October 18, 2026
- Drupal patched two critical RCEs, core's Field UI (CVE-2026-108097) and the contributed Entity List module (CVE-2026-108099), in 10.6.19, 11.3.19, 11.4.10 and Entity List 3.0.10. Neither is reachable through core alone, but several contributed-module paths exist and at least one requires no authentication; the security team warned admins to pre-book the window because "exploits might be developed within hours or days" (BleepingComputer, The Hacker News). · Vulnerabilities & Exploits
in One Backup App's OAuth Grant Opened Hundreds of Microsoft 365 Tenants