Drupal Aid, Pittsburgh, PA (2026)

10/30/2026

Using Drupal Canvas on a site that already has Paragraphs? Check this before you publish a template.

A Canvas content template replaces the whole page display. If the template doesn't include your Paragraphs field, visitors stop seeing those items. Your editors keep filling them in and never find out why they don't show.

The fix takes one View and no add-on module.

👉 Build a block View with the Paragraphs field, set to Rendered entity.
👉 Add a contextual filter on the content ID, taken from the URL.
👉 Place that View in the Canvas template from the Library.
👉 Log out and check the page.

I also wrote up how to decide what goes where. Paragraphs hold the items that belong to one page. Shared things like staff and sponsors get their own content type. Canvas does the layout.

The full walkthrough has a screenshot of every screen.
https://www.drupalaid.com/blog/drupal-canvas-and-paragraphs

Questions about your own site? Ask in the comments.

10/29/2026

If you run a Drupal 10 site, put December 9, 2026 on your calendar.

That's the day Drupal 10 reaches end of life. After it, there are no new Drupal 10 releases, security fixes included.

Here's a 30-minute check that tells you how big your Drupal 11 upgrade will be:

1. Open your Status report at /admin/reports/status and note your Drupal, PHP and database versions.
2. Make sure your host can run PHP 8.3 or later. Test your custom code on a copy before you switch.
3. Install the free Upgrade Status module on a copy of the site and run a scan.
4. Read the results group by group. "Fix manually" is where developer time goes.
5. Check whether you use any of the six modules Drupal 11 removed from core: Actions UI, Activity Tracker, Book, Forum, Statistics and Tour.

One warning: don't aim for Drupal 11.3. It loses support the same week as Drupal 10. Aim for 11.4 or later.

On our test site, Drupal's own updates page called one module "Up to date." It has no Drupal 11 release at all.

The full guide, with every command and screenshot:
https://www.drupalaid.com/blog/drupal-11-readiness-check

10/28/2026

Drupal's security team put out 39 advisories for 21 contributed modules today. Here is what each one means, starting with the most serious.

Commerce Core is rated highly critical. A flaw lets people see order and customer information they should not have access to. The fix is in 3.3.13, or 2.41.0 if you are still on the 2.x line.

Single Content Sync has a remote code ex*****on flaw, which means an attacker could run their own code on your server. Update to 1.4.19.

OAuth Login (OAuth OIDC SSO) can be tricked into logging someone in without valid credentials. Version 3.1.1 closes that.

OAuth2 Token Manager has a critical access bypass. Update to 1.2 and run database updates afterward.

Four critical cross-site scripting issues let an attacker plant script that runs in your visitors' browsers: Stage File Proxy (4.0.1), Signature pad widget (1.15.0), AI (1.5.2 or 2.0.0) and Commerce Stripe (2.2.3). Stage File Proxy is normally a development tool, but if it is installed on a live site it still needs the update.

Moderately critical, one line each:
• CAPTCHA: a solved CAPTCHA can be replayed to get past it. Update to 2.0.11 or 1.18.0.
• S3 File System: access bypass, 3.12.0
• Commerce License: access bypass, 3.1.1
• Commerce Shipping: access bypass, 3.0.6 or 2.16.0
• Bulk Update User Roles: incorrect authorization, 1.0.5
• Fasttoggle: cross-site request forgery, 4.1.1
• OpenID Connect Client: improper authentication, 2.3.1
• Field Permissions: two access bypass fixes, 1.6
• Content Sync (content-sync.io): information disclosure, 3.2.2
• Media Alias Display: information disclosure, 3.0.3 or 2.1.3

Three modules are now unsupported and will get no fix: CacheFlush, GroupEx PRO (Daxko) integration and PayUmoney for Drupal Commerce. If you use one, plan to remove or replace it.

If none of these modules are on your site, there is nothing to do this week.

10/21/2026

The Drupal security team published 31 advisories for contributed modules and themes today. That is a big batch, so here is what matters most.

