A Critical advisory for the REST & JSON API Authentication module shows how an enabled gate with no API key configured can let unauthenticated requests through. Here is what SA-CONTRIB-2026-298 says and the one negative test I'd add to every deploy.
PSA-2026-11-02 shortens security coverage for each Drupal core minor release to 8 months starting in 2027. I walked through the exact end dates and what it means for how often I need to update.
SA-CONTRIB-2026-254 (CVE-2026-118539) is an access-bypass flaw in Drupal Commerce that the Security Team says is already being exploited in the wild. The same October 28 advisory batch included an unauthenticated-adjacent deserialization RCE in Single Content Sync — here's what each one actually does and who needs to patch today.
While everyone covered Drupal 12's removal list, the release that actually halved query counts vs 11.3 shipped five months earlier with far less attention. Here's what 11.4 actually changed under the hood — Brotli, the new dr CLI, argon2id, and the benchmark numbers Drupal.org published.
Drupal 11.3.0 bakes HTMX into core and rebuilds BigPipe on top of it, with claims of up to 71% less JavaScript and 26-33% more requests served at the same database load. I went through the release notes to see what that means for anyone who still writes #ajax callbacks, and whether Navigation is actually worth switching to yet.
PHP 8.6 adds partial function application — load('node', ?) returns a closure. I ran it on the RC and hit three sharp edges: arguments evaluate at creation not call, extra args are silently ignored, and the ... placeholder leaks keys into optional parameters. Plus why Drupal contrib can't use it for years.
Drupal 12 is mostly 11.5 with the deprecations deleted — and the deletions include nine modules a lot of sites run (Search, Contact, Toolbar, Shortcut...). The upgrade is a Composer-require checklist, Contact is the one to check carefully, and the Dec 9 Drupal 10 EOL makes it a deadline for some.
PHP 8.6 RC3's long deprecation list is just log noise. The sneaky changes are the filesystem functions that used to return false on a NUL byte and now throw a ValueError — a 500 you won't catch in a unit test. Plus where Drupal's 8.6 support actually stands.
SA-CORE-2026-014 (Oct 14) is a critical RCE in core's Field UI module that, per the advisory, isn't exploitable by core alone — contrib or custom code completes the path, and at least one needs no auth. Why 'am I patched?' beats 'is core vulnerable?', and the one-command mitigation.
Drupal is at ~219 contrib advisories in 2026 against ~126 for all of 2025. Both the Drupal Association and Anthropic's new OSS Scanner say the same thing from opposite ends: AI made finding bugs nearly free, and verifying and fixing them is still a human's afternoon. What that means for your security inbox.
