official advisory

Drupal plans a core security update later today and warned that exploits could follow within hours. The advisory affects core versions 8 and later, with fixes planned for supported releases and hotfixes for some older branches.