Drupal to Release Urgent Core Security Updates on May 20 Sites Told to Prepare
On May 20, 2026, from 5 to 9 p.m. UTC, Drupal plans to deploy a "core security release" for all supported branches, according to a warning.
According to the maintainers of the PHP-based content management system (CMS), exploits could be created in a matter of hours or days, so the Drupal Security Team advises you to schedule time for core updates during that period.
All setups are not impacted. Make time on May 20 during the release window to find out if your websites are impacted and require an urgent update. The advise will include details about mitigation.
It is recommended that the site's Drupal version be updated to the most recent supported patch prior to the deadline in order to resolve any unresolved upgrade concerns.
Patches are expected to be available for the follow...