Newsfeed-Generator
Usergroup Berlin – Juli 2026
Liebes Berliner Drupal!
[English version below]
Am 02. Juli 2026 um 19:30
treffen wir uns wie die letzen 2 Jahre
im Brło-Biergarten am Gleisdreieck (Location)
vor der Sommerpause.
Statt kalter LCD-Panels bescheint uns die warme Sonne, und …– [Sonne scheint ein bißchen zu doll] — Erwärmt, nicht verbrennt, Sonne! — [Sonne dreht etwas runter] – … wir freuen uns über neue und alte Gesichter sowie Geschichten, die man sich bei einem Drink erzählen … – [Regenwahrscheinlichkeit: 40%] – …kann.
P.S.: Es ist WM, ab 21h wird da Fußball (1. Gruppe H vs. 2. Gruppe J) gezeigt. Wenn Ihr das doof findet oder der Biergarten zu voll ist, weichen wir nebenan ins Jules (Location) aus.
Wir freuen uns! Meldet Euch gern schon davor: Ihr erreicht uns auf unseren Online-Kanälen. Kommt vorbei!
--
Dear Berlin Drupal!
On July 2nd 2026 at 19:30
we're gathering (like the years before)
at Brło beer garden at Gleisdreieck (location)
before our summer break.
Instead of cold LCD panels, we're shone upon by a warm sun and …– [sun shines a little too strong] — warms, not burns, sun! — [sun turns it down a bit] – … we're happy to encounter old and new faces telling Drupal tales, to listen to… – [chance of rain: 40%] – …over a drink.
P.S.: It's world championship, from 21h on, they're showing soccer (1st group H vs. 2nd group J). If you think that's silly or the beer garden gets too cramped, we're moving close by to Jules (location).
We're looking forward to it! Gladly contact us on our online channels before. Pass along!
Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064
The Tealium iQ Tag Management module provides Drupal integration with Tealium iQ.
tealiumiq stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an Object Injection vulnerability when the data are unserialized.
This vulnerability is mitigated by the fact that an attacker must have permission to edit a content entity with an attached tealiumiq field. In addition, the core jsonapi module must be enabled with the option "Accept all JSON:API create, read, update, and delete operations", which is not the default, or the attacker needs some other way to edit field values directly.
Note: This project was marked as Unsupported by the Drupal Security Team on 2026-06-24 but a fix was released and the project restored on 2026-06-26.
Solution:Install the latest version:
- If you use the Tealium iQ Tag Management module, upgrade to Tealium iQ Tag Management 8.x.2.4
- Drew Webber (mcdruid) of the Drupal Security Team
- Benji Fisher (benjifisher) of the Drupal Security Team
- Daniel Schiavone (schiavone)
- Benji Fisher (benjifisher) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063
The Salesforce Suite of modules integrates Drupal with Salesforce.
The Salesforce module does not properly validate the OAuth handshake during interactive authentication, allowing an attacker to hijack the authorization token and bind the site to an attacker's Salesforce account.
This vulnerability is mitigated by the fact that salesforce_oauth submodule must be enabled, and a salesforce_oauth authorization profile active and in use. The submodule salesforce_oauth is deprecated, and salesforce_jwt has been the recommended authentication plugin for several years. Sites with salesforce_oauth uninstalled, or sites relying exclusively on salesforce_jwt (JWT or JWT Gov Cloud) for authentication are not impacted.
Submodule salesforce_oauth has been removed in branch 6.0.x, so >= 6.0.x versions are not affected by this vulnerability.
Solution:Recommended solution:
- Update to Salesforce Suite version 5.1.3
- Uninstall salesforce_oauth module
Alternative solution, if you must continue to use salesforce_oauth module:
- Update to Salesforce Suite version 5.1.3
- Revoke existing oauth provider tokens
- Re-authenticate all existing oauth providers
- Neil Drumm (drumm) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062
Geolocation modules adds a field to store coordinates and provides supporting plumbing for views and other modules.
One of the provided views filters does not sufficiently sanitize values if exposed to user input resulting in a SQL injection vulnerability.
This vulnerability is mitigated by the fact that a view must exist, that uses the aforementioned filter and it is set to accept user input.
Solution:Install the latest version:
- If you use the Geolocation Field module for Drupal, upgrade to Geolocation Field 8.x-3.15
- cilefen (cilefen) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061
The optional Paragraphs Library module allows the reuse of paragraphs in multiple places.
