34 advisories in one day and an exploit in 51 minutes: Drupal security in 2026.

On 21 October 2026 the Drupal Security Team published 34 security advisories for contributed projects in a single day. Two of them described remote code execution, the kind of flaw that lets an attacker take over the server. A week earlier core itself got a critical fix. Five months earlier a core vulnerability was being attacked on thousands of sites two days after the patch came out.

This post is not meant to scare. It shows the scale in numbers so it is easier to answer one question: is someone checking my site every week, or once a quarter?

The numbers worth remembering.

How often fixes ship.

Every Drupal security fix comes with a public advisory (Security Advisory, SA for short) on drupal.org. The numbering restarts each year, so counting a year's advisories is straightforward.

Contributed advisories have been growing for three years, but the real jump came in mid-2026:

Since June there have been several times more advisories, because bugs are being found faster. In May 2026 the Drupal Association received a grant from the Alpha-Omega programme for AI-assisted vulnerability research. After six weeks it reported more than ten published advisories and more than 30 filed issues. It also said plainly that the bottleneck is no longer finding bugs but the time volunteers need to verify and fix them. I described the same pattern in the post on the PHP2Shell flaws, where AI tools found most of the bugs too.

In fairness: more advisories does not mean Drupal's code is worse than a year ago. It means the bugs that were already there come to light sooner. For a site owner the effect is the same, though — more fixes to deploy, and each one is a public pointer to where the hole is.

Drupal advisories usually come out on Wednesdays. In 2026 there was hardly a Wednesday without new fixes.

It is not just obscure modules.

Many advisories cover modules with a few hundred installs. But the list from the last two years also includes modules that almost every Drupal business site has. Install counts are drupal.org figures for the week of 11 October 2026. They only count sites that report usage, so the real numbers are higher.

A separate case is the AI module, part of Drupal CMS. Since early 2025 it has had more than a dozen advisories, including critical remote code execution and CSRF. If your site integrates with language models, that is one of the most frequently patched parts of the whole ecosystem.

Advisories marked “Unsupported” are also getting more common. Such an advisory means the module has a known vulnerability and its maintainer has not fixed it. The module is officially abandoned and no update is coming. The only way out is to replace it or remove it.

The window to react is shrinking.

The clearest example from 2026 is SA-CORE-2026-004 from 20 May: an SQL injection in core (CVE-2026-9082), exploitable without logging in on sites using PostgreSQL. Here is how it unfolded:

• 20 May, 05:12 UTC — Miggo Security detects the public patch.
• 20 May, 06:03 UTC — Miggo has a working exploit, written with the help of Claude for under 10 dollars. It notes that a human had to step in at a few points.
• 22 May — Drupal raises the risk score to 23/25 after detecting exploit attempts. Imperva records more than 15,000 attack attempts against nearly 6,000 sites in 65 countries in the first two days.
• Then — the US agency CISA adds the flaw to its catalogue of known exploited vulnerabilities.

The pattern is not new, just faster. After the Drupalgeddon flaw in 2014 the Drupal Security Team warned that sites not patched within 7 hours should be treated as compromised. The difference is that writing an exploit no longer takes a specialised team.

The October core flaw (SA-CORE-2026-014, remote code execution in the Field UI module) shows a different problem. Core alone is not directly exploitable, but according to the advisory several popular modules open a path to it, one of them without logging in. Whether a site is at risk depends on its whole set of modules, not just the core version.

How many sites run without support.

Only supported Drupal branches receive fixes. In October 2026 these are 10.6, 11.3 and 11.4. According to drupal.org data from 11 October 2026:

Then there is Drupal 7, which has had no fixes since 5 January 2025. The drupal.org table does not list it separately, but the gap between all Drupal sites (823,823) and sites on versions 8–12 is about 177,000 — mostly Drupal 7. According to W3Techs (August 2026) Drupal 7 still accounts for 29.6% of detected Drupal sites, and all unsupported versions together for about 50%.

In practice, roughly every other Drupal site will not get a fix for the next vulnerability on the list above. And being on a supported branch does not mean a site has the latest fixes installed. The drupal.org statistics do not show that.

How to keep watch over your own site.

At this pace, the monthly update review that used to be enough no longer is. The rhythm that works in 2026:

1. Check new advisories every week, on Wednesday or Thursday. The easiest way is to turn on email notifications for security updates in the Update Status module, or run composer audit or drush pm:security in the project. Advisories are also available as an RSS feed on drupal.org/security.
2. Deploy critical fixes within a day. Advisories rated “Critical” and “Highly critical” should not wait for the weekly review. If updating right away is not possible, the advisory usually gives a workaround, such as disabling the vulnerable module.
3. Test on a copy of the site. Deploying fast is only safe if there is somewhere to check it first. Without a staging copy every update risks breaking the site, which is the most common reason businesses put them off.
4. Keep track of core minor versions. Support ends not only for major versions. Drupal 10.5 and 11.2 stopped receiving fixes even though they are still “10” and “11”. Plan the move to a newer branch ahead of time.
5. Remove unneeded and abandoned modules. Every module means more advisories to follow. A module that is enabled but unused, or one with an “Unsupported” advisory, is risk with no benefit.
6. Have a backup that someone has tested, plus uptime monitoring. If something does happen anyway, they decide whether the outage lasts an hour or a week.

I cover why updates protect a site in more detail in the post on Drupal updates, and the costs in how much Drupal maintenance costs.

Frequently asked questions.

How often are Drupal security updates released? In 2026, practically every week. By 21 October the Drupal Security Team had published 253 advisories for contributed projects and 16 for core. They usually come out on Wednesdays.

Do the fixes only affect obscure modules? No. In 2026 the patched projects included Webform (357,000 installs, 20 advisories in one day), Paragraphs, CAPTCHA, Gin, Colorbox, Entity Browser and core itself, including an SQL injection that was attacked two days after the fix.

How do I know my site needs an update? The status report in the Drupal admin lists missing security updates. The Update Status module can email you about them, and composer audit and drush pm:security check the same from the command line.

My site runs Drupal 7 or 9. Is that a problem? Yes. Drupal 7, 8 and 9 no longer receive security fixes, and neither do Drupal 10.5, 11.2 or older branches. Every new vulnerability stays on such a site for good. The fix is updating to a supported branch or, for Drupal 7, migrating.

Summary.

In 2026 Drupal gets security fixes every week, sometimes dozens at once, and an exploit can appear within an hour of publication. It is not only obscure modules that get patched but also Webform, Paragraphs and core itself. Meanwhile roughly half of all Drupal sites run versions that receive no fixes at all.

There is no need to panic, but it does need to be in the calendar. A site that someone reviews weekly, tests fixes on a copy and deploys critical ones within a day gets through a year like this without a story to tell. If you are not sure what state your site is in, get in touch — I will check the core version, modules and missing fixes. Ongoing care is described on the Drupal maintenance page, and if something has already happened, see Drupal site repair.

Sources

• Drupal.org: contributed-project security advisories and core advisories — yearly and monthly counts as of 21 Oct 2026
• Drupal.org: project usage statistics and core usage by version — week of 11 Oct 2026
• SA-CORE-2026-004, SA-CORE-2026-014, SA-CONTRIB-2026-175 (Webform)
• The Drop Times: Miggo and the 51-minute exploit; Security Affairs: CVE-2026-9082 under attack; Qualys: added to CISA KEV
• The Drop Times: first six weeks of the AI security initiative; Alpha-Omega; The Drop Times: Digital Matters on larger advisory batches
• The Drop Times: W3Techs — about half of Drupal sites on unsupported versions