Drupal patches critical remote code execution vulnerabilities in core and module

Drupal released updates on October 17, 2026, to fix two critical remote code execution vulnerabilities that affect all supported versions of its content management system, BleepingComputer reported. The flaws allow remote attackers to execute arbitrary code on vulnerable websites. [1]

According to BleepingComputer, the security issues reside in the software core Field UI module and the contributed Entity List module. The Drupal Security Team issued an advance warning earlier in the week, urging system administrators to apply the updates quickly because attackers could create functional exploits shortly after public disclosure. [1]

Drupal is an open-source web content management framework written in PHP. Belgian developer Dries Buytaert originally created it in 2000 as a university bulletin board before releasing the first official version in January 2001. The platform powers back-end framework operations for at least 14 percent of the top 10,000 websites globally, ranging from personal blogs to government portals. [2][3]

System administrators are urged to schedule time immediately for core updates to protect sites against potential incoming exploitation attempts, BleepingComputer reported. [1]