Drupal patches critical core RCE flaw in Field UI

Drupal released fixes on October 14 in versions 11.4.10, 11.3.19 and 10.6.19 for a critical flaw in the Field UI module that could let an attacker execute code on a site's server. The flaw is unreachable through core alone, but exploit paths exist via contributed modules, at least one without login.

• Fixes shipped October 14 in Drupal 11.4.10, 11.3.19 and 10.6.19
• Field UI flaw allows remote code execution on the server
• Not reachable through core alone; requires contributed modules
• At least one known exploit path needs no login