The Drupal Security Team published 26 Drupal module advisories on October 7, 2026, numbered SA-CONTRIB-2026-192 through SA-CONTRIB-2026-217. One is Highly critical, seven are Critical, and two of the Critical ones have no fix at all. The advice there is to uninstall.
The Webform release on September 23 brought 20 advisories for one module. These Drupal module advisories are spread across 25 projects, so the first job is finding out whether you run any of them. This piece covers how to check, what to patch first, why the two-factor advisories matter, and how Drupal 10’s December 9 end of life fits in.
The short version: run one inventory command, then work down the list. Patch Block AJAX first if you have it. Next come the Critical issues that need no login. Then fix the two-factor modules. Then remove ECA Helper and Orphans Media, which will not be fixed. Facts here are as of October 10, 2026, from the drupal.org advisory pages.
Our Webform security release breakdown covered the last batch. This is the triage guide for this one.
What the October 7 Drupal module advisories cover
The full list is on drupal.org’s contributed project advisories page. Here is how the 26 break down.
| Risk level | Count | Score range | Advisories |
|---|---|---|---|
| Highly critical | 1 | 20 to 25 | 192 (Block AJAX) |
| Critical | 7 | 15 to 19 | 193 to 198, 216 |
| Moderately critical | 17 | 10 to 14 | 199 to 214, 217 |
| Less critical | 1 | 5 to 9 | 215 (Examples for Developers) |
The score bands come from the Security Team’s risk levels page. Each advisory also has a risk string, such as A:None or A:Admin. The "A" part tells you who can attack. A:None means anyone, including visitors who are not logged in. A:User means someone with common permissions. A:Admin means someone with broad, trusted permissions.
Every advisory we read rates exploitation as theoretical: no public exploit code was known at publication. Patch while that is still true.
Step one: check whether you run any of these modules
Before you can triage Drupal module advisories, you need a list of what each site runs. There are three ways to get it.
Drush. Run drush pm:list --no-core --status=enabled --type=module. The Drush pm:list documentation lists those options. You get every installed contributed module with its version. Search the output for the machine names below.
Composer. Run composer outdated "drupal/*", the command drupal.org gives in its Composer update guide. It lists every Drupal package with a newer release. Most packages are named drupal/ plus the machine name. A few projects publish under a different vendor name, so Drush is the surer check.
The admin screen. Go to Reports, then Available updates. Security releases are flagged there. This needs the core Update Status module turned on.
The machine names to search for:
block_ajax, eca_helper, entity_reference_manager, mathjax, orphans_media, auth_login_plus, actstream, restrict_route_by_ip, miniorange_2fa, gutenberg, leaflet, dkan, smartlinker_ai, easy_breadcrumb, permissions_by_term.
Agencies with many client sites can script the Drush check and save one dated list per site.
Block AJAX: the one Highly critical advisory
SA-CONTRIB-2026-192 scores 20 out of 25. Block AJAX does not properly check data used to build a block. In the worst case, that can lead to PHP object injection and remote code execution. In plain terms, an attacker could run their own code on your server.
The risk string is A:None, so no login is needed. The advisory limits the risk to sites with Layout Builder turned on, or another block plugin that handles this data unsafely.
The fix is Block AJAX 3.0.2. Read the release notes before you deploy it. The 3.0.2 release removes support for rendering AJAX blocks with custom configuration through Twig Tweak. Only blocks placed through the Block layout screen still load. If your theme builds blocks in Twig, test those pages after the update.
