Most software vulnerabilities show up unannounced, like a raccoon in the garage. Drupal's Security Team does it differently: it sends a formal heads-up two days early so you can clear your calendar, brew some coffee, and get ready. That heads-up went out on Monday, and the window opens today.
A 19-Out-of-25 Kind of Tuesday
In public service announcement PSA-2026-10-12, the Drupal Security Team confirmed a core security release for all supported branches on October 14, 2026, between 16:00 and 21:00 UTC. The issue is rated Critical, scoring 19 out of 25 on Drupal's risk calculator. The affected branches are Drupal 11.4.x, 11.3.x, and 10.6.x, and Drupal 12.0.0-beta1 is also affected.
As usual, the team isn't sharing details of the vulnerability until the fix ships. The PSA does warn that once it's public, "exploits might be developed within hours or days." Drupal Steward already blocks some known attack vectors, but the team says plainly that it doesn't cover every possible exploit.
The Patch Gap Is Where Sites Get Hurt
A critical core release is when attackers start reading the diff right along with defenders. Once the advisory is out, the clock is running. The sites that get compromised usually aren't the unlucky ones. They're the ones that were three minor versions behind and couldn't apply a one-line patch without first spending a day sorting out dependencies.
The detail most people miss is this: all Drupal versions before 10.6.x, and all Drupal 11 versions before 11.3.x, are end-of-life and won't receive this fix. If your site is on an older release, today's patch doesn't apply to you. You'll need an upgrade project first, and this is exactly why the Security Team recommends getting onto the latest supported patch release before release day.
Today is a good test of your update process. If "patch Drupal core" means a quick Composer command and a deploy, you're fine. If it means a week of meetings, attackers will move faster than you do.
If you're not sure your site can take today's patch cleanly, or you already know it's on an end-of-life branch, our Drupal team can help you get patched and onto a supported version.