Drupal has announced a "core security release" scheduled for later today, warning that threat actors might develop exploits within hours of the update disclosure.

Drupal plans May 20 core security patches as exploits may follow within hours or days, requiring urgent site updates.

The org’s staying mum on the details, but Wednesday’s fixes reach back to unsupported 8.9 branches