday before a Wednesday security release when the issue could easily be turned into an automated attack.

A contributed project advisory gives a risk level with a score out of 25, the affected versions and a Solution section that names the fixed release. The Security Team defines five levels, from Not critical (0 to 4) to Highly critical (20 to 25).

Your own site also checks. The core Update Status module marks an installed release that drupal.org has flagged as insecure, and shows an error on admin pages for users with the permission "View software update notifications". Separately, the System module fetches highly critical announcements from drupal.org and shows them on admin pages to users who can administer site configuration. When at least one announcement is tied to a release, all of them show as errors; when all are PSAs, they show as warnings.

Example

SA-CONTRIB-2026-253, published on 21 October 2026, covers a PHP object injection problem in the Monster Menus module, rated Critical. Its Solution section tells sites that use the module to upgrade to version 9.5.6. A site owner reads it, checks whether the module is installed, and, if it is, updates through the usual update routine: test on a copy, deploy, then run the database updates.

Common mistakes

• Running a development snapshot. Drupal.org says that with a dev snapshot of core or a contributed project, Drupal cannot tell whether a needed fix is installed, so you must check it yourself.
• Leaving nobody with notification rights. The permission description says site administrators need "View software update notifications" so that security updates are applied promptly.
• Skimming the advisory. Drupal.org makes it the site owner's responsibility to read each advisory and decide whether the site must upgrade the project it names.

For marketing and content teams

When it announced the core security release of 14 October 2026, the Security Team urged sites to reserve time for it because exploits might be developed within hours or days. A security update does not wait for a quiet week in the campaign calendar. Agree with your technical team who reads the advisories, and keep a staging site available, so a fix can be checked and shipped quickly. Ask for a short note after each release saying which advisories applied to your site.

Sources

• Drupal.org: Security advisories
• Drupal.org: Security advisory contributed projects list
• Drupal.org: SA-CONTRIB-2026-253
• Drupal.org: Security advisory coverage policy
• Drupal.org: Security risk levels defined
• Drupal.org: Core release schedule
• Drupal.org: Responding to critical security update advisories
• Drupal core 11.4.10: UpdateSettingsForm
• Drupal core 11.4.10: Update Status hooks
• Drupal core 11.4.10: System module hooks, critical advisories