The most serious is Ffmpeg Image Toolkit, rated highly critical. A flaw in it lets an attacker run their own code on the web server. Version 1.0.3 fixes it.

Custom Formatters has a similar remote code ex*****on problem, rated critical. Update to 4.2.1.

Monster Menus (Drupal 9) has a PHP object injection flaw that can be used to take over a site. The fix is 9.5.6.

Four modules can be tricked into putting attacker-written script into pages your visitors load: UI Icons (2.0.2 or 1.1.3), ABC, Black Hole and Zero Point (each fixed in their 1.x release or 2.0.1). Dopup leaks information it should keep private; update to 1.0.7.

Moderately critical, one line each:
• AI File to Text: access bypass, update to 1.0.1
• Block Attributes: cross-site scripting, 2.1.0
• Bootstrap theme: cross-site scripting, 3.45.0
• CSV Field: cross-site scripting, 3.0.7 or 2.0.10
• Data field: cross-site scripting, 2.0.14
• DocCheck Basic: access bypass, 2.2.1
• Domain: access bypass on the 3.0.x branch only, 3.0.2 (the 2.0.x branch is not affected)
• Domain Login Restrict: access bypass, 1.5.0
• Frontend Editing: access bypass and CSRF, 1.9.3
• Fullcalendar View: access bypass, 5.2.6
• ImageAPI Optimize WebP: information disclosure, 2.1.2
• Media Alias Display: information disclosure, 3.0.2 or 2.1.2
• Media Bulk Upload: access bypass, 3.0.6
• Rabbit Hole: access bypass, 1.3.0
• Sector Distribution: cross-site scripting, 10.4.2 (Drupal 10)
• Shield: access bypass, 1.9.0
• Simple OAuth (OAuth2) & OpenID Connect: access bypass, 6.1.3
• Simple User Management: access bypass, 1.11.0
• Swiper formatter: information disclosure and cross-site scripting, 3.1.0 or 2.1.2
• TinyPNG: information disclosure, 2.0.2
• USWDS Paragraph Components: cross-site scripting, 3.1.3
• View Unpublished: access bypass, 1.5.0
• Ágora Transparency Theme: information disclosure, 1.2.3

If your site doesn't use a module on this list, there's nothing for you to do.

10/14/2026

Three Drupal security advisories came out today, and one of them is rated critical.

Entity List (critical, remote code ex*****on)
Entity List lets you build lists of entities without Views. The flaw can let someone run their own code on the server. The module alone isn't enough to trigger it, but several other contributed modules open a path to it, and at least one of those paths needs no login at all. Custom code can expose it too. If you run Entity List on Drupal 10 or 11, update to 3.0.10.

Drupal core (SA-CORE-2026-014, 015 and 016)
This core release bundles three advisories. SA-CORE-2026-014 is rated critical and covers remote code ex*****on. The other two are cross-site scripting issues, including one in the Navigation module where certain attributes aren't cleaned up properly, so a user with the right permissions could plant script that runs in other people's browsers. That one needs a role that can enter HTML with specific data attributes, or the administer menu permission. Update to 11.4.10, 11.3.19 or 10.6.19 depending on your branch.

Gin Admin Theme (moderately critical, cross-site scripting)
Same kind of problem in the popular admin theme, with the same permission requirement. Update to 4.1.4 on the 4.x branch or 5.0.16 on 5.x.

If Entity List or Gin isn't installed on your site, those two don't affect you. Core applies to every Drupal 10 and 11 site.

10/07/2026

Running a Drupal site? Today is a good day to look at your module list.

The Drupal security team released 25 advisories for contributed modules. Seven are rated critical.

Start with these. Block AJAX has a PHP object injection flaw, fixed in 3.0.2, and it is the one most likely to be abused. Restrict route by IP can be bypassed, which defeats the point of installing it, so move to 2.0.1 or 1.3.1. Actstream (2.1.1) and Entity Reference Manager (1.0.3) both let people reach things their role should block. MathJax: LaTeX for Drupal lets someone inject script that runs in visitors' browsers, fixed in 4.1.2.

