On October 12, 2026, the Drupal Security Team announced that on Wednesday, October 14, it will release a critical security fix for Drupal core covering every supported version: 11.4, 11.3 and 10.6. The release window is 16:00 to 21:00 UTC. The team asks site owners to reserve time that day to update.
What we know
- The announcement: according to drupal.org's public service announcement PSA-2026-10-12, published October 12, there will be a core security release for all supported branches on October 14, between 16:00 and 21:00 UTC.
- Severity: drupal.org scores it 19 out of 25 on its risk calculator, the top of the "Critical" band (15 to 19). Only "Highly Critical" ranks higher.
- What the score means: under drupal.org's definitions, the flaw needs no account on the site, affects every configuration, and could expose all non-public data and allow it to be changed or deleted. The same score also says exploitation is complex (many steps and conditions) and that no public exploit code exists.
- Affected versions: per the announcement, all supported versions: Drupal 11.4.x, 11.3.x and 10.6.x. The 12.0.0-beta1 test release is affected too; new betas will follow.
- Why not wait: the Security Team warns that exploits "might be developed within hours or days" after release.
- What to do before the 14th: the announcement recommends moving to the latest patch release of your branch before October 14, so any upgrade problems are solved ahead of the window. Drupal.org's release history lists those as 11.4.9 (October 9), 11.3.18 (September 28) and 10.6.18 (September 26).
- Drupal Steward: sites using that protection service are already shielded from some known attack vectors, but not all, and should still update, the announcement says.
- What is not known: drupal.org says no one will share more details until the release announcement.
- Unsupported versions: everything before 10.6.x, and Drupal 11 before 11.3.x. The announcement urges those sites to update as soon as possible.
What changes and what doesn't
There is nothing to patch today: the fix does not exist yet. What changes is the schedule. Anyone running a Drupal site now knows they need someone available on Wednesday the 14th to install the new release the same day.
The October 14 window in local time: 12:00 to 17:00 in New York (EDT), 9:00 to 14:00 in Los Angeles (PDT) and 17:00 to 22:00 in London (BST).
Sites built on WordPress or other content management systems are not affected. Nothing changes for contributed modules either: this notice covers core only.
If your site runs an unsupported version (for example Drupal 11.2 or Drupal 10.5), it will not get this fix. That takes more work than a patch, so it is worth starting today.
How to check if it affects you
- Check your version. As an administrator, go to Reports → Status report (/admin/reports/status). The first line shows the Drupal version.
- Match it to your branch: 11.4.x → install 11.4.9 today; 11.3.x → 11.3.18; 10.6.x → 10.6.18. If you already have it, the site is ready for the 14th.
- If your version is not on that list, the site is out of support and will not receive the October 14 fix. Ask for a plan to move it to a supported branch.
- Back up the database and files before every update.
- Book someone for October 14 during the window in your time zone. The new release can land at any point in those five hours.
- Watch for the release on drupal.org's security advisories page or its RSS feed. That is where the version numbers to install will appear.
- If someone else maintains the site, ask them today: "Which Drupal version is the site on, and who will install the October 14 core security release?"
Related: Drupal: 26 Module Security Advisories, What to Update
Sources
- Drupal Security Team, "Upcoming critical Drupal core release on October 14, 2026 - PSA-2026-10-12", October 12, 2026
- Drupal.org, Drupal core release history
- Drupal.org, "Security risk levels defined"
Updates: the fixed version numbers will be added here once drupal.org publishes them on October 14.