The seven Critical Drupal module advisories
Here are the Critical Drupal module advisories, with the fix as each advisory states it.
| Module (advisory) | Risk in plain terms | Login needed? | What the advisory says to do |
|---|---|---|---|
| Restrict route by IP (216), 17/25 | Access bypass. Some dynamic routes are not blocked by the IP rules. | No (A:None, AC:None) | Upgrade to 2.0.1 (2.0.x) or 1.3.1 (1.3.x) |
| Actstream (198), 16/25 | Access bypass. The settings page does not check that the editor owns the account. | No (A:None) | Upgrade to 2.1.1 (2.1.x) or 2.0.1 (2.0.x) |
| Entity Reference Manager (194), 16/25 | Access bypass. Anyone who can view content can use the merge feature to delete nodes, terms or media. | No (A:None) | Upgrade to 1.0.3 |
| MathJax (195), 15/25 | Cross-site scripting. Script inside TeX formulas is not escaped. | No (A:None) | Upgrade to 4.1.2, then check the status report for MathJax warnings |
| Authenticator Login Plus 2FA (197), 15/25 | Improper authentication. One-time login links skip the second factor. | No (A:None, AC:Complex) | Upgrade to 1.0.1 |
| ECA Helper (193), 16/25 | Unsupported. A known issue the maintainer has not fixed. | Admin (A:Admin) | No fix. “If you use this project, you should uninstall it.” |
| Orphans Media (196), 16/25 | Unsupported. A known issue the maintainer has not fixed. | Admin (A:Admin) | No fix. “If you use this project, you should uninstall it.” |
Two notes. Restrict route by IP is the only one rated AC:None, which means an attacker only needs to visit a page. If you use it to protect admin or staff routes, those routes may not be protected. For MathJax, the advisory says that if the status report shows "safe mode is not enabled," the update could not fix your settings, and you have to change them by hand.
Which Drupal module advisories to patch first
This is the order we would use for the October 7 Drupal module advisories.
- Block AJAX, today, if Layout Builder is on. It is the only Highly critical one, and it can lead to code running on your server with no login.
- The Critical issues that need no login: Restrict route by IP, Actstream, Entity Reference Manager and MathJax. Anyone on the internet can reach these.
- The two-factor modules: Authenticator Login Plus (two advisories) and TFA / Passwordless Login. These protect the accounts that matter most. More on why below.
- ECA Helper and Orphans Media. They need admin access to exploit, so they rank lower for speed. But they will never be fixed. Plan the removal this week, and check what each one does before you uninstall it.
- Moderately critical issues that match your setup. Read the conditions. Many only apply with a specific setting turned on.
Patch on staging first. Then run drush updatedb and drush cache:rebuild, as drupal.org’s Composer guide describes, and test the affected pages.
Why the two-factor advisories matter
Three advisories in this batch hit two-factor login modules. For associations, nonprofits and universities, two-factor login usually guards the admin and editor accounts. Those are the accounts the A:Admin risks need.
Authenticator Login Plus, Critical. SA-CONTRIB-2026-197 says the module does not ask for the second factor when someone logs in through Drupal’s one-time login link. The attacker needs a valid one-time link for the victim’s account first. Drupal’s password reset email contains that kind of link, so anyone reading a staff member’s mailbox could have one.
Authenticator Login Plus, Moderately critical. SA-CONTRIB-2026-201 says that under certain conditions, a user may log in with only a password, even when 2FA is required site-wide. Version 1.0.1 fixes both. After the update, users who had turned 2FA off will be asked to set it up again. Warn your staff before you deploy.
TFA / Passwordless Login, Moderately critical. SA-CONTRIB-2026-207 covers the miniOrange module. Its headless login endpoint can expose the site’s miniOrange customer API key to visitors who are not logged in. This only applies if Headless 2FA has been turned on. The fix is 5.5.2 for the 5.5.x branch or 5.4.1 for 5.4.x.
If you report two-factor login to an auditor or insurer, confirm these updates are in before you do.