Orphans Media and ECA Helper got a different kind of notice. The security team no longer covers them, and there is no patched version. Sites using them should look for a replacement.

Sixteen more are moderately critical. Most of them are access bypass, information disclosure or cross-site scripting:
Advanced Filesystem 1.0.28
Authenticator Login Plus (2FA) 1.0.1
Country 2.2.1
DKAN 4.1.5
Easy Breadcrumb 2.0.11
Freelinking 4.0.3
Gutenberg 3.0.7 or 2.15.0
Inline Entity Form Dialog 1.0.6
Inline Formatter Field 4.2.0
Leaflet 10.4.13
Linked Field 1.8.0
Menu Link Attributes 1.8.0
Permissions by Term 3.1.41
SmartLinker AI 1.0.3
Two Factor Authentication 5.5.2
Views Share 2.0.1
Xray Audit 3.1.1, 2.0.4 or 1.6.3

Examples for Developers also got a less critical fix in 4.0.7.

If your site doesn't use any of these, you can skip this one.

09/23/2026

Big day on the Drupal security page. Sixteen contributed modules got security releases today, for Drupal 10 and 11. Four have critical problems, so start there.

Webform 6.3.1 is the one most sites will actually have. This single release closes 20 advisories. The worst is a critical remote code ex*****on bug: when a webform uses a custom multiple-value item format that includes submission-value tokens, someone can submit text that gets evaluated as template code when the submission is displayed. Depending on the site, that can leak information, plant a script in the page, or run code on the server. The rest of the batch is access bypass, cross-site scripting, a server-side request forgery and a denial of service.

Cloud 7.0.1 (two critical advisories). In the Kubernetes submodule, Git branch names and repository URLs are passed to shell commands without proper cleaning, so a user who can add or edit cloud server templates could run commands on your server. You're only exposed if that submodule is enabled and Git is on the box.

Project Browser 2.1.5. The screens that apply recipes and enable modules don't guard against cross-site request forgery. An attacker could get a logged-in admin to click a link that installs something without meaning to.

Tawk.to 3.0.4. Same class of bug in the live chat integration: a logged-in user can be tricked into actions they never intended.

The moderately critical group:
AI CKEditor 1.4.3: Twig template injection in some AI rules can pull out confidential system data.
Combined image style 1.0.7: anonymous visitors can generate image derivatives without a valid token, which can be used to overload the server. Having the module installed is enough, even with no combined styles set up. Public files only.
Commerce Decoupled Checkout 1.8.0: the order creation endpoint lets unsafe properties be set on an order.
CookieCuttr 2.0.3: stored cross-site scripting through the admin form. Needs the "administer cookiecuttr" permission.
CSS Usage Analyzer 1.0.2: the save endpoint accepts forged or repeated submissions.
Diba carousel slider 3.1.1: slide descriptions skip Drupal's text filtering when "Allow HTML description" is on, which opens the door to cross-site scripting.
Editoria11y Accessibility Checker 2.2.23 or 3.0.9: a permission labeled as "view" actually grants edit and delete on the module's data.
Mermaid Diagram Field 1.0.10: modal diagram content isn't access-checked properly.
REST & JSON API Authentication 3.2.0: some API requests skip the authentication check.
Smart Content 3.2.1: the Smart Content Block AJAX endpoint can show access-restricted blocks to the wrong users. Views blocks aren't affected.
Stop administrator login 1.6.0: a blocked admin account can still sign in through some less common login methods, provided the attacker has that account's password.

And one less critical: Webform REST 4.2.1 doesn't check permissions properly when returning webform elements and fields.

If none of these modules are on your site, there's nothing for you to do today.

09/16/2026

Quick one for anyone running Drupal 10 or 11: update core.

Today's advisory, SA-CORE-2026-013, covers a cross-site scripting bug in the CKEditor library that comes with Drupal. The versions you want are 11.4.7, 11.3.17 or 10.6.17, depending on which branch you're on.