The module doesn't sufficiently restrict access to direct child paragraphs of library items through API endpoints.
This vulnerability is mitigated by the fact the paragraphs_library module must be in use and general write access to paragraphs through another module must be allowed.
Install the latest version:
- If you use the Paragraphs module for Drupal 8.x, upgrade to Paragraphs 8.x-1.21
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060
The optional Paragraphs Library module allows the reuse of paragraphs in multiple places.
The module doesn't sufficiently restrict access to unpublished library items in lists.
This vulnerability is mitigated by the fact the paragraphs_library module must be in use, and that an attacker must have access to a list of library items, such as a field with autocomplete suggestions or a view.
Install the latest version:
- If you use the Paragraphs module for Drupal 8.x, upgrade to Paragraphs 8.x-1.21
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Sascha Grossenbacher (berdir)
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
WissKI - Critical - Access bypass - SA-CONTRIB-2026-059
The module adds support for the mirador viewer in WissKI and enables annotations on images via the mirador viewer.
It does not sufficiently check the submitted parameters via a route and writes these to the session object without further checks, which can lead to Access Bypass.
This vulnerability is mitigated by the fact that it is specific to the wisski_mirador submodule.
Solution:Install the latest version:
- If you use the WissKI module version 8.x-4.1, upgrade to WissKI 8.x-4.2
- Drew Webber (mcdruid) of the Drupal Security Team
- cilefen (cilefen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058
This module enables you to take payments through the Global Payments / Realex Hosted Payment Page (HPP), either via a lightbox iframe or via a full-page redirect.
When the gateway is configured with the redirect payment method, the module doesn't sufficiently verify the authenticity of the payment response returned by Global Payments.
The lightbox payment method validates the signature and is not affected, so sites that use the lightbox payment method are not affected.
Solution:Install the latest version:
- If you use the commerce_realex module <=3.0.1, upgrade to commerce_realex 3.0.2.
The redirect payment response is now cryptographically verified against the merchant shared secret .
Sites that cannot update immediately should disable this payment gateway, until the update can be applied.
Reported By: Fixed By: Coordinated By:- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057
This module provides the entity type and runtime for Drupal AI Agents, enabling agents to use tools.
Under certain circumstances, the agent inherits deterministic parameters when invoking the same tool in one request, which can lead to information disclosure.
Solution:Install the latest version:
- If you use the AI Agents module 1.1.3, upgrade to AI Agents 1.1.4
- If you use the AI Agents module 1.2.4 upgrade to AI Agents 1.2.5
- If you use the AI Agents module 1.3.0 upgrade to AI Agents 1.3.1
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056
This module provides the entity type and runtime for Drupal AI Agents, enabling agents to use tools.
The module does not sufficiently check the required permissions when a tool loads content entities.
This vulnerability is mitigated by the fact that an agent must be configured to use the affected tool, and an attacker must have access to that agent.
Solution:Install the latest version:
- If you use the AI Agents module 1.1.3, upgrade to AI Agents 1.1.4
- If you use the AI Agents module 1.2.4 upgrade to AI Agents 1.2.5
- If you use the AI Agents module 1.3.0 upgrade to AI Agents 1.3.1
- Artem Dmitriiev (a.dmitriiev)
- AKHIL BABU (akhil babu)
- harivansh sharma (harivansh)
- Kuniyoshi Noguchi (kuninogu)
- Marcus Johansson (marcus_johansson)
- Bram Driesen (bramdriesen) of the Drupal Security Team
AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055
This module enables you to utilize an agent to use Drupal core actions tools with bypassed access.
Certain Drupal core actions, exposed as agent tools did not have correct access validation, and some core actions were missing associated access-level definitions.
This vulnerability is mitigated by the fact that an attacker must have access to communicate with an affected agent, the site must be configured to expose the affected tools to non-privileged users.
Solution:Install the latest version:
- If you use the AI module 1.2.16, upgrade to AI 1.2.17
- If you use the AI module 1.3.7 upgrade to AI 1.3.8
- If you use the AI module 1.4.2 upgrade to AI 1.4.3
- Artem Dmitriiev (a.dmitriiev)
- Marcus Johansson (marcus_johansson)
- Dezső Biczó (mxr576)
- Valery Lourie (valthebald)
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054
The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content Suggestions) provide the ability to use an LLM to generate HTML or Markdown and preview it in a browser.
