Drupal.org has announced a highly critical update will be released tomorrow at 9:00 AM PDT.
This is not a Drupal core upgrade, but rather a collection of contributed module patches containing highly critical updates. This update is expected to drive hackers to develop exploits for remote code execution within hours to days. You are urged to check the list of affected modules tomorrow, and apply/test the patch within hours of its release.
We won't know the module list until tomorrow morning, so stay tuned for the list.