20 May 2026
Drupal.org aggregator
Security advisories: Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks.
A vulnerability in this API allows an attacker to send specially crafted requests, resulting in arbitrary SQL injection for sites using PostgreSQL databases. This can lead to information disclosure, and in some cases privilege escalation, remote code execution, or other attacks.
This vulnerability can be exploited by anonymous users.
This vulnerability only affects sites using PostgreSQL. However, the dependency updates in this release apply to all sites.
Upstream security advisories
The Drupal releases for supported branches (11.3, 11.2, 10.6, and 10.5) in this advisory also include security updates for Symfony and Twig. Those projects have released important Security Advisories that were coordinated with this Drupal release, and Drupal is affected by some of the vulnerabilities.
Depending on your site configuration and contrib modules, you may be vulnerable to one or more of these upstream issues, so updating these dependencies is highly recommended whether the SQL Injection vulnerability affects you or not. It is also recommended to review which user roles have the ability to update Twig templates, for example via Views or contributed modules.
Install the latest version.
The following releases will be available as soon as automated release packaging is complete. You may receive a 404 in the interim. The updates may also be available on Packagist sooner.
Drupal 11
- If you use Drupal 11.3.x, update to Drupal 11.3.10.
- If you use Drupal 11.2.x, update to Drupal 11.2.12.
- If you use Drupal 11.1.x or 11.0.x, update to Drupal 11.1.10.
Drupal 10
- If you use Drupal 10.6.x, update to Drupal 10.6.9.
- If you use Drupal 10.5.x, update to Drupal 10.5.10.
- If you use Drupal 10.4.x or earlier, update to Drupal 10.4.10.
Drupal 9 and 8
- If you use any version of Drupal 9, try manually applying the Drupal 9.5 patch for this issue.
- If you use Drupal 8.9, try manually applying the Drupal 8.9 patch for this issue.
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.) Due to this issue's severity, the unsupported releases and patches for unsupported versions are provided as a best effort. Those unsupported versions will still have other, previously disclosed security vulnerabilities.
- Björn Brala (bbrala)
- Benji Fisher (benjifisher) of the Drupal Security Team
- catch (catch) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Anna Kalata (akalata) of the Drupal Security Team
- Benji Fisher (benjifisher) of the Drupal Security Team
- catch (catch) of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Heine Deelstra (heine) of the Drupal Security Team
- Tim Hestenes Lehnen (hestenet)
- Dave Long (longwave) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Cathy Theys (yesct) of the Drupal Security Team
20 May 2026 6:08pm GMT
Jacob Rockowitz: Drupal (AI) Playground: AIs are eating our websites, and we need to adapt.
Recently, I contributed an AI-powered Schema.org JSON-LD module to Drupal that uses AI automators to generate Schema.org JSON-LD, building a knowledge graph that improves SEO/AEO by making it easier for machines to understand your website. The module was built with AI in 4 days, whereas the Schema.org Blueprints module with a similar goal took 4 years. I have been so shocked by how efficiently AI can code and build software that I realized, "AI ate my work, and I need to be okay with that." I wrote about how I am adjusting to this new "AI" normal.
A slightly different reckoning is unfolding for our websites because AI is consuming our content, thereby reducing traffic. Providing Schema.org JSON-LD is one way to feed the machines. AIs are becoming the front page of most websites. To adapt to this new "AI" normal, where an AI is the gatekeeper to your website, we need to evolve our approach to building and managing our websites.
Adaptation
Personally, "adaptation" feels like the right word to describe the challenge and change we, developers, site builders, managers, and owners, are facing right now. Adaptation is forced upon us by external constraints or opportunities, depending on your point of view, to evolve our approach to building and sharing information. There is a much larger discussion about the impact of AI on who we are, what we are building, and how we build. For now, I want to focus on what Drupal-built websites need to consider to adapt and keep up with the rapidly evolving digital landscape, which is largely out of our control.
Out of our control
How AIs are consuming our websites is out of our control. If you look back at how websites continually bent and tweaked to get a bump in page ranking, implementing now-defunct things like AMP (Accelerated Mobile Pages) because Google told us to,...Read More
20 May 2026 2:47pm GMT
The Drop Times: Drupal Releases SA-CORE-2026-004 Fixing Critical Database Injection Vulnerability
The Drupal Security Team has released SA-CORE-2026-004, confirming that the highly critical issue previewed in yesterday's advance advisory is an anonymous SQL injection vulnerability affecting Drupal sites running PostgreSQL databases. The flaw, tracked as CVE-2026-9082, exists in Drupal core's database abstraction API and can lead to information disclosure, privilege escalation, and potentially remote code execution. The coordinated release also includes upstream Symfony and Twig security fixes, prompting update recommendations for all supported Drupal installations regardless of database configuration.
20 May 2026 7:10am GMT
30 Apr 2026
W3C - Blog
Age-restrictions on the web and user privacy and safety
In this blog post, W3C CEO Seth Dobbs shares his thoughts about age-restrictions and user privacy on the web - a topic that was at the heart of the October W3C/IAB workshop on Age-Based Restrictions on Content, and recent W3C Members conversations.
