Is there a call for passwordless login via an emailed access code?

I've recently implemented the passwordless module (https://www.drupal.org/project/passwordless) on a site which utilises the core reset password functionality to log users straight in via unique login link.

The negatives are a user wanting to access a page via an external link that they need to log in to view, the page they want to access is lost in the process of receiving the email and clicking to log in. With an extra page with an access code form the user can then navigate to the page they want. Or is this niche? Or have I not found and implemented the correct flow/configuration?

Any feedback or advice is appreciated 😄

I just run this command I didn't see any drupal/core-xxxx packages in the listing.

The disk was running out of space and saw the message in the admin that I didn't have enough space, ie 1024k to upgrade Drupal core and wonder if that was why the above command didn't upgrade Drupal core as well.

I upgraded it using composer require drupal/core-recommended:11.1.10 drupal/core-composer-scaffold:11.1.10 drupal/core-project-message:11.1.10 --update-with-all-dependencies

It was as far as I could go probably it was a Drupal CMS 1.0 installation.

CISA added CVE-2026-9082 to the KEV catalog yesterday (May 22). For those catching up: this is an unauthenticated SQL injection in Drupal Core's database abstraction API that affects PostgreSQL-backed installs. There's working PoC code from Searchlight Cyber already in the wild, and SecurityWeek confirmed attacks on thousands of sites.

The technical detail that I think is being undersold in the mainstream coverage:

The flaw is in the code that's *supposed to prevent* SQL injection. The Drupal database abstraction API is used precisely to sanitize queries before they hit PostgreSQL. A user-supplied PHP array key reached the SQL placeholder construction stage without being stripped. The patch is an `array_values()` call that resets array keys to sequential numerics before they can do damage. It's clean and correct — but it took a disclosure for anyone to notice the gap.

The thing I'm curious about from people running Drupal in enterprise environments: **are you treating Drupal's pre-announcement PSA (published May 18, three days before the actual advisory) as enough lead time to get patches through your change management process? Or is the 24-72 hour window still too tight for your approval workflows?**

I ask because that gap — between when you can prepare and when the PoC drops — is increasingly the only window defenders actually have.

---

I previously covered a similar platform-layer trust failure in the CVE-2026-41940 cPanel Authentication Bypass if you want background on how attackers operationalize these types of vulnerabilities: https://www.techgines.com/post/cve-2026-41940-cpanel-authentication-bypass-zero-day

Full technical breakdown with patch table and exploit mechanics: https://www.techgines.com/post/cve-2026-9082-drupal-sql-injection-postgresql-rce

Not looking to just drop a link — genuinely interested in how people are managing the patch urgency vs. change control tension here.

I’m not sure how this slipped under the radar but check this out.

The Drupal Association has been given a grant, and we know from the credits on symfony vulnerabilities that Mythos has scanned them.

This is huge and reassures us that once again, Drupal is, and will remain, the most secure open-source CMS out there.

https://thephp.foundation/blog/2026/05/18/announcing-ecosystem-security-team/

Edit - reworded para 2 based on rereading the context.

I picked up a new client today. A charity based in the UK.

The “webmaster” (her words) was a 79 year old lady who started Drupal when she was 70.

It was a delight to talk to her and hear her talk about composer, git, and the things we take for granted.

It’s honestly one of the most wholesome things I’ve encountered in my 20+ years of running a Drupal agency.

She wanted a D10 to D11 upgrade and explained about the composer hell she went through. I agreed to help her and estimated a couple of hours to assist. It’s a super simple site, and that’s honestly how long it will take.

Anyway, I wanted to share the story and I hope I’m still doing Drupal at the age of 79 with as much passion as my new client has for her project.

Is there an alternative to the "Webform" module for Drupal 11 that already has a stable release and is covered by the security advisory policy? These are both requirements that i can't deviate from.

Tiny patch, huge impact:

if (is_array($condition['value'])) {
$condition['value'] = array_values($condition['value']);
}

Drupal fixed PostgreSQL placeholder generation by reindexing array keys before query translation.

Without it, attacker-controlled keys could influence SQL placeholder construction.

Affects PostgreSQL-backed Drupal sites.
Anonymous exploitation possible.

Advisory:
[https://www.drupal.org/sa-core-2026-004\](https://www.drupal.org/sa-core-2026-004)

[https://cveplayground.com/blog/cve-2026-9082-drupal-core-sql-injection?utm\\\_source=reddit\](https://cveplayground.com/blog/cve-2026-9082-drupal-core-sql-injection?utm\_source=reddit)

Context: https://www.reddit.com/r/drupal/comments/1t884c3/hello_drupal_community_looking_for_help_with/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

Firstly thank you for such detailed suggestions and I am learning Drupal at a good pace, enjoying most of the time and process. I am learning mostly frontend right now and absorbing everything, learning some backend too but not heavily, would go on it later

I would really appreciate some help from your side as you all have been in the Drupal market since so long, I have a drupal interview in coming week, the person said its frontend heavy role, you will be working mostly on the frontend with HTML CSS JS.

While I understand how Drupal architecture works and how to make things and how does this css works here,
I am confused what can I be asked in the interviews, mainly what is asked in Drupal? would they ask me from html css? I come from a full stack web dev background so really no idea how it works in low code interviews, its a part time role. Just 1 round of interview to show my understanding and skills

Any help is good, I will really appreciate, thank you so much !!!

So, like Icarus, I flew too close to the sun, and fucked up. I was trying to upgrade a small site from Drupal 9.3 because something under the hood was stopping image files from uploading. Unfortunately, I didn't read the instructions on upgrading correctly. While going from 9.3 to 9.5 went fine, at the next step, it went all the way to 11.3, which has rendered the site unreachable, except for the update.php page.

The problems I'm facing are:

1. It wants the CKEditor module installed, but that's only compatible with Drupal 10
2. I've used Composer to add the MySQL57 module, and added the needed line to my settings.php, but I can't get in to the administrative interface to install the module there.
3. Something somewhere is reporting that the installed Drupal version is below 9.4
4. Attempts to access other site pages produce "Uncaught PHP Exception TypeError: "Drupal\Core\Utility\ThemeRegistry::getPreprocessInvokes(): Return value must be of type array, null returned"" at /core/lib/Drupal/Core/Utility/ThemeRegistry.php line 180

So, my question is:

• Is it possible to rollback to, say, Drupal 10, at this point, or should I just rebuild the site from scratch? (I have access to an ancient backup of the site.)

I should add that there's something weird going on with the installation of Drush I'm working with as it seems to only be interacting with one of the multiple sites we have with this hosting provider, and it's not the problem site.

I've been using Drush on Drupal 7 for a long time, but having started on Drupal 11 I've gotten more used to the Composer approach and see on Drupal.org that many Drupal 7 modules can be installed through composer.

Are there any gotchas installing Drupal 7 and installing/upgrading modules with composer?

Is Composer usage on Drupal 7 mature and comparable or even better than Drush?