Peter Brady, Drupal developer and private AI consultant

Drupal security updates, in plain English

Week of 14 October 2026

Drupal publishes security updates on Wednesdays. On 14 October 2026 there were 3: 1 for Drupal core itself, 1 for modules and 1 for a theme. Between them they carry 5 security fixes, because a module can fix several bugs in one update: Drupal core fixed 3.

One is for Drupal core. That applies to every Drupal site, so start there.

Each card says what the module does, what went wrong, who could do it, whether it applies to you, how urgent it is, and the one line to send to your developer. Worst rated first, and most used first within a rating.

New here? How Drupal security updates work explains who publishes these, why they matter and what the ratings mean. Earlier weeks and a search by module are on the main page.

Critical: 2 updates

Cyber Essentials expects a fix within 14 days. Do it this week.

Entity List

Critical · 90 sites report using it · SA-CONTRIB-2026-218 · on drupal.org

This module provides a way to create lists of content.

A visitor could run their own software commands on the website. They could read any private information stored on the server and change anything including the website code itself.

  • Who could do thisAnyone visiting the site. No login needed.
  • Does it apply to youA site is affected if it uses this module alongside certain other modules or custom code.
  • Has it been used in attacksNo sign of it.
  • How urgentDrupal rates this critical. Cyber Essentials expects a fix within 14 days. Do it this week.

Tell your developerUpdate Entity List to 3.0.10.

For developers: what the fix changed

The fix removes a vulnerable call to call_user_func_array using a region callback in src/Element/EntityListTable.php and instead derives the region name directly from the row data.

3.0.9 to 3.0.10 1 commit, 1 file.

  • src/Element/EntityListTable.php +4 −2 fix

Full diff, 3.0.9 to 3.0.10

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

Drupal core

Critical · Drupal core · every Drupal site · 3 security fixes

The core software provides the foundation that runs the website and this part allows administrators to manage data fields.

3 security fixes in one update. Drupal core fixed 3 separate security bugs at once: 2 cross site scripting, 1 remote code execution. One update covers all of them. The most serious, SA-CORE-2026-014, is explained here and the full list is at the end of the card.

An outside visitor could execute malicious commands on the server. They could read any private database records and alter any files including the core software itself.

  • Who could do thisAnyone visiting the site. No login needed.
  • Does it apply to youA site is affected if it uses the field management feature alongside certain other modules or custom code.
  • Has it been used in attacksNo sign of it.
  • How urgentDrupal rates this critical. Cyber Essentials expects a fix within 14 days. Do it this week.

Tell your developerUpdate Drupal core to 11.4.10, 10.6.19 or 11.3.19, whichever branch you are on.

For developers: what the fix changed

This release carries 3 security fixes. The summary below is for SA-CORE-2026-014, the most serious of them.

The fix removes a vulnerable call_user_func_array execution in FieldUiTable::tablePreRender and replaces it with a direct array value lookup to determine the region name.

Also in this release The release also includes fixes for two other security advisories addressing XSS vulnerabilities in the Link and Navigation modules, alongside version bumps.

11.4.9 to 11.4.10 4 commits, 8 files.

  • composer.lock +5 −5
  • composer/Metapackage/CoreRecommended/composer.json +1 −1
  • composer/Metapackage/PinnedDevDependencies/composer.json +1 −1
  • core/lib/Drupal.php +1 −1
  • core/modules/field_ui/src/Element/FieldUiTable.php +4 −1 fix
  • core/modules/link/src/AttributeXss.php +2 −0
  • core/modules/navigation/js/tooltip.js +15 −5
  • core/modules/navigation/navigation.libraries.yml +1 −0

Full diff, 11.4.9 to 11.4.10 · Full diff, 10.6.18 to 10.6.19 · Full diff, 11.3.18 to 11.3.19

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

All 3 security bugs this update fixes, worst first. Each link is the drupal.org notice for that one.

Moderately critical: 1 update

Include in your next routine update, within the month.

Gin Admin Theme

Moderately critical · Theme · 107,017 sites report using it · SA-CONTRIB-2026-219 · on drupal.org

This design changes the look of the management area used by site editors.

A logged in user could place hidden scripts into the management pages. They could uncover some private details and change certain text but they could not destroy the whole database.

  • Who could do thisOnly someone with a login on your site.
  • Does it apply to youA site is affected if a user has the access right to manage menus or enter specific web code.
  • Has it been used in attacksNo sign of it.
  • How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.

Tell your developerUpdate Gin Admin Theme to 4.1.4 or 5.0.16, whichever branch you are on.

For developers: what the fix changed

The fix modifies Drupal.theme.ginTooltipWrapper in js/tooltip.js and its compiled version in dist/js/tooltip.js to create a DOM element and set its text content instead of returning an HTML string, preventing cross site scripting.

Also in this release Updated an ID in the toolbar template to accommodate a refactor in the admin toolbar search module.

4.1.3 to 4.1.4 2 commits, 3 files.

  • dist/js/tooltip.js +7 −3 fix
  • js/tooltip.js +15 −5 fix
  • templates/navigation/toolbar--gin.html.twig +1 −0

Full diff, 4.1.3 to 4.1.4 · Full diff, 5.0.15 to 5.0.16

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

Not sure what your site is running?

Send me your Drupal site's address.

I'll tell you what I can see from outside, what the Drupal 10 end of life on 9 December means for it, and what it would cost to have me keep it patched. There's no charge for that and no obligation. peter@peterbrady.co.uk

Compiled 15 October 2026 from the advisories published by the Drupal security team on drupal.org. The facts on each card are theirs. The plain English is mine, with help from a language model, and read before publishing.

Get in touch

Tell me who you are, what your organisation does, and what you need. That might be a Drupal site that needs looking after, an upgrade to get done before December, or an agency that needs Drupal cover.

If I can help, I'll say so and suggest a call. If I can't, I'll tell you straight away rather than waste your time.

peter@peterbrady.co.uk

For context: I work mainly with UK charities, membership bodies and research organisations, and with the agencies that look after their websites. Not recruiters.

Or start smaller and connect with me on LinkedIn. That's where I post what I find digging around in charity and grants data, and where the free tools turn up first.

Peter Brady, Drupal developer and private AI consultant

PNB Technologies Limited
55 Yew Tree Road, Ormskirk
Lancashire, L39 1NT, United Kingdom

Company Reg: 07166600
VAT Reg: GB986726850

© 2026 Peter Brady. All rights reserved.

Connect on LinkedIn

Links

Reference