Contact forms are the digital equivalent of a "Please Wipe Your Feet" mat — you assume nothing dramatic could possibly happen there. Turns out the Drupal ecosystem just learned that a form built to collect polite little text submissions can also be turned into a wide-open door for remote code execution, and that's a plot twist nobody wanted.

One Critical Bug, Twenty Friends

On September 23, 2026, the Drupal Security Team dropped a coordinated advisory window (17:00–21:00 UTC) covering the Webform module, one of the most widely installed contributed projects in the entire Drupal ecosystem. The headline item, SA-CONTRIB-2026-175, is a critical remote code execution vulnerability — as serious as it gets.

It didn't come alone. The same release window bundled roughly twenty additional advisories ranging from cross-site scripting to access bypass and denial-of-service issues. Drupal core itself is untouched; this is squarely a Webform problem, but given how many marketing, HR, and lead-gen forms run through it, "squarely a Webform problem" still touches an enormous number of live sites.

Why Your Patch Queue Can't Wait

Here's the part that should get site owners moving faster than usual: these releases are explicitly not covered by Drupal Steward's automatic patching. If you're leaning on Steward as a safety net, this one slips right through it. That means someone has to manually pull the update, test it, and deploy it — and with an RCE in play, "someday this sprint" isn't a real plan.

Attackers don't need to reverse-engineer some exotic edge case here; RCE advisories in popular contributed modules tend to get weaponized within days of disclosure, because the patch itself is a roadmap for what was broken. The window between "advisory published" and "opportunistic scanning begins" is measured in hours, not weeks.

A form that quietly collects "Tell us about your project" shouldn't also be capable of handing someone a shell. Patch it like you mean it.

If your team doesn't have a process for triaging Drupal contrib security advisories the same day they drop, that's exactly the kind of gap we help clients close — let's talk about locking down your Drupal stack.

Source: Drupal.org