#NØØT_Security_Alerts 🚨 #ALERT — DRUPAL ENTITY LIST: CRITICAL REMOTE CODE EXECUTION WITH CONDITIONAL UNAUTHENTICATED EXPLOITATION October 14, 2026 DISCLOSED BY: Drupal Security Team PRODUCT: Drupal Entity List contributed module CVE: CVE-2026-108099 SEVERITY: CRITICAL — Drupal risk rating 19/25 ADVISORY: SA-CONTRIB-2026-218 AFFECTED VERSIONS: Entity List releases before 3.0.10. IMPACT: A vulnerability in the Entity List module can enable remote code execution when exposed through exploitable integrations. EXPOSURE: The Entity List module alone is NOT directly exploitable. Additional contributed modules or custom application code must expose the vulnerable functionality. Drupal confirms multiple serious exploit paths, including at least one requiring no authentication. This is a distinct vulnerability from Drupal core CVE-2026-108097, although the disclosures describe similar exploitation prerequisites. EXPLOITATION STATUS: VENDOR-CONFIRMED CRITICAL RCE. No verified malicious in-the-wild exploitation or independently confirmed public working exploit established. Forensic triage: Identify installations running vulnerable Entity List releases. Review integrations with contributed modules and custom code. Investigate unusual requests, unexpected PHP execution, unauthorized application changes and suspicious server-side processes. No confirmed CVE-specific malicious IOCs published. URGENT ACTION: Upgrade Entity List to version 3.0.10 or later. Review integrations exposing Entity List functionality to untrusted users. Disable vulnerable functionality where immediate remediation is unavailable. Verify that deployment artifacts contain the corrected module version. SOURCE: https://www.drupal.org/sa-contrib-2026-218 CONFIDENCE: HIGH — Official Drupal Security Team advisory confirms the vulnerability, affected versions, conditional exploitation and security fix. Successful exploitation in the wild: NOT ESTABLISHED. #CyberSecurity #ThreatIntel #Drupal #RCE #PHP #WebSecurity