Drupal's security team usually releases contributed-module advisories on Wednesdays, and they are typically a modest little stack of paperwork. On October 21 they dropped 34 of them in one go, on the same day PHP itself was having an emergency. If your update queue looked like a Costco receipt this week, you're not imagining it.

One Highly Critical, Plenty of Critical

The headliner is SA-CONTRIB-2026-220, a Highly Critical (20/25) remote code execution flaw in the Ffmpeg Image Toolkit module. It doesn't sufficiently sanitize file names passed to the ffmpeg command line, so anyone who can upload images could potentially run code on the server; version 1.0.3 fixes it. Close behind: Custom Formatters (Critical, fixed in 4.2.1), whose PHP formatter engine runs eval() on admin-supplied code without the permissions UI warning anyone, and a critical PHP object injection issue in Monster Menus.

The rest of the batch reads like a greatest-hits album of web vulnerabilities: access bypasses in Simple OAuth, Domain, Shield and Rabbit Hole; cross-site scripting in Bootstrap, Block Attributes and UI Icons; information disclosure in TinyPNG and ImageAPI Optimize WebP; and critical XSS in several contributed themes. That comes one week after a critical Field UI remote code execution fix in Drupal core itself.

Yes, Even the AI Modules

The one that should make AI-curious site owners sit up is SA-CONTRIB-2026-251 in AI File to Text, a module that extracts text from uploaded documents and hands it to AI agents as a tool. It didn't adequately check whether the current user could actually view a file before extracting it, which could expose private files to anyone with a role allowed to invoke AI tools. It's rated Moderately Critical and fixed in 1.0.1, but the pattern matters: when you give an agent a tool, the agent inherits every permission bug that tool has.

The bigger story here is arguably a healthy one. A burst of advisories like this usually means more eyes, and increasingly more automated tooling, are combing through contributed code. That's good for the ecosystem long-term. In the short term, it means the sites that skip "boring" maintenance are the ones that get unboring very quickly.

Thirty-four advisories isn't a reason to panic; it's a reason to know exactly which modules you're running and to have someone whose job it is to notice Wednesdays.

If reading that list made you wonder how many of those modules are quietly installed on your own site, we'll audit your Drupal stack and patch what needs patching.

Source: Drupal.org Security Advisories