[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPZU6_3xPB7mGuTPcdIA_t8T5lpNISBRz-IwDiyaIuCo":3},{"article":4,"iocs":43,"watch_terms":51,"solutions":52,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"acfb9890-5cbd-444b-941d-48924b00c10d","Drupal patches critical RCE flaws, warns exploits may emerge soon","drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon-978985","Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. [...]","Drupal has released patches for two critical remote code execution (RCE) vulnerabilities affecting its core Field UI module and the contributed Entity List module. The vulnerabilities impact all supported versions of the content management system, and the Drupal Security Team has warned that exploits could emerge within hours or days of disclosure. Administrators are urged to update immediately to secure versions or, as a mitigation, uninstall the Field UI module if an upgrade is not possible.","Drupal patches two critical RCE vulnerabilities in Field UI and Entity List modules.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fdrupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F15\u002FDrupal.jpg","2026-10-17T14:32:48+00:00","2026-10-17T16:00:11.711554+00:00",9,[17,20,23],{"name":18,"type":19},"Drupal","product",{"name":21,"type":22},"Field UI module","technology",{"name":24,"type":22},"Entity List module","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,33,38],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44,48],{"type":45,"value":46,"context":47},"cve","CVE-2026-108097","RCE vulnerability in Drupal core's Field UI module.",{"type":45,"value":49,"context":50},"CVE-2026-108099","RCE flaw in the contributed Entity List module.",[18],{"controls":53,"vendors":136},[54,83,108],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":84,"name":85,"problem":86,"products":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",[88,92,100],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":84,"product_name":89,"url":90,"description":91},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":42,"name":109,"problem":110,"products":111},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":151},"critical-drupal-rce-flaws-demand-immediate-patching","Critical Drupal RCE Flaws Demand Immediate Patching","Two critical remote code execution vulnerabilities in Drupal's core Field UI module and the contributed Entity List module expose all supported versions of the CMS to potential full system compromise. The Drupal Security Team's warning that exploits could appear within hours of disclosure underscores the narrow window administrators have to act before threat actors weaponize the findings. Unpatched CMS platforms are a high-value target because they often host public-facing websites with access to sensitive data and backend systems. Delayed patching in this context is not a calculated risk — it is an open invitation to attackers who actively monitor vulnerability disclosures.",[142,143,144,145,146,147,148,149,150],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","NIST CM-6: Configuration Settings","OWASP A06:2021 – Vulnerable and Outdated Components","ITIL Change Management: Emergency Change Procedure","GDPR Article 32: Security of Processing (technical measures to ensure ongoing integrity)",{"NIST SI-2: Flaw Remediation":152,"NIST CM-6: Configuration Settings":153,"CIS Control 7: Continuous Vulnerability Management":154,"ITIL Change Management: Emergency Change Procedure":155,"OWASP A06:2021 – Vulnerable and Outdated Components":156,"CIS Control 2: Inventory and Control of Software Assets":157,"NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning":158,"GDPR Article 32: Security of Processing (technical measures to ensure ongoing integrity)":159},"Requires timely remediation of the Drupal flaws.","Secure configuration, such as disabling unneeded modules, reduces exposure.","Fast patching of Drupal closes the RCE flaws before exploits appear within hours.","Emergency change procedures help patch Drupal quickly.","Describes the risk of running outdated components like unpatched Drupal.","An inventory of Drupal sites and modules shows which are affected.","Patch planning should allow emergency updates for Drupal.","Requires appropriate security, including prompt patching of websites."]