Drupal to Release Urgent Core Security Updates on May 20, Sites Told to Prepare
Drupal to Release Urgent Core Security Updates on May 20, Sites Told to Prepare — Ravie LakshmananMay 19, 2026Vulnerability / Website Security [https://blog
What’s new: Drupal will release urgent core security updates on May 20, 2026, from 5-9 p.m. UTC. The updates will address a severe security issue, with patches available for supported branches: 11.3.x, 11.2.x, 10.6.x, and 10.5.x. Sites on end-of-life versions (Drupal 8 and 9) will need to apply manual patches, but these may not be reliable.
Who’s affected
All sites running supported versions of Drupal core (11.3.x, 11.2.x, 10.6.x, 10.5.x) should prepare for updates. Sites on Drupal 11.1 or 11.0 should update to at least 11.1.9, and those on Drupal 10.4 or earlier should update to at least 10.4.9. Drupal 7 is not affected.
What to do
- Reserve time on May 20 during the release window to apply updates.
- Update to the latest supported patch for your site’s version of Drupal before the deadline.
- For sites on end-of-life versions, apply manual patches for Drupal 8.9 and 9.5, but be aware of potential issues.
- Plan to upgrade to supported versions (Drupal 10.6 or 11.3) soon after applying the security update.