Under certain circumstances, rendering of this HTML can lead to Cross Site Scripting, or exposing secret communications in the context of the LLM request.
This vulnerability is mitigated by the fact that an attacker must be able to inject text into prompts to create an attack.
Solution:Install the latest version:
- If you use the AI module 1.2.16, upgrade to AI 1.2.17
- If you use the AI module 1.3.7 upgrade to AI 1.3.8
- If you use the AI module 1.4.2 upgrade to AI 1.4.3
- Drew Webber (mcdruid) of the Drupal Security Team
- Artem Dmitriiev (a.dmitriiev)
- Abhisek Mazumdar (abhisekmazumdar)
- AKHIL BABU (akhil babu)
- Marcus Johansson (marcus_johansson)
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053
This module enables you to use OpenAI as a provider for the AI module.
The module doesn't sufficiently sanitize user-supplied URLs, leading to a Server-side request forgery (SSRF) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have the access to change the host url and a way to generate AI-generated images.
Solution:Install the latest version:
- If you use the OpenAI Provider module 1.1.0, upgrade to OpenAI Provider 1.1.1
- If you use the OpenAI module 1.2.1 upgrade to OpenAI Provider 1.2.2
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
Advanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-052
This module enables you to collect feedback from your site visitors on content pages, allowing them to optionally attach a free-text comment to their Yes/No vote.
The module doesn't sufficiently verify authorization over the targeted feedback record when processing a comment submission.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "give feedback". Note: "give feedback" is granted to anonymous and authenticated by default on install.
Solution:Install the latest release:
- If you use the admin_feedback module for Drupal 8.x, upgrade to admin_feedback 8.x-2.8
The comment endpoint now requires an HMAC-signed token bound to the specific feedback row (issued only to the visitor who cast that vote), and a comment may be written only once, preventing both forgery of arbitrary ids and replay.
Reported By: Fixed By: Coordinated By:- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
Advanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051
This module enables you to collect feedback from your site visitors on content pages, presenting Yes/No buttons and providing dashboards for administrators to review the responses.
The module doesn't sufficiently sanitize several administrator-configured response messages (the "Yes response", "No response", and the custom text shown on a "No" answer) under the scenario where those settings contain HTML or script markup, which is then emitted as raw HTML in the feedback response shown to visitors.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer admin feedback".
Solution:Install the latest release:
- If you use the admin_feedback module for Drupal 8.x, upgrade to admin_feedback 8.x-2.8
The configured plain-text responses are now escaped with `Html::escape()`, and the formatted "No" response is rendered through its configured text format filter (`check_markup()`) instead of being printed raw.
Reported By: Fixed By: Coordinated By:- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009
The JSON:API and REST modules allow you to upload image files to image fields.
The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image.
Certain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other unexpected behavior.
Solution:Install the latest version:
Drupal 11
- If you use Drupal 11.3.x, update to Drupal 11.3.12.
- If you use Drupal 11.2.x, update to Drupal 11.2.14.
Drupal 10
- If you use Drupal 10.6.x, update to Drupal 10.6.11.
- If you use Drupal 10.5.x, update to Drupal 10.5.12.
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)
Reported By: Fixed By:- Björn Brala (bbrala)
- Kim Pepper (kim.pepper)
- Lee Rowlands (larowlan) of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008
The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via providers.json and via URL discovery.
The URL discovery code could be leveraged to trick Drupal into making server-side requests to any URL.
Solution:Install the latest version:
Drupal 11
- If you use Drupal 11.3.x, update to Drupal 11.3.12.
- If you use Drupal 11.2.x, update to Drupal 11.2.14.
Drupal 10
- If you use Drupal 10.6.x, update to Drupal 10.6.11.
- If you use Drupal 10.5.x, update to Drupal 10.5.12.
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)
Required site changes for URL discoveryMost users of the oEmbed functionality in Drupal likely use providers.json to define known providers (such as YouTube and Vimeo) for embedding content.
If you are using URL discovery, you now need to set a list of trusted oEmbed discovery hosts in settings.php.
This is an array containing a series of regular expressions for matching host names for discovery. It follows the same pattern as the existing trusted hosts settings.
