Some people get a pumpkin spice latte to mark the season. Drupal site owners got 34 security advisories in a single afternoon. It's not the October treat anyone asked for, but it's the one that keeps your site from turning into a haunted house.
One Highly Critical, Seven Critical, Lots of Homework
On October 21, the Drupal Security Team published 34 contributed-module advisories, SA-CONTRIB-2026-220 through SA-CONTRIB-2026-253. Top of the list is a Highly critical remote code execution flaw in Ffmpeg Image Toolkit (SA-CONTRIB-2026-220), caused by insufficient sanitization of filenames passed to the FFmpeg command-line tool. Exploiting it requires permission to upload images, which on plenty of sites (think community portals, intranets, or any site with editor accounts) is not exactly a high bar.
Seven more were rated Critical, including a remote code execution issue in Custom Formatters (fixed in 4.2.1), whose PHP formatter engine uses eval() to run user-supplied PHP, plus a PHP object injection flaw in Monster Menus. The rest of the batch is a who's-who of common modules with access bypass and cross-site scripting issues, including Bootstrap, Domain, Shield, Rabbit Hole, and Simple OAuth. Several Critical cross-site scripting fixes also landed for themes and UI modules like Zero Point, Black Hole, and UI Icons.
The Long Tail Is Where Sites Get Bitten
Core gets the headlines (and yes, a Critical core RCE in Field UI landed just a week earlier), but contrib is where most real-world Drupal sites carry their risk. Your site might run a dozen of these modules without anyone remembering who installed them or why. Access bypass bugs in particular rarely make headlines, but they're how private content quietly ends up public. And Custom Formatters is a good reminder that a module rated "admin-only" still matters: one compromised admin account turns eval() into a full site takeover.
There's also an AI-flavored entry worth noting: AI File to Text picked up an access bypass advisory. As more sites bolt AI modules onto Drupal, those modules join the attack surface like everything else. A shiny AI feature gets the same patch discipline as a menu module, or it becomes the shiniest door into your site.
The takeaway: check your composer.lock against the full list today, not after your next sprint.
Drupal is our home turf, so if 34 advisories just turned into 34 open browser tabs, let our team triage your site's exposure and get the right patches in.
Source: Drupal.org Security Advisories