Some people mark the weeks by Taco Tuesday. Drupal site owners mark them by security advisory day, and this week's lineup was stacked. The Drupal Security Team published 26 contributed-project advisories in one go, and the top of the bill was a module that sounds harmless: Block AJAX.
One Highly Critical, Seven Critical, Zero Chill
As The DropTimes reports, the batch covered 25 projects: one highly critical advisory, seven critical, 17 moderately critical and one less critical. The headliner is SA-CONTRIB-2026-192 for Block AJAX, the module that loads blocks asynchronously over Ajax. It's rated highly critical with a score of 20 out of 25.
The bug is PHP object injection. The module didn't properly validate user-supplied data used to build a block, which can lead to remote code execution. Exposure is somewhat limited: it only affects sites with Layout Builder enabled, or another block plugin that handles the passed data unsafely. That's a lot of modern Drupal sites, though, because Layout Builder is everywhere. Versions earlier than 3.0.2 are affected. The fix is to upgrade to 3.0.2, and per the release notes, the Twig Tweak support that introduced the issue has been reverted.
The Danger Lives in the Contrib Long Tail
Drupal core gets plenty of security attention, and for good reason. The real-world risk is often in contrib, though: the dozens of modules a typical site picks up over the years, some of which nobody on the current team remembers installing. Twenty-six advisories in a single drop is a reminder that your attack surface is your whole composer.json, not just core.
The bit worth stressing is how this bug got in. A feature addition, Twig Tweak support, quietly opened the hole, and the fix was to roll it back. Helpful features and dangerous features can be the same code. That's why "we'll update next quarter" is not a patching strategy, and why the advisory's warning about possible breaking changes means you should test the update, not skip it.
Patch Block AJAX today, then do a quick audit of the rest of your module list. Future you will be grateful.
If this advisory batch made you realize nobody's really keeping an eye on your contrib modules, our Drupal team can audit and patch your site before the next drop lands.
Source: The DropTimes