CVE-2026-108097

Drupal core critical security update (CVE-2026-108097) https://bit.ly/4sd972c

#NØØT_Security_Alerts 🚨 #ALERT — DRUPAL ENTITY LIST: CRITICAL REMOTE CODE EXECUTION WITH CONDITIONAL UNAUTHENTICATED EXPLOITATION October 14, 2026 DISCLOSED BY: Drupal Security Team PRODUCT: Drupal Entity List contributed module CVE: CVE-2026-108099 SEVERITY: CRITICAL — Drupal risk rating 19/25 ADVISORY: SA-CONTRIB-2026-218 AFFECTED VERSIONS: Entity List releases before 3.0.10. IMPACT: A vulnerability in the Entity List module can enable remote code execution when exposed through exploitable integrations. EXPOSURE: The Entity List module alone is NOT directly exploitable. Additional contributed modules or custom application code must expose the vulnerable functionality. Drupal confirms multiple serious exploit paths, including at least one requiring no authentication. This is a distinct vulnerability from Drupal core CVE-2026-108097, although the disclosures describe similar exploitation prerequisites. EXPLOITATION STATUS: VENDOR-CONFIRMED CRITICAL RCE. No verified malicious in-the-wild exploitation or independently confirmed public working exploit established. Forensic triage: Identify installations running vulnerable Entity List releases. Review integrations with contributed modules and custom code. Investigate unusual requests, unexpected PHP execution, unauthorized application changes and suspicious server-side processes. No confirmed CVE-specific malicious IOCs published. URGENT ACTION: Upgrade Entity List to version 3.0.10 or later. Review integrations exposing Entity List functionality to untrusted users. Disable vulnerable functionality where immediate remediation is unavailable. Verify that deployment artifacts contain the corrected module version. SOURCE: https://www.drupal.org/sa-contrib-2026-218 CONFIDENCE: HIGH — Official Drupal Security Team advisory confirms the vulnerability, affected versions, conditional exploitation and security fix. Successful exploitation in the wild: NOT ESTABLISHED. #CyberSecurity #ThreatIntel #Drupal #RCE #PHP #WebSecurity

#NØØT_Security_Alerts 🚨 #ALERT — DRUPAL CORE: CRITICAL REMOTE CODE EXECUTION WITH A POTENTIAL UNAUTHENTICATED ATTACK PATH October 14, 2026 DISCLOSED BY: Drupal Security Team PRODUCT: Drupal Core — Field UI module CVE: CVE-2026-108097 SEVERITY: CRITICAL — Drupal risk rating 19/25 ADVISORY: SA-CORE-2026-014 AFFECTED VERSIONS: Drupal 10 before 10.6.19. Drupal 11.3 before 11.3.19. Drupal 11.4 before 11.4.10. Drupal 12.0.0 prereleases before beta2. Earlier unsupported branches may also be vulnerable. IMPACT: Remote code execution through vulnerable Field UI functionality. EXPOSURE: Drupal core alone is NOT sufficient for exploitation. Additional contributed modules or custom code are required to expose vulnerable execution paths. Drupal confirms multiple serious exploit paths, including at least one that does not require authentication. EXPLOITATION STATUS: VENDOR-CONFIRMED CRITICAL RCE. No confirmed malicious in-the-wild exploitation established. The vendor’s risk assessment identifies theoretical exploitability, not verified active compromise. Forensic triage: Inventory installations with Field UI enabled. Review suspicious application requests, unexplained PHP execution, unexpected file modifications and unauthorized administrative changes. No confirmed CVE-specific attacker IOCs published. URGENT ACTION: Update immediately: Drupal 10.6 → 10.6.19. Drupal 11.3 → 11.3.19. Drupal 11.4 → 11.4.10. If immediate patching is impossible, uninstall the Field UI module (field_ui). Drupal Steward provides partial protection but does NOT replace patching. SOURCE: https://www.drupal.org/sa-core-2026-014 CONFIDENCE: HIGH — Official Drupal Security Team advisory confirms the vulnerability, conditional attack paths, affected versions and remediation. Active exploitation: NOT VERIFIED. #CyberSecurity #ThreatIntel #Drupal #RCE #WebSecurity #VulnerabilityManagement