And if the codebase is on PHP 5.x, then depending upon what modules and custom code you have, the security fix might break some things. There's a bugfix patch

And if the codebase is on PHP 5.x, then depending upon what modules and custom code you have, the security fix might break some things. There's a bugfix patch to the security patch at: https://www.drupal.org/files/issues/2018-03-29/SA-CORE-2018-002-bugfix1.patch https://www.drupal.org/files/issues/2018-03-29/SA-CORE-2018-... That's the D6 version, but same concept would apply to other versions.