Drupal schedules a critical core security release for today
A fix for all currently supported Drupal core branches lands between 16:00 and 21:00 UTC today, with no technical detail released before then.
The Drupal Security Team published a pre-announcement on 12 October warning of a critical core security release landing today, 14 October, between 16:00 and 21:00 UTC. The advisory rates the issue 19 out of 25 on Drupal’s own risk calculator, critical, and says that once exploited, “all non-public data is accessible” and “all data can be modified or deleted.”
Every currently supported branch is affected: 11.4.x, 11.3.x, 10.6.x, and the 12.0.0-beta1 pre-release. Following Drupal’s standard disclosure policy, no technical detail about the actual flaw is published before the fix ships, so there’s nothing yet to say about the attack vector itself.
Why it matters: the security team’s own wording is “exploits might be developed within hours or days” of disclosure, so the gap between the patch landing and a working exploit appearing could be short. If you run Drupal, block out time this afternoon to update to the latest patch release for your branch rather than queuing it for next week.
The caveat: Drupal Steward, the managed protection service, covers some exploit patterns ahead of a fix but Drupal’s own advisory is explicit that “the protection offered will not cover all possible exploits.”