Acquia participates in the Drupal Steward program as a platform partner. This page explains the Drupal Steward program, how it helps reduce short-term risk for certain highly critical Drupal vulnerabilities, and what Acquia customers may expect.
Drupal Steward is a temporary protective measure for qualifying highly critical vulnerabilities. It does not replace patching or normal security maintenance.
In practical terms, Drupal Steward provides a network-level or Web Application Firewall (WAF) mitigation for vulnerabilities that meet the qualifying criteria. For more information, refer to the Drupal Steward FAQ. You can also describe this as a “virtual patch” because it is designed to block known exploit patterns while customers prepare and apply official updates to Drupal core or associated modules.
What is Drupal Steward
Drupal Steward is a service from the Drupal Association and Drupal Security Team that helps reduce exposure during the period between the release of a fix for a highly critical Drupal vulnerability and the time when site owners can apply that fix.
Drupal Steward is best understood as a short-term risk-reduction measure for specific severe events, not as a permanent substitute for patching.
What it means for Acquia customers
Acquia is a member of the Drupal Steward partner program. For qualifying Drupal Steward events, Acquia can apply platform-level protections to supported customer environments as part of platform operations.
Protection is provided at the platform level for covered events.
Drupal Steward
Acquia participates in the Drupal Steward program as a platform partner. This page explains the Drupal Steward program, how it helps reduce short-term risk for certain highly critical Drupal vulnerabilities, and what Acquia customers may expect.
Drupal Steward is a temporary protective measure for qualifying highly critical vulnerabilities. It does not replace patching or normal security maintenance.
In practical terms, Drupal Steward provides a network-level or Web Application Firewall (WAF) mitigation for vulnerabilities that meet the qualifying criteria. For more information, refer to the Drupal Steward FAQ. You can also describe this as a “virtual patch” because it is designed to block known exploit patterns while customers prepare and apply official updates to Drupal core or associated modules.
What is Drupal Steward
Drupal Steward is a service from the Drupal Association and Drupal Security Team that helps reduce exposure during the period between the release of a fix for a highly critical Drupal vulnerability and the time when site owners can apply that fix.
Drupal Steward is best understood as a short-term risk-reduction measure for specific severe events, not as a permanent substitute for patching.
What it means for Acquia customers
Acquia is a member of the Drupal Steward partner program. For qualifying Drupal Steward events, Acquia can apply platform-level protections to supported customer environments as part of platform operations.
Protection is provided at the platform level for covered events.
Customers do not need to register separately with the Drupal Association to receive partner-delivered coverage through Acquia.
Drupal Steward support is event-driven and applies only to qualifying highly critical vulnerabilities.
Detailed implementation logic is not shared publicly for security reasons.
Availability of Drupal Steward protection depends on the vulnerability being one of the qualifying events covered by the program. Not every Drupal security advisory is included.
How Drupal Steward helps
When a qualifying vulnerability is handled through the Drupal Steward process, temporary mitigations can be prepared and deployed to reduce the likelihood of broad exploitation before normal remediation is complete.
This approach helps to:
Reduce immediate exposure during a narrow, high-risk period.
Slow or prevent common exploit attempts at scale.
Give site owners additional time to test and deploy official fixes.
For covered events, Drupal Steward adds an extra layer of short-term protection while customers move through their standard patching process.
What Drupal Steward does not do
It does not replace Drupal core, Acquia CMS or Acquia Source security updates.
It does not guarantee complete protection against every exploit path.
It does not apply to every Drupal vulnerability or every security advisory.
It is not a general-purpose, always-on managed security feature for all security events.
Customers must continue to follow normal vulnerability management and patch governance practices, including applying security updates as soon as practical after release.
Customer Guidance
If a security advisory indicates Drupal Steward coverage, Acquia may, in its sole and exclusive discretion, and without recourse by a customer, manage relevant partner-level protections through the platform, where applicable. Customers must still prioritize testing and deploying the official patch as soon as possible. Customers do not need to sign up or submit a Support ticket to confirm coverage.
To read through the official overview of the program, refer to Drupal Steward.
Frequently Asked Questions
Do Acquia customers need to sign up separately for Drupal Steward?
No. For qualifying events, protection is automatically applied at the platform level for all supported environments. Separate registration is not required, and opt-outs are not available.
Is Drupal Steward always active?
No. Drupal Steward is used for qualifying highly critical vulnerabilities and is not applied as a blanket measure for every advisory.
Does Drupal Steward remove the need to patch Drupal?
No. Drupal Steward is a temporary mitigation only. Customers must still apply the official security update.
Are all Drupal security advisories covered by Drupal Steward?
No. Coverage applies only to certain qualifying highly critical vulnerabilities.
Can Acquia share details of the mitigation applied through the Drupal Steward programme?
No. Details of the mitigation remain confidential as they may reveal the nature of the vulnerability to the public.
Customers do not need to register separately with the Drupal Association to receive partner-delivered coverage through Acquia.
Drupal Steward support is event-driven and applies only to qualifying highly critical vulnerabilities.
Detailed implementation logic is not shared publicly for security reasons.
Availability of Drupal Steward protection depends on the vulnerability being one of the qualifying events covered by the program. Not every Drupal security advisory is included.
How Drupal Steward helps
When a qualifying vulnerability is handled through the Drupal Steward process, temporary mitigations can be prepared and deployed to reduce the likelihood of broad exploitation before normal remediation is complete.
This approach helps to:
Reduce immediate exposure during a narrow, high-risk period.
Slow or prevent common exploit attempts at scale.
Give site owners additional time to test and deploy official fixes.
For covered events, Drupal Steward adds an extra layer of short-term protection while customers move through their standard patching process.
What Drupal Steward does not do
It does not replace Drupal core, Acquia CMS or Acquia Source security updates.
It does not guarantee complete protection against every exploit path.
It does not apply to every Drupal vulnerability or every security advisory.
It is not a general-purpose, always-on managed security feature for all security events.
Customers must continue to follow normal vulnerability management and patch governance practices, including applying security updates as soon as practical after release.
Customer Guidance
If a security advisory indicates Drupal Steward coverage, Acquia may, in its sole and exclusive discretion, and without recourse by a customer, manage relevant partner-level protections through the platform, where applicable. Customers must still prioritize testing and deploying the official patch as soon as possible. Customers do not need to sign up or submit a Support ticket to confirm coverage.
To read through the official overview of the program, refer to Drupal Steward.
Frequently Asked Questions
Do Acquia customers need to sign up separately for Drupal Steward?
No. For qualifying events, protection is automatically applied at the platform level for all supported environments. Separate registration is not required, and opt-outs are not available.
Is Drupal Steward always active?
No. Drupal Steward is used for qualifying highly critical vulnerabilities and is not applied as a blanket measure for every advisory.
Does Drupal Steward remove the need to patch Drupal?
No. Drupal Steward is a temporary mitigation only. Customers must still apply the official security update.
Are all Drupal security advisories covered by Drupal Steward?
No. Coverage applies only to certain qualifying highly critical vulnerabilities.
