https://www.drupal.org/psa-2026-09-21

There will be a security release for a widely used contributed module on September 23, 2026 between 17:00 and 21:00 UTC.

We are announcing this release in advance because the affected contributed module is used on a significant portion of Drupal sites, and the upcoming release will include a significant number of advisories. The advisory with the highest risk score for the release is currently rated as critical.

Edit

From slack,

This will be the first time we've handled this many advisories, but we're also taking steps to do as much in advance as possible, so we'll see how it goes and then we'll know how long it takes 🙂

Also,

This will not be covered by Drupal Steward. There are far too many individual advisories, and many of them would not be mitigatable by a WAF rule, so it would give a false sense of security if we did probably. (And nothing is highly critical.)

I'll update the PSA accordingly.

🫠