The Moderately critical Drupal module advisories worth a look
Seventeen advisories are Moderately critical. These six are the ones most likely to show up on association and university sites.
| Module (advisory) | Problem | When it applies | Fix |
|---|---|---|---|
| Gutenberg (202) | Access bypass in editor endpoints | Attacker has a role with “use gutenberg” | 3.0.7 or 8.x-2.15 |
| Leaflet (204) | Stored cross-site scripting in map titles | Attacker can create or edit content shown on a map | 10.4.13 |
| DKAN (208) | Access bypass in datastore endpoints | Anonymous users lack “access content” | 4.1.5 or 4.0.4 |
| SmartLinker AI (210) | Search results ignore access rules | User can use the AI internal link feature | 1.0.3 |
| Easy Breadcrumb (212) | Unpublished parent terms can show in breadcrumbs | “Add parent hierarchy” is on and a parent term is unpublished | 2.0.11 |
| Permissions by Term (214) | Restricted nodes visible through JSON:API | Permission mode, a deleted term and JSON:API access | 3.1.41 |
Also check Inline Formatter Field (203) and Linked Field (200), both server-side template injection issues. The other Moderately critical Drupal module advisories each list their fixed version on the advisory page.
Drupal 10 end of life and the next round of advisories
Drupal’s release schedule says Drupal 10 reaches end of life on December 9, 2026. It also says no new Drupal 10 releases will be made after that date.
These Drupal module advisories show why that date matters. The October 7 fixes still support Drupal 10. Block AJAX 3.0.2 works with Drupal 10.3 and 11. MathJax 4.1.2 supports Drupal 9.1, 10 and 11. The Authenticator Login Plus advisories name Drupal 10 or 11.
That may not hold for the next batch. Drupal.org’s security advisory policy ties support to both Drupal core support and the maintainer’s support. Once core support for Drupal 10 ends, maintainers have no obligation to keep a Drupal 10 branch patched. Some will. Many will not.
Background is in what Drupal 10 end of life means for your site, and our plain-language Webform guide shows the same risk for one popular module. Drupal 12’s beta has slipped, as we covered in Drupal 12’s release slip, but the Drupal 10 date did not move. Our DrupalCon Rotterdam recap has a nine-week plan for teams still on 10.
A checklist for this week
- Run the Drush inventory on every site and save the output.
- Update Block AJAX to 3.0.2 and test any Twig-rendered blocks.
- Update Restrict route by IP, Actstream, Entity Reference Manager and MathJax.
- Update Authenticator Login Plus to 1.0.1 and TFA / Passwordless Login to 5.5.2 or 5.4.1. Tell staff about the 2FA prompt.
- Plan the removal of ECA Helper and Orphans Media.
- Match the Moderately critical conditions against your settings.
- Confirm each site’s Drupal version and the Drupal 11 date for any still on 10.
In September we covered fifteen advisories in one day. A saved module list per site makes the next batch of Drupal module advisories a quick check.
Frequently Asked Questions
How many Drupal module advisories were published on October 7, 2026?
Twenty-six, SA-CONTRIB-2026-192 through SA-CONTRIB-2026-217. One is Highly critical, seven are Critical, 17 are Moderately critical and one is Less critical.
Which advisory should we patch first?
Block AJAX, SA-CONTRIB-2026-192, if your site runs it with Layout Builder. It scores 20 out of 25, needs no login and can lead to remote code execution. The fix is 3.0.2.
How do I check whether my site uses any of these modules?
Run drush pm:list with the –no-core option and search for the machine names. You can also check Reports, then Available updates.
What does “unsupported” mean for ECA Helper and Orphans Media?
The Security Team marked both projects unsupported because each has a known issue the maintainer has not fixed. There is no new version to install. Each advisory says to uninstall the module.
Has anyone attacked sites through these flaws?
Not as of the advisories. Each one we read rates exploitation as theoretical, which means no public exploit code was known. That can change after publication.
Why do the two-factor advisories matter so much?
Two-factor login protects admin and editor accounts. If it can be skipped, those accounts are only as safe as their passwords and email.
Will users notice the Authenticator Login Plus update?
Some will. The advisory says users who had turned 2FA off will be asked to set it up again at their next login.
Do these fixes work on Drupal 10?
The ones we checked do. Block AJAX 3.0.2 supports Drupal 10.3 and 11, and MathJax 4.1.2 supports 9.1, 10 and 11. After December 9, 2026, new fixes may not support Drupal 10.
When does Drupal 10 reach end of life?
December 9, 2026. No new Drupal 10 releases will be made after that date, so sites on 10 need a dated Drupal 11 plan.
