Craft's September patch closed one way to smuggle raw SQL into Element::findOne(). A newly disclosed advisory shows a second, unauthenticated-reachable path into the exact same sink survived that fix for another month, through endpoints as mundane as deleting a saved address.
Two GitHub advisories published November 2 describe two ways to defeat Craft's guard against attacker-chosen classes — one via isset()'s blind spot on null, one via an incomplete DOMDocument blocklist that forgot ZipArchive and XMLWriter. Both were quietly fixed in 5.11.4, weeks before anyone outside Craft knew they existed.
Alpha.19 replaces Craft's upload stack with Uppy, shared upload sessions, and tus/S3 multipart transports — uploads that can bypass the PHP process entirely and survive you navigating away mid-upload. It's also a real breaking change for anyone hooking the old multipart endpoints.
Alpha.18 ripped out Craft's own system-status mechanism and replaced it with Laravel's native maintenance mode outright, not alongside it. For plugin authors it's a real breaking change with a deprecation shim attached — and a concrete receipt for a claim that was easy to be skeptical of.
A customer's fat-payload queue jobs took seconds to reserve, not milliseconds — and it had nothing to do with row count. Here's what the GitHub issue actually showed, the index that fixed it, and why MySQL has to read a column you never sort on.
A captured passkey login request could be replayed indefinitely against Craft, because the server never saved the updated signature counter after a successful login. It's a good excuse to actually explain what a WebAuthn signature counter is for, hung on a real, named bug.
One unsanitized attribute parameter, combined with PDO's emulated prepares, let an unauthenticated request run stacked SQL statements against Craft's database — and the demonstrated impact was flipping user ID 1 to admin. It's a clean case study in why Drupal's entity-query discipline over raw SQL exists.
Two moderate-severity advisories, patched together in Craft 5.11.2, show how a schema's Sites scope could be read around entirely: once through an element field missing its site argument, once by chaining prev/next across entries. Neither needed a login, a token, or any non-default configuration.
Craft 6 alpha.19 adds publishing workflows, atomic 'releases', and timeline comments — the editorial governance Craft 5 lacked. A Drupal dev compares the draft-centric design to core Workflows and Content Moderation, notes it's Pro/Enterprise-only, and flags that the feature has no docs yet.
Craft 6 removes its own filesystem concept: volumes and transforms now point at Laravel disks in config/filesystems.php, and storage config leaves the control panel for code. A Drupal dev on what that shift costs — plus the payoff, BlurHash and dominant-color handed to GraphQL for free.
