The PSA for tomorrow left me a bit uncomfortable. Quote:

The Drupal Security Team urges you to reserve time for module updates at that time because exploits are expected to be developed within hours/days.

Does it make sense to put all sites in maintenance mode or take them offline precautionary? Maybe creating database backups before the announcement takes place isn't a bad idea?

Is there a Drupal way of responding such a pending threat? Or should we just sit and wait what's coming?


Taking a backup before the security release is a good idea.

Most people can't take their site offline unless completely necessary, but if you have that option then taking it offline at 16:00 UTC while you review and apply the updates would be the very safe way of doing it.

In summary, take a backup now and make yourself available after 16:00 UTC to review which of your modules need to be updated and then apply those updates asap.

| improve this answer | |

1) List all the Drupal 7 projects you maintain. 2) Have a list of used modules by project, you can use fllowing command

 drush pml --no-core --type=module --status=enabled > mylist.txt

3) Once the updates announced, you can search your modules lists to detect which project you really need to update

| improve this answer | |
  • That's nice for environments supporting drush. We have a whole variety of clients with different server setups, a lot of them on shared hosting platforms that don't support drush. – Volker Jul 13 '16 at 8:32

The important is being reactive in updating the modules when the security issue is made public, which normally is not done before the new security releases for the affected modules are made available.

The new releases will be available on on Wednesday July 13, 2016 16:00 UTC; until then, you could put the site in maintenance mode, or also temporary disable the modules that aren't strictly necessary. This could avoid possible exploits, but the majority of exploits happens when the security issues are made public, which is moment when you should updated the installed modules.

| improve this answer | |
  • Does anybody has any idea of which modules this concerns or will they announce the modules list ? As far as I can see they don't name any modules – mchar Jul 12 '16 at 21:00
  • 1
    Of course they won't make this public before the security fixes are available. Otherwise you would have a wild guessing hackathon on your installations, i'd guess. – Volker Jul 12 '16 at 21:03
  • @mchar You will know that on July 13, 2016 16:00 UTC. – kiamlaluno Jul 12 '16 at 21:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.