Security2 hOctober 19, 2026, 22:47

Drupal warns of fast exploitation risk for critical core RCE flaws

Drupal patched five vulnerabilities, including two critical RCE bugs: CVE-2026-108099 in the Entity List module and CVE-2026-108097 in core Field UI. Fixes ship in Entity List 3.0.10 and Drupal 11.4.10, 11.3.19 and 10.6.19, along with XSS patches for Link, Navigation and the Gin theme.

SecurityWeek

Open source

CVE-2026-108099 in Entity List has an unauthenticated exploit path
CVE-2026-108097 in Field UI can be mitigated by uninstalling the module
Fixes in Drupal 11.4.10, 11.3.19, 10.6.19 and Entity List 3.0.10
Drupal warns exploits may be developed within hours or days

#Drupal

Drupal patches two critical RCE vulnerabilities

Security

Palo Alto Networks warns of exploited PAN-OS RCE flaw

Security

Critical Authenticated RCE in Langflow Hit by 1,423 Honeypot Exploit Attempts

Security

Drupal warns of fast exploitation risk for critical core RCE flaws

Drupal patches two critical RCE vulnerabilities

Palo Alto Networks warns of exploited PAN-OS RCE flaw

Critical Authenticated RCE in Langflow Hit by 1,423 Honeypot Exploit Attempts

CVE-2026-75650: critical RCE in Adobe Commerce and Magento exploited in the wild