Nothing says "check your update notifications" like the words "remote code execution" showing up next to a module running on a huge chunk of the Drupal-powered internet. If your site collects a single contact form through Webform, today's homework just got assigned.

21 Advisories, One Very Bad Day

On September 23, 2026, the Drupal Security Team dropped 21 security advisories for the Webform contributed module in a single coordinated release. The headline act, SA-CONTRIB-2026-175, is rated critical and allows remote code execution.

The rest of the pile isn't exactly light reading either: nine cross-site scripting bugs, seven access-bypass issues, one server-side request forgery, and a denial-of-service flaw for good measure. Some of these are exploitable in default configurations, and a few don't even require a login.

Why This One Actually Matters

Webform is one of the most-installed modules in the entire Drupal ecosystem — it's the thing behind contact forms, application forms, surveys, you name it. A vulnerability this broad in a module this common isn't a niche edge case; it's a "how many of our clients' sites just got more interesting to attackers" situation.

Also worth noting: Drupal Steward, the program that normally backports fixes for sites on older unsupported branches, does not cover this release. Translation — there's no safety net catching stragglers this time. You either update or you're exposed.

Twenty-one advisories in one drop is Drupal's security team basically saying "we found a lot, please don't make us say we told you so."

If patch day for a module this widespread makes your stomach drop a little, that's the exact feeling James and the WTK team live to prevent — grab the free developer security checklist and get ahead of the next one.

Source: Drupal.org