Example:
// Only allow URL discovery from example.com. $settings['media_oembed_discovery_trusted_host_patterns'] = [ '^example\.com$', ]; Reported By:- Hamed Kohi (0xhamy)
- assaf alassaf (ama62)
- Albert Skibinski (askibinski)
- Jon Minder (ayalon)
- Lautaro Casanova (betah4k)
- Gabe Sullice (gabesullice)
- John Morahan (john morahan)
- Michael Winser (michaelwinser)
- nbanderson
- offensive-ai
- Francesco Placella (plach)
- quynh ho (qquynh)
- Himanshu Anand (unknownhad)
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Adam G-H (phenaproxima)
- Sean Blommaert (seanb)
- Benji Fisher (benjifisher) of the Drupal Security Team
- cilefen (cilefen) of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Mori Sugimoto (dokumori) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- James Gilliland (neclimdul) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007
Drupal core ships a rebuild.php front controller that can be used to rebuild Drupal (clearing the caches and rebuilding the container) when the site is in an unexpected condition.
This script doesn't correctly check the Host header against the list of trusted host patterns. This could result in cache poisoning or a redirect to an attacker-controlled domain.
Solution:Install the latest version:
Drupal 11
- If you use Drupal 11.3.x, update to Drupal 11.3.12.
- If you use Drupal 11.2.x, update to Drupal 11.2.14.
Drupal 10
- If you use Drupal 10.6.x, update to Drupal 10.6.11.
- If you use Drupal 10.5.x, update to Drupal 10.5.12.
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)
Reported By: Fixed By:- Lee Rowlands (larowlan) of the Drupal Security Team
- catch (catch) of the Drupal Security Team
- cilefen (cilefen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- James Gilliland (neclimdul) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006
Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application deserializes untrusted data due to another vulnerability.
This issue is not directly exploitable.
This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize().
Solution:Install the latest version:
Drupal 11
- If you use Drupal 11.3.x, update to Drupal 11.3.12.
- If you use Drupal 11.2.x, update to Drupal 11.2.14.
Drupal 10
- If you use Drupal 10.6.x, update to Drupal 10.6.11.
- If you use Drupal 10.5.x, update to Drupal 10.5.12.
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)
Reported By: Fixed By:- Lee Rowlands (larowlan) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Mohit Aghera (mohit_aghera)
- Anna Kalata (akalata) of the Drupal Security Team
- Benji Fisher (benjifisher) of the Drupal Security Team
- cilefen (cilefen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Drupal core - Critical - PHP object injection - SA-CORE-2026-005
SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services.
The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain rare circumstances, potentially resulting in PHP Object Injection.
This vulnerability is mitigated by the fact that in order to be exploitable:
- A site must use an entity reference field type that stores a serialized property.
- An attacker must have permission to write to the entity via JSON:API.
No field type shipped with Drupal core meets these criteria, and contributed or user-created field types that do appear to be extremely unusual. This update protects all such fields; no changes are required in contributed modules.
JSON:API is read-only by default, so sites are only affected if they have enabled write access (either through administrator configuration or the installation of a contributed or custom module that enables write access).
Drupal Steward protection:This issue is being protected by Drupal Steward. In this instance, we believe that the WAF rule will provide mitigation for the common/obvious vulnerability paths, but may not cover all cases or work for all hosting providers. Additionally, several other core security advisories released today are not mitigated by Drupal Steward. Therefore, our recommended action is still to plan an actual Drupal update within 24 hours of this release.
Solution:Install the latest version:
Drupal 11
- If you use Drupal 11.3.x, update to Drupal 11.3.12.
- If you use Drupal 11.2.x, update to Drupal 11.2.14.
Drupal 10
- If you use Drupal 10.6.x, update to Drupal 10.6.11.
- If you use Drupal 10.5.x, update to Drupal 10.5.12.
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)
Reported By: Fixed By:- Björn Brala (bbrala)
- Sascha Grossenbacher (berdir)
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Anna Kalata (akalata) of the Drupal Security Team
- Benji Fisher (benjifisher) of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- David Strauss (david strauss) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Tim Hestenes Lehnen (hestenet)
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Ra Mänd (ram4nd) provisional member of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Neue Kommentare
vor 7 Wochen 12 Stunden
vor 7 Wochen 4 Tagen
vor 7 Wochen 4 Tagen
vor 10 Wochen 14 Stunden
vor 10 Wochen 2 Tagen
vor 10 Wochen 2 Tagen
vor 10 Wochen 5 Tagen
vor 14 Wochen 4 Stunden
vor 13 Wochen 6 Tagen
vor 13 Wochen 6 Tagen