On September 23, 2026, the Drupal Security Team published 22 advisories for the Webform module in one coordinated release. Two of them affect file uploads, and we backported both fixes to Drupal 7 for our Never-Ending Support (NES) customers. When we compared the Drupal 7 patches with the fixes for supported branches, one of them came up short in two places. We closed both gaps and shipped the NEW for Drupal 7 release to customers within about a day of the advisories going out.

AI now finds, patches, exploits, and even invents open source vulnerabilities faster than maintainers can keep up — and end-of-life software, with no maintainers at all, is the most exposed code in your stack.

The Drupal Security Team's May 20 advisory leaves Drupal 7 site owners with no answer — not vulnerable, not safe, just unchecked. Here's how we audited core and contrib modules to confirm D7 is not exposed to this highly critical SQL injection.

Why Snyk still flags vulnerabilities after NES—and how to correctly suppress false positives with a .snyk policy file.

How to eliminate false positives in Snyk after securing Spring Boot 2.7 with HeroDevs NES