Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules
Drupal shipped fixes on October 14 in versions 11.4.10, 11.3.19, and 10.6.19 for a critical Field UI flaw, CVE-2026-108097, rated 19 out of 25 on Drupal's risk scale, which cannot be reached through core alone but has exploit paths through contributed...