Drupal is releasing an emergency security update
The Drupal Security Team announced that it will release a core security update for all supported branches on May 20 between 5 and 9 p.m. UTC. The vulnerability type has not been disclosed before the coordinated release. The team warns that exploits might be developed within hours or days.
CERT24