Drupal Security Team

https://www.drupal.org/security

Added 2026-10-16 (S1): Drupal Security Team advisories (SA-CORE, SA-CONTRIB, PSA at drupal.org/security). First-party, scored 0-25 advisories for the CMS behind many public-sector sites, with pre-announcements that warn of imminent exploit development; SA-CORE-2026-014 was the 2026-10-14 critical Field UI RCE. `extract https://www.drupal.org/sa-core-2026-014` read cleanly on the first request, then drupal.org answered `extract` with a client challenge for sibling pages and the PSA while `WebFetch` read SA-CORE-2026-015/-016 and SA-CONTRIB-2026-218 in full. The listing or feed was not verified: find it (drupal.org/security/rss.xml or the advisory index) on the next sweep. | 2026-10-16 Recipe fixed in the same run: `feed https://www.drupal.org/security/all/rss.xml` reads direct (core, contrib and PSAs; /security/rss.xml is core only); the /security listing reads with WebFetch; advisory pages answer extract with a client challenge after the first request, so read them with WebFetch.