The Drupal on AWS by FOSSonCloud pattern now ships Drupal 11.4.4, up from 11.3.8. That span covers a full minor release plus four patch releases, and it ends on a security-only release — so there’s both a large free performance win and a patch you should apply now.
What changed
11.4.0 — a major performance release
Released July 1, 2026, 11.4.0 was one of the biggest performance releases in Drupal’s recent history. It cut database queries by roughly half compared to 11.3 across a wide range of requests, and on a cold cache it uses only about a third of the database and cache lookups that 11.0 or 10.6 needed for the same work.
Alongside the performance work:
- An experimental native command-line interface landed at
./vendor/bin/dr, extensible and intended to eventually replace Drupal’s older hardcoded CLI scripts. - Assets get 15–25% better compression via Brotli.
- Translation file handling was modernized — on a 66-project, 38-language test site, checking for translation updates was 87% faster than on 11.3.
- The default Standard install profile dropped the Article and Page content types and disabled commenting by default, so fresh installs look different than they used to.
- Composer-installable Rector rulesets became stable, making automated code upgrades far more accessible for teams maintaining multiple Drupal codebases.
11.4.1–11.4.3 — routine maintenance
No headline changes; ordinary bug fixes.
11.4.4 — security only
Released mid-July 2026, patching three vulnerabilities with no feature changes:
- A moderate-severity information disclosure issue (SA-CORE-2026-010)
- Two moderate cross-site scripting (XSS) issues (SA-CORE-2026-011, SA-CORE-2026-012)
Why it matters
The performance story is the headline, and it’s the kind of improvement you rarely get for free. Halving database queries on a content-heavy site translates directly into headroom: fewer RDS connections under load, lower latency on cold-cache requests, and more traffic absorbed before you need to scale up. If you’ve been sizing your database instance around 11.3 behavior, 11.4 may let you stay where you are considerably longer.
The 87% faster translation update check matters much more than it sounds if you run a multilingual site — that check is a routine cron-driven operation, and on a large project it had become genuinely slow.
The security fixes are moderate severity rather than critical, but XSS on a CMS is a path to session hijacking and admin account compromise. They’re cheap to apply and there’s no reason to sit on them.
The install profile change is the one that can quietly surprise you: fresh installs no longer come with Article and Page content types, and commenting is off by default. Existing sites are unaffected — nothing is removed from a site you already run — but any automation, documentation, or onboarding guide that assumes a stock Drupal install has an “Article” type needs updating.
What you should do
- Apply 11.4.4 now if you’re on the 11.4.x branch. It’s a security-only release; there’s nothing to plan around.
- If you’re still on 11.3.x, plan the 11.4 upgrade — you’re leaving a large performance improvement on the table. Test in staging first, as with any minor version jump.
- Update your provisioning scripts and docs for the install profile change if you spin up fresh Drupal sites from the pattern. Assume nothing about Article, Page, or comments being present.
- Look at the Rector rulesets if you maintain custom modules or multiple Drupal codebases. Now that they’re stable and Composer-installable, a lot of upgrade drudgery becomes automatable.
- Try
./vendor/bin/drif you script against Drupal, but treat it as experimental — it’s not a replacement for your existing tooling yet. - Note the support window. Drupal 11.4.x receives security coverage until June 2027.
Version details in this post come from Drupal’s own release notes and security advisories. If you hit anything upgrading the pattern, open an issue on GitHub.
— FOSSonCloud