Why bother? A user with permission to write content could slip in code that fires when an administrator edits that content. The attacker never touches the editor directly. On sites where several people contribute content, that's a realistic path to an admin account.

Sites that don't use CKEditor for WYSIWYG editing aren't affected by this one. Older, unsupported core branches won't get a fix, so this is also a good nudge to get onto a supported release.

09/09/2026

If you run any of these ten Drupal modules, today is an update day. Everything below affects Drupal 10 and 11.

Update now, in rough order of how much it matters:

amazee.ai Private AI Provider to 1.4.3. SQL injection through unsanitized filter values in the Postgres/pgvector backend. Critical.

CSP log to 1.0.2. SQL injection in the report endpoint, reachable by anyone holding the "Access CSP reports" permission. Critical.

Taxonomy Term Glossary to 4.6.0. Anonymous visitors could read any taxonomy term through the JSON endpoint, unpublished ones included. Critical.

Ultimate Table Field to 2.0.1, or 1.1.1 if you are on the 1.x branch. Anonymous visitors could open the cell editor dialog and upload pdf, doc or docx files to the server. Critical.

CAS Server to 2.1.3. Open redirect during login.

Feed Block to 3.0.2, or 2.0.2 on 2.x. Stored cross-site scripting in the generated feed.

Key auth to 2.2.4. Missing per-user caching could expose one user's API key to another with the same permissions.

SafeDelete to 1.0.88. Stored cross-site scripting through node titles on the orphaned content report.

SAML SSO Service Provider to 3.2.0. Unvalidated identity provider metadata URLs allow server side request forgery.

One of the ten has no fix. Patreon has been marked unsupported by the security team over an issue the maintainer never resolved. There is no version to update to, so the answer there is to plan a move away from the module, or volunteer to maintain it.

A quick way to check where you stand: log in as an administrator and open Reports, then Available updates. If none of these module names show up, this week does not affect you.

09/02/2026

Fourteen Drupal security advisories went out today. Four are rated critical, and those are the ones to deal with first.

Calculate Working Days (2.0.3) left its settings form open to people who should not be able to reach it.

Email Verification / SMS Verification / OTP Verification (2.4.0) has a reflected cross-site scripting hole that does not require an attacker to be logged in at all. That combination is why it earned a critical rating.

Jsonapi Role Access (2.0.2) is meant to lock JSON:API routes down by role. A request shaped like an XMLHttpRequest slipped past those checks.

Unpublished Node Permissions (1.8.0) was granting view access to published content in a way that overrode other access rules a site had set up.

The remaining ten are moderately critical.

Mailer Plus Log (1.2.7) is the one I would not sit on. It logged account emails with their one-time login links still readable, so anyone allowed to view the mail log could grab a login link for any account, user 1 included.

Media Library Importer (2.1.6) accepted any folder path the web user could read and republished the files it found into the public files directory. Private files could end up downloadable by anyone.

Monobank payment API (1.0.3) processed payment webhooks without checking the signature first.

Advanced Search (2.4.5) and Islandora (2.19.0) share the same AJAX endpoint flaw, where a guessed block ID could return restricted block content.

AI (1.4.8) and AI translate (1.4.1) skipped access checks on referenced entities during translation.

Component blocks (1.2.7) and PhotoSwipe (5.0.9) both pass user input through without enough sanitising, which opens the door to cross-site scripting.

Webform Submissions Delete (1.2.0) did not properly restrict access to its bulk delete form.

All of these apply to Drupal 10 and 11. If you do not run the module, there is nothing to do.

Drupal Aid

10/30/2026

10/29/2026

10/28/2026

10/21/2026

10/14/2026

10/07/2026

09/23/2026

09/16/2026

09/09/2026

09/02/2026

Address

Telephone

Website

Alerts

Shortcuts

Share

Other Pittsburgh gyms & sports facilities

Listing takedown request