14 Oct 2026
Drupal.org aggregator
Dynamosys Insights: Drupal 11.4.10 Fixes Critical Security Flaw: What Site Owners Should Do Now
Drupal 11.4.10 addresses three core security vulnerabilities, including a critical remote code execution flaw. Site owners should prioritize the appropriate core update and check whether separate Gin or Entity List updates also apply.
14 Oct 2026 7:20pm GMT
Darren Oh: Try the Drupal AI demo!
Try the Drupal AI demo!
Darren Oh
- Read more about Try the Drupal AI demo!
- Log in or register to post comments
14 Oct 2026 6:59pm GMT
Security advisories: Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016
drupalThe Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.
Install the latest version:
Drupal 11
- If you use Drupal 11.4.x, update to Drupal 11.4.10.
- If you use Drupal 11.3.x, update to Drupal 11.3.19.
- Drupal 11.2.x and below are end-of-life and do not receive security coverage.
Drupal 10
- If you use Drupal 10.6.x, update to Drupal 10.6.19.
- Drupal 10.5.x and below are end-of-life and do not receive security coverage.
- Benji Fisher (benjifisher) of the Drupal Security Team
- Jürgen Haas (jurgenhaas)
- Lee Rowlands (larowlan) of the Drupal Security Team
- Mingsong (mingsong), provisional member of the Drupal Security
- Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team
- James Gilliland (neclimdul) of the Drupal Security Team
- Pablo López (plopesc)
- Juraj Nemec (poker10) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
- cilefen (cilefen) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- James Gilliland (neclimdul) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
14 Oct 2026 5:25pm GMT
Symfony Blog
SymfonyCon Warsaw 2026: Web-less Console: Standalone Apps in Symfony 8.2
Want to sharpen your PHP and Symfony skills? SymfonyCon Warsaw 2026 is hitting Poland on November 26-27! Join developers from around the world for two days of 3 parallel tracks and great community events. Secure your spot now and get ready! 🎤 Speaker…
14 Oct 2026 12:30pm GMT
New in Symfony 8.2: Attribute-Based Workflows
Contributed by Grégoire Pineau in #61935…
14 Oct 2026 7:16am GMT
Symfony 8.1.9 released
Symfony 8.1.9 has just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project. Tip…
14 Oct 2026 6:49am GMT