Drupal Aid

24 #Drupal security advisories went out today, and 1 is critical.

• graphql_core_schema 1.0.29 (critical)
A user who can view another account can change its password, admin accounts included.

The other 23 are moderately critical or lower, across 18 more modules.

24 #Drupal advisories security today. 9 are critical:

• commerce_product_alternative
• content_synchronizer
• groupexpro
• highlight_js
• reset_password_email_otp
• rest_api_authentication
• s3fs_cors
• simple_oauth
• workflow_notifications

15 more are lower risk.

#Drupal security: 18 fixes, 3 unsupported.

• commerce 3.3.13 (highly critical)
• single_content_sync 1.4.19
• oauth_login_oauth2 3.1.1
• oauth2_token_manager 1.2
• stage_file_proxy 4.0.1
• sign_widget 1.15.0
• ai 1.5.2
• commerce_stripe 2.2.3

+10 moderately critical.

#PHP 8.2 security support ends December 31, 2026.

Moving a #Drupal site to PHP 8.3 rarely breaks your own code. It breaks the tools around it, and some of those failures report success.

drupalaid.com/blog/php-8-3-r…

#Drupal security day: 31 contrib advisories. Most urgent:

• ffmpeg_image_toolkit 1.0.3 (highly critical)
• custom_formatters 4.2.1
• monster_menus 9.5.6
• ui_icons 2.0.2
• abc 2.0.1
• black_hole 2.0.1
• zero_point 2.0.1
• dopup 1.0.7

Plus 23 moderately critical.