On May 20, 2026, from 5 to 9 p.m. UTC, Drupal plans to deploy a “core security release” for all supported branches, according to a warning.
According to the maintainers of the PHP-based content management system (CMS), exploits could be created in a matter of hours or days, so the Drupal Security Team advises you to schedule time for core updates during that period.
All setups are not impacted. Make time on May 20 during the release window to find out if your websites are impacted and require an urgent update. The advise will include details about mitigation.
It is recommended that the site’s Drupal version be updated to the most recent supported patch prior to the deadline in order to resolve any unresolved upgrade concerns.
Patches are expected to be available for the following supported branches of Drupal core –
- 11.3.x
- 11.2.x
- 10.6.x
- 10.5.x
In order to get ready for the security window, websites running one of these supported versions should update to the most recent patch release read more about Drupal to Release Urgent Core Security Updates on May 20 Sites Told to Prepare.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.