October 2026 brought Critical security fixes for Drupal core and a contributed module, plus upgrade deadlines that affect every site owner. Teams should patch affected sites now and move remaining Drupal 10 sites to Drupal 11.4 before support ends in December. Drupal is an open-source content management system used to build and manage websites. This month matters because the flaws allow remote-code execution, and the version calendar leaves little time to delay upgrades.
Table of Contents
- Which security flaws need patching now?
- Which releases fix the problems?
- What changed for content editors?
- Should you move to Drupal 12 now?
- What should you watch before December?
Which security flaws need patching now?
The Drupal security team disclosed a Critical remote-code-execution flaw in core's Field UI module. The issue is tracked as CVE-2026-108097 with a risk score of 19 out of 25, according to the Field UI advisory. Field UI is the administrative tool for managing content fields and displays.
Core alone is not exploitable, but several paths through contributed modules create serious risk, including one path without login. The same day brought a separate Critical remote-code-execution flaw in the contributed Entity List module. It affects versions below 3.0.10 and concerns sites that build entity lists without Views.
Which releases fix the problems?
Fixed core releases are 10.6.19, 11.3.19, 11.4.10 and 12.0.0-beta2, plus Entity List 3.0.10. Site owners running Entity List should update that module at the same time as core.
The 11.4.10 notes urge sites to update immediately after reading advisories SA-CORE-2026-014 through 016, according to the 11.4.10 release notes. Read those advisories first, then patch production sites without waiting for a maintenance window.
- Confirm your core branch and Entity List version
- Update a copy or staging site first when possible
- Apply core and Entity List updates together
- Clear caches and check custom entity lists and field displays
What changed for content editors?
Drupal 11.4.9 arrived on 9 Oct 2026 as a production-ready patch. It fixed admin-sidebar predictability and CKEditor configuration, and updated the CKEditor 5 library. CKEditor is the rich-text editor used for writing and formatting page content.
The fixes help teams editing multilingual pages and structured content with fewer interface surprises. Content managers do not need a separate security response for this release. They should still ask developers whether editor customizations depend on the older CKEditor behavior.
Should you move to Drupal 12 now?
Drupal 12.0.0-beta1 was published on 30 Sept 2026 for testing compatibility and upgrade paths only. It is not for production use. The beta will refuse upgrades from Drupal 11.2 or earlier.
Teams must first reach Drupal 11.3, preferably 11.4 or 11.5, before testing the Drupal 12 path. Use the beta to check custom modules, themes, and migration steps in a separate environment. Keep production work focused on supported Drupal 10 or 11 releases.
What should you watch before December?
Drupal 10 reaches end of life on 9 Dec 2026. Drupal 11.3 loses security coverage in Dec 2026, while 11.4 remains covered until June 2027. Remaining Drupal 10 sites should move to Drupal 11.4 now.
That move resolves the December deadline and provides a supported base for later Drupal 12 planning. Drupal CMS 2.2.4, released 12 Oct 2026, removes several default package dependencies and fixes Composer compatibility for site templates, according to the CMS 2.2.4 report. The same report notes that CMS Helper 2.2.2 adds opt-in anonymous Amplitude tracking and that the CMS release limits telemetry naming.
