Update - Advice Advice: GovCMS released updates to the Drupal 10 (D10) and Drupal 11 (D11) distributions on Thursday 21 May 2026. Deployments are scheduled to commence from 7:00am Thursday 21 May 2026 and will be conducted throughout the day.
It addresses a recent security advisory issued by Drupal.org. GovCMS assessed the HIGHLY CRITICAL risk as they applied to both distributions, subsequently the security residual risk remained HIGHLY CRITICAL. This vulnerability only affects sites using PostgreSQL. However, the third-party dependencies updates, such as Symfony and Twig, in this release apply to all sites. The D10 and D11 distributions will continue to be supported after this update.
PaaS customers should also treat this as HIGHLY CRITICAL and continue their deployments today.
As preventative preparation for this release, where shield was be not already enabled on SaaS non-production environments – it was enabled on 20 May 2026. This change will be rolled back during the release window.
Deployment schedule: - Production environments completed by 10:00am (AEST) Friday 22 May 2026. - Non-Production environments completed by 10:00am (AEST) Saturday 23 May 2026.
Update - GovCMS has assessed the HIGHLY CRITICAL risk as they applied to both distributions. The vulnerability only affects sites using PostgreSQL, given the upstream Symfony and Twig dependencies associated with this release, we continue to consider this update to be HIGHLY CRITICAL.
GovCMS is working on hotfixes to the distributions, and will be proceeding with this morning’s deployments. PaaS customers should also treat this as HIGHLY CRITICAL and continue their deployments today.
May 21, 2026 - 05:03 AEST
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
May 21, 2026 - 03:00 AEST
Scheduled - Advice We would like to inform you of an upcoming GovCMS Drupal 10 (D10) and Drupal 11 (D11) release and deployment. It will address DSA advisory PSA-2026-05-18 (https://www.drupal.org/psa-2026-05-18). Release notes will be sent out on 22 May 2026.
In preparation for this release, shield will be enabled on all non-production environments from 20 May 2026. If you are unsure of the shield credentials, please raise a service desk ticket.
As a reminder, a SaaS deployment block is in place ONLY while we update the production branches. During this time, you will still be able to develop and deploy to non-production feature branches. We are wanting to give you as much lead time as possible, should you need to adjust your timeframes.
PaaS deployments schedules are not impacted.
Deployment schedule: - Deployment to commence from 3am Thursday 21 May 2026 and will be conducted throughout the daytime. - Production branches completed by 10am Friday 22 May 2026 - Non-Production branches completed by 10am Saturday 23 May 2026
PaaS Actions It is very important that you make plans to address this advisory (https://www.drupal.org/psa-2026-05-18) on Thursday morning 21 May 2026. We also strongly advise that you turn on shield for all non-productions environments.
If you have any concerns, raise a ticket at https://www.govcms.support
May 21, 202603:00 - May 25, 202607:00 AEST
GovCMS: Content management and website hosting for the Australian government. Managed by the Department of Finance with service delivery partners Salsa Digital and amazee.io