Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system.
Drupal patches critical RCE flaws, warns exploits may emerge soon
About this summary. This is a short excerpt from the description that BleepingComputer published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/
Source attribution: headline and facts are from BleepingComputer (bleepingcomputer.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw
Critical flaws impact the Entity List and Field UI modules, and exploit paths exist with contributed modules.
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10…
AhsayCBS Deep-Dive: Auth Bypass to RCE
On 8 August 2026, Huntress released a report detailing the in-the-wild exploitation of AhsayCBS, an on-premises backup server application. The report described two…
Zammad Zero-Days Exploited in AI-Powered DIVD Hack
The flaws were chained to hijack sessions, achieve remote code execution, and elevate privileges to root.
Hackers Start Probing Fresh Oracle EBS Vulnerability
CVE-2026-101767 is an unauthenticated SQL injection that can be exploited for remote code execution.
CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit.