Drupal patches critical Field UI RCE reachable via modules
Drupal core flaw CVE-2026-108097 (SA-CORE-2026-014, 19/25) runs arbitrary PHP via an unchecked #region_callback in Field UI; contributed modules expose an unauthenticated RCE path.
Stories tagged: #drupal
Drupal patches highly critical SQL injection (CVE-2026-9082) — exploited in the wild within 48h
An unauthenticated SQL injection in Drupal core's database abstraction API affects every PostgreSQL-backed site. Drupal scored it 23/25. Attacks started two days after the patch dropped.