While everyone else spent August arguing about AI, the Drupal Security Team quietly did something far more useful: they went through the contributed-module ecosystem with a fine-tooth comb and started throwing things out.

Five Advisories, Two Problems, Zero Drama

On August 12, the Drupal Security Team published five Moderately Critical advisories covering the contributed modules Commerce PayPal, Diff, Entity Share Websub, External Authentication, and Quick Tabs. Four involved access bypass issues, one involved server-side request forgery, and all five carried only a "theoretical" exploit-availability rating — meaning nobody's caught it being actively exploited yet, which is exactly the window you want to patch in.

That wasn't a one-off. Since June 10, the Security Team has marked a total of 16 contributed projects unsupported across five separate rounds, most recently pulling the plug on Gammu SMS Daemon, Link content parser, and Screenshot on August 19. A project lands on that list when its maintainer goes silent after repeated attempts to get a reported security issue fixed — at which point Drupal doesn't just flag the bug, it tells every site running that module to uninstall it entirely.

Ruthless Housekeeping Is a Feature, Not a Bug

Most CMS ecosystems let abandoned plugins quietly rot in the directory, still installable, still technically "supported" in the sense that nobody's stopped you. Drupal's team does the less popular thing: it publicly names the module, tells you it's dead, and tells you to remove it — full stop, no patch coming. It's a blunt policy, and it's also exactly the kind of discipline that keeps a decade-old module ecosystem from becoming a liability nobody wants to own.

The catch is that this only works if site owners actually act on it. An advisory that says "uninstall Quick Tabs" does nothing if nobody's reading the advisory feed. Given how many Drupal builds accumulate contributed modules over the years — added for one client request, forgotten the moment the project shipped — there's a good chance at least one of these five, or one of the 16 unsupported projects, is sitting in a codebase somewhere right now.

Drupal's security team can tell you a module is dead. Only someone actually looking at your site can tell you whether you're still running it.

If it's been a while since anyone audited what contributed modules are actually installed on your Drupal site, that's a quick check worth having on the calendar — grab our free security checklist to get started.

Source: The Drop Times