Somewhere out there, a Drupal site's humble "Contact Us" form is quietly powering lead gen, event signups, and customer support tickets — and on September 23rd, it turned out that same form might also be powering a hacker's afternoon. Twenty-one security advisories in one release. That's not a patch, that's a patch Tuesday on steroids.

21 Advisories, One Very Busy Patch Day

The Drupal Security Team's contributed-project release on September 23, 2026 hit the Webform module — one of the most widely installed tools in the entire Drupal ecosystem — with 21 separate advisories. The headline act is SA-CONTRIB-2026-175, a critical remote code execution flaw, backed up by a supporting cast of cross-site scripting, access bypass, server-side request forgery, and denial-of-service issues.

Drupal core itself is untouched — this is squarely a Webform problem. But given how many sites lean on Webform for anything from job applications to donation forms, "core is fine" is cold comfort if your contact form is the front door someone just picked the lock on.

Why "I'll Patch It Later" Isn't a Plan

Here's the part that should make site owners sit up: Drupal explicitly noted these vulnerabilities won't be auto-remediated by Drupal Steward, the managed patching service some sites lean on as a safety net. Translation: nobody is quietly fixing this for you in the background. You, or someone you trust, has to go do it.

RCE bugs in a form-handling module are especially nasty because forms are, by design, the one part of your site built to accept input from total strangers. That's the whole point of a contact form — and exactly why it's such an efficient attack surface when something goes wrong under the hood.

Twenty-one advisories in one drop isn't a fluke, it's a reminder that "set it and forget it" was never a real CMS strategy.

If your Drupal site is running Webform and you're not 100% sure it's patched, that's exactly the kind of gap our free developer security checklist was built to help you close.

Source: Drupal.org