Emerging Threats

Drupal Patches Code Flaws, Warns of Imminent Exploits

Analyst 207||Source: BleepingComputer
Modern computer science building on a bright campus with abstract foreground elements.

"The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days,” the project's security team warned.

The flaws: CVE-2026-108097 and CVE-2026-108099

Drupal disclosed two critical remote code execution (RCE) vulnerabilities that affect all currently supported versions of Drupal core. The project identified them as CVE-2026-108097 and CVE-2026-108099. CVE-2026-108097 is located in Drupal core’s Field UI module and could allow attackers to execute arbitrary code on affected servers. CVE-2026-108099 is a flaw in the contributed Entity List module, which can also enable remote code execution.

How the vulnerabilities can be reached: contributed modules and custom code

Drupal’s advisory makes clear these flaws are not limited to a single simple exploit path. Both CVEs require interaction with contributed modules or custom code to expose the vulnerable behavior; in each case, the project says there is at least one known exploitation path that does not require authentication. In short, even if a site’s Drupal core is present, additional modules or bespoke site code can provide the routes attackers need.

Patch and mitigation guidance from Drupal

Administrators are urged to apply the available fixes promptly. Drupal published fixed core releases and specific module updates: update Drupal core to 10.6.19, 11.3.19, or 11.4.10 depending on your release branch, and update the Entity List contributed module to 3.0.10. For environments that cannot immediately upgrade, Drupal recommends uninstalling the core Field UI module (field_ui) as an effective mitigation measure.

The project also noted that Drupal Steward — a managed update service — protects against some known attack vectors but does not cover every possible exploit. Because multiple exploitation paths exist, and some require no authentication, Drupal emphasized urgency: “We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before October 14, so that you can address any other upgrade issues before the security window.”

Scope: who runs Drupal and where these risks matter

Drupal is a free, open-source content management system used to build and manage websites and is particularly popular among government agencies, universities, and non-profit organizations. According to the project’s website, more than one million websites run on Drupal. The advisory also notes that Drupal 12 pre-releases before beta2 are impacted, though those pre-release versions are not intended for production; the final stable 12.0 release will include fixes for both flaws.

Drupal warned that “all versions of Drupal prior to 10.6.x, as well as all versions of Drupal 11 prior to 11.3.x, are end-of-life and no longer supported,” underscoring that only the specified patched branches will receive remediation.

What this means for government agencies, universities, and non-profit organizations

  • Government agencies: Sites running supported Drupal releases should prioritize the listed core updates or uninstall field_ui if upgrades cannot be completed immediately, because public-facing government websites are high-value targets and contributed modules can open unauthenticated exploit paths.
  • Universities: Campus sites often run a mix of contributed modules and custom code; institutions must inventory instances of Entity List and other contributed modules and apply the Entity List 3.0.10 update or remove the module pending a patch.
  • Non-profit organizations: With many non-profits relying on hosted or volunteer-maintained Drupal instances, administrators should confirm whether their Drupal branch is still supported and follow the project’s guidance on upgrades and mitigations to avoid being exposed to rapidly developed exploits.

Context on prevention and the pace of exploitation

Drupal’s advance warning stressed the speed with which attackers can weaponize disclosed flaws: “exploits might be developed within hours or days.” The advisory cautioned that prevention metrics can be misleading: once attackers obtain valid credentials, prevention effectiveness drops sharply. Related industry reporting cited in the source points to a broad measurement effort — the Blue Report 2026 — which measures defenses technique-by-technique across 338 million simulations run in customer production environments, illustrating how post-compromise behavior often undermines initial prevention.

Drupal administrators and site owners face a narrow, concrete choice: apply the specified core and contributed-module updates now, remove the Field UI module where upgrades are impossible, or accept that an unauthenticated exploitation path may be available to attackers. The project's explicit calendar guidance — update before October 14 to leave time for addressing upgrade issues before the security window — makes urgency the clearest operational takeaway.

Original reporting: https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/

Emerging ThreatsPatch ManagementRemote Code ExecutionVulnerability ManagementWeb Application SecurityRCECVE-2026-108097Drupal SecurityCVE-2026-108099
Related Intelligence

Continue Reading

Workspace with laptop, papers, and networking equipment near a window.

ConnectWise Supply-Chain Attack Targets Microsoft 365 Tenants

A recent supply-chain attack on ConnectWise's Cloud Backup service has compromised at least 162 Microsoft 365 tenants, prompting urgent concerns for managed service providers and administrators. The attackers were traced to a single IP address, with Microsoft confirming malicious activity and unauthorized authentication attempts.

Analyst 207
Dimly lit workspace with a Windows console on a desk, surrounded by papers and coffee cups, with a laptop in the background…

MALFEX Campaign Unveils imgdecode npm Package with Shellcode Loader

Meet the sneaky imgdecode npm package, which hides a malicious loader in its code, and has already been downloaded 979 times. This package secretly downloads and injects encrypted shellcode into a new process, making it a serious threat to Windows users.

Analyst 207
Grocery store refrigeration units with malfunctioning equipment and exposed wiring.

Ransomware Attacks Target Physical Building Systems

Imagine walking into your local grocery store on Monday morning to find chaos: spoiled food, melted ice cream, and fires sparked by a mysterious cyberattack that hit thousands of remote-controlled refrigeration systems overnight. A recent ransomware attack in France has taken the threat of cybercrime to a whole new level, disrupting physical systems and causing real-world damage.

Analyst 207
A workstation with a laptop on a desk and network equipment in the background.

Hackers Exploit Compromised Credential to Breach 173 Microsoft 365 Tenants

Security researchers have uncovered a disturbing breach: hackers exploited a stolen Microsoft 365 credential to infiltrate 173 tenant accounts of ConnectWise Cloud Backup, gaining broad access to sensitive data. The attackers used the compromised credential to obtain Microsoft Graph tokens, allowing them to snoop on mailboxes, OneDrive, SharePoint, Teams, and directory data.

Analyst 207