Every few weeks, somewhere in the world, a Drupal site maintainer opens an email, reads three words — "security release available" — and quietly reschedules their evening. This week it's your turn, and honestly, it's not a bad one to lose an evening to.

Three Bugs, Zero Drama (If You Update)

Drupal's security team shipped a coordinated core release fixing three moderately critical vulnerabilities: an information disclosure bug (SA-CORE-2026-010) and two cross-site scripting flaws (SA-CORE-2026-011 and SA-CORE-2026-012). Sites on Drupal 11.4.x should jump to 11.4.4, 11.3.x and earlier to 11.3.14, and anyone still on Drupal 10 needs 10.6.13.

None of these are the "drop everything, the internet is on fire" tier of highly critical — but XSS bugs are the kind of thing that turn into "highly critical, actually" the moment someone publishes a working exploit chain. Drupal.org's advice is blunt: update immediately, don't wait for your next maintenance window.

Why "Moderately Critical" Still Deserves Your Attention

Here's the thing about "moderately critical" — it's a rating for the vulnerability in isolation, not for what happens when it's sitting on your site for six months unpatched next to that one contrib module nobody's updated since 2023. Layered risk is how a shrug-worthy XSS bug becomes a session-hijacking incident.

Drupal 10.5.x and 11.2.x and below are already end-of-life and getting zero coverage here, which is the quieter but scarier part of this story — a lot of sites are running versions that will never see this patch, or any patch, ever again.

The good news: patching is free, the fix is out, and "we meant to update Drupal core" is a much worse sentence to say after an incident than before one.

If your team's not sure which Drupal version your site is actually running (we see this more than you'd think), that's a five-minute conversation with WTK before it becomes a five-alarm one.

Source: Drupal.org