Drupal's October 28 Advisories Beyond Commerce Core: Stage File Proxy, Single Content Sync RCE, Commerce Stripe, and an Exploited CAPTCHA Flaw

Drupal's security team published 21 contributed-module advisories on Wednesday, October 28, 2026, carrying 39 separate fixes. None of them touch Drupal core. The headline item, the actively exploited Commerce Core access bypass (SA-CONTRIB-2026-254), and the eight fixes in the AI module have already drawn attention. This piece covers the rest of the batch, where several widely used modules need updating this week.

Critical: update this week

• Stage File Proxy (SA-CONTRIB-2026-286), about 27,000 sites. The module's fallback download on a 404 did not properly check file paths, opening a cross-site scripting path. Exploitation requires that an attacker can already upload a malicious file to the live site. The fix limits fallback fetching to paths under styles/. Update to 4.0.1 or 3.1.7. Since this is a development helper, it is also worth confirming it isn't enabled on production at all.
• Single Content Sync (SA-CONTRIB-2026-275 and -274), about 19,700 sites. A malicious import file could lead to remote code execution through untrusted deserialization of inline block data, plus a file path control issue. Only users with the import permission can trigger it. Update to 1.4.19, which also adds validation for imported files and limits remote downloads to trusted hosts.
• Commerce Stripe (SA-CONTRIB-2026-263, -264, -265), about 5,200 sites. The Stripe Connect return flow lacked a state token, so a forged link clicked by an administrator could mark an order as paid with no money changing hands. The release also enforces webhook signing secret validation and fixes an XSS. Update to 2.2.3.
• OAuth Login - OAuth OIDC SSO (SA-CONTRIB-2026-284). An unprotected test-configuration route and missing email_verified checks could let someone log in as an existing user whose email they know. Update to 3.1.1.
• Signature pad widget (SA-CONTRIB-2026-285) now sanitizes SVG signatures (update to 8.x-1.15), and OAuth2 Token Manager (SA-CONTRIB-2026-290) locks down its validation routes (update to 8.x-1.2).
• Withdrawn with no fix: CacheFlush (SA-CONTRIB-2026-276), GroupEx PRO (Daxko) integration (SA-CONTRIB-2026-278) and PayUmoney for Drupal Commerce (SA-CONTRIB-2026-277). Their maintainers did not fix a reported issue, so the only remedy is to remove or replace them.

Moderately critical, but one is being exploited

• CAPTCHA (SA-CONTRIB-2026-281), about 276,000 sites. A solved CAPTCHA session was not marked as used, so a protected form could be submitted repeatedly without solving a new challenge. Drupal rates it moderately critical, but the advisory notes it has been used in real attacks, so spam-heavy sites should not wait for the monthly cycle. Update to 2.0.11 or 8.x-1.18.
• Field Permissions (SA-CONTRIB-2026-289, -288), about 78,000 sites: private fields on entities without an owner were visible. Update to 8.x-1.6.
• Commerce Shipping (SA-CONTRIB-2026-261, -262): anyone could change or delete shipments in some setups. Update to 8.x-2.16 or 3.0.6.
• Commerce License (SA-CONTRIB-2026-260): a buyer could edit their own license to gain administrator rights. Update to 3.1.1.
• S3 File System, Media Alias Display, Content Sync (content-sync.io), Fasttoggle, OpenID Connect Client and Bulk Update User Roles also shipped fixes.

What to do

Run composer outdated "drupal/*" (or check Reports > Available updates) and prioritize Commerce Core, Stage File Proxy, Single Content Sync, Commerce Stripe and CAPTCHA. Commerce sites using Stripe, Shipping or License should update all of them together with Commerce Core 3.3.13 or 8.x-2.41, then review recent orders for anything marked paid without a matching Stripe charge.

Also keep the calendar in mind: Drupal 10 reaches end of life on December 9, 2026, after which these contrib fixes will increasingly target Drupal 11 and 12 only.

Sources: drupal.org security advisories and the weekly summary by Peter Brady.

If your Drupal site is stuck on an older core or module branch and can't take these updates cleanly, RescuePHP can help with upgrades, compatibility fixes and backported security patches.