30 Apr 2026 8:04pm GMT
14 Apr 2026
W3C - Blog
2026 Breakouts Day recap
Breakouts Day 2026 was the third edition of W3C's fully remote community driven information sharing event. In this post we summarize key aspects of the event.
14 Apr 2026 11:03am GMT
03 Apr 2026
W3C - Blog
The W3C TAG Meeting in London, March 2026
Earlier this month, the W3C Technical Architecture Group (TAG) gathered in London for a multi-day face-to-face meeting. While the TAG meets regularly online, these in-person sessions remain an important part of how the group builds shared understanding, tackles complex architectural questions, and welcomes new members into the work.
03 Apr 2026 12:00am GMT
18 Jan 2026
Official jQuery Blog
jQuery 4.0.0
On January 14, 2006, John Resig introduced a JavaScript library called jQuery at BarCamp in New York City. Now, 20 years later, the jQuery team is happy to announce the final release of jQuery 4.0.0. After a long development cycle and several pre-releases, jQuery 4.0.0 brings many improvements and modernizations. It is the first major … Continue reading
18 Jan 2026 12:29am GMT
11 Aug 2025
Official jQuery Blog
jQuery 4.0.0 Release Candidate 1
It's here! Almost. jQuery 4.0.0-rc.1 is now available. It's our way of saying, "we think this is ready; now poke it with many sticks". If nothing is found that requires a second release candidate, jQuery 4.0.0 final will follow. Please try out this release and let us know if you encounter any issues. A 4.0 … Continue reading
11 Aug 2025 5:35pm GMT
17 Jul 2024
Official jQuery Blog
Second Beta of jQuery 4.0.0
Last February, we released the first beta of jQuery 4.0.0. We're now ready to release a second, and we expect a release candidate to come soon™. This release comes with a major rewrite to jQuery's testing infrastructure, which removed all deprecated or under-supported dependencies. But the main change that warranted a second beta was a … Continue reading
17 Jul 2024 2:03pm GMT
29 May 2023
Smiley Cat: Christian Watson's Web Design Blog
7 Types of Article Headlines: Craft the Perfect Title Every Time
When it comes to crafting an article, the headline is crucial for grabbing the reader's attention and enticing them to read further. In this post, I'll explore the 7 types of article headlines and provide examples for each using the subjects of product management, user experience design, and search engine optimization. 1. The Know-it-All The […]
The post 7 Types of Article Headlines: Craft the Perfect Title Every Time first appeared on Smiley Cat.
29 May 2023 10:20pm GMT
09 Apr 2023
Smiley Cat: Christian Watson's Web Design Blog
5 Product Management Myths You Need to Stop Believing
Product management is one of the most exciting and rewarding careers in the tech world. But it's also one of the most misunderstood and misrepresented. There are many myths and misconceptions that cloud the reality of what product managers do, how they do it, and what skills they need to succeed. In this blog post, […]
The post 5 Product Management Myths You Need to Stop Believing first appeared on Smiley Cat.
09 Apr 2023 5:28pm GMT
11 Dec 2022
Smiley Cat: Christian Watson's Web Design Blog
The Key Strengths of the Best Product Managers
The role of a product manager is crucial to the success of any product. They are responsible for managing the entire product life cycle, from conceptualization to launch and beyond. A product manager must possess a unique blend of skills and qualities to be effective in their role. Strong strategic thinking A product manager must […]
The post The Key Strengths of the Best Product Managers first appeared on Smiley Cat.
11 Dec 2022 4:43pm GMT
01 Apr 2004
Planet PHP
ezSystems are classy folks

Last week I helped the folks at ezSystems debug some APC problems they were having. The problems ended up being a 64bit architecture problem (they have uber-fast Opterons) and the bug is now fixed in 2.0.3.
Today I received Python & XML from them (off my Amazon wishlist). Thanks guys!
On a side note, my wishlist seems borked. The list I get when I search on my email address or name is not the same one I can edit when I log into the site.
01 Apr 2004 6:53pm GMT
PHP april fools...
1st of April 2004 get's to it's end and I guess it's time, to summarize the recent April fools a bit. Not that I think anyone in the world believes in them, but some were quite funny:
1. Changes to case sensitivity in PHP.
Alan Knowles announced that PHP will change to the studlyCase API and therefor will get everything broken by changing established functions.
2. IBM takes over Zend.
Myself hacked a little article about IBM taking over Zend to make PHP a compete of Java.
3. The first PHP virus has been seen.
Wasn't there one last year, too?
4. PHP has been overtaken by Micro$oft.
Mhhh... a little bit unreliable, if they had been taken over by IBM this morning... Maybe one should first look, what others wrote...
5. And finally, PHP4 and 5 showed their real faces...
Take a look at a phpinfo() output!
I guess I missed some, so feel free to comment on this entry, if you found another!
01 Apr 2004 5:49pm GMT
PHP Virus Attacking Web Hosts
Symantec have a report of the virus here. I've yet to see any of the PHP news sites picking up on it but, using a virtual host account, managed to deliberately expose some PHP scripts to it. From examining the infected scripts, what's disturbing is once infected, every tim...
01 Apr 2004 12:19pm GMT