Drupal 11.4

Apply the PHP 8.5 baseline first. These rules cover Drupal core 11.4 on PHP 8.5; the line also supports PHP 8.3 and 8.4. Use Drupal's services and configuration for framework-managed behavior.

Version and dependency security

• On 11.4.0 through 11.4.6, which predate the 11.4.7 fix for SA-CORE-2026-013, the bundled CKEditor has an XSS flaw: anyone who can create or edit content, even without CKEditor access, may be able to run script in the browser of users who edit with CKEditor, including site administrators. Drupal publishes no workaround, and custom-code hardening doesn't replace the update, so until a fixed 11.4 release is deployed, limit content creation and editing to trusted accounts.
• Run the newest 11.4 release and take each 11.4 security release as it ships, because Drupal delivers security fixes only as new patch releases of the minors it still covers; 11.4 has security coverage through June 2027. Don't wait for composer audit to tell you about a core security release: Drupal advisories without a CVE, such as SA-CORE-2026-013, don't reach the advisory data it reads. Keep core's update module enabled with its email notification set to at least security updates, and follow drupal.org's core security announcements.
• Keep drupal/core-recommended, drupal/core-composer-scaffold, and other installed drupal/core-* packages aligned when updating the lock file. Review contributed modules, themes, patches, and separately installed editor plugins against their own security advisories; core coverage does not cover every extension or external library.