PatchClock

PHP security digest · 7 Oct 2026

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you...

Unrated CVE-2026-107250

Package
drupal/eca_helper
Fixed in
No fixed version yet
Published
Wed 7 Oct 2026, 17:15 LisbonUpdated Mon 26 Oct 2026, 04:26 Lisbon

In plain words

The Drupal Security Team has marked drupal/eca_helper unsupported because it has a known security issue that the maintainer has not fixed. The advisory does not explain what an attacker could do or under which conditions.

Am I affected?

Look for drupal/eca_helper in composer.lock and note its installed version. The advisory gives no affected version range or fixed version, and names no configuration or feature conditions, so it does not establish which versions are affected.

What to do

There is no fixed release yet. Read the advisory for a workaround, and watch drupal/eca_helper for a new version.

The advisory's description

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.