The Hot Drop

Oct 23

The Hot Drop for 10-23-2026

PHP2Shell RCE flaws leaked 24 hours early, forcing gov sites offline. Now, BRONZE SANDCASTLE steals AD databases from 8 nations while VoidLink cloud rootkits strike Kubernetes. Finally, Cisco’s 9.8 CVSS Expressway flaw lets unauthenticated attackers run root commands. Is your infrastructure ready?

Since the last show: 4 new · 1 developing · 3 returning · 11 dropped · 5% overlap with the previous show

Contents

  1. PHP patches critical PHP2Shell RCE flaws after pre-disclosure leak
  2. Sophos and Check Point Detail BRONZE SANDCASTLE AD Theft and VoidLink Cloud Malware
  3. Cisco patches critical Expressway RCE flaw (CVE-2026-76466) enabling root command execution
  4. Imperva Demonstrates Node2Shell RCE in Node[.]js Brotli Decoder
  5. eMudhra Revokes Eight CA Certificates After Weak Key Flaw Discovered
  6. Horizon3[.]ai Releases Public PoC for Critical Unauthenticated RCE in Fortinet FortiSIEM
  7. Exposed AI Panels Breach Major Brands While Critical Magento Flaw Remains Unpatched
  8. Drupal patches critical unauthenticated RCE flaws in Field UI and Entity List modules

1. PHP patches critical PHP2Shell RCE flaws after pre-disclosure leak (Lead)

CVE-2026-109618 CVSS increased from 9.2 to 9.8; CVE-2026-109619 CVSS increased from 9.2 to 9.8; Claim “d337fdb72a5e5f8a” now corroborated (was source_specific)

CVE-2026-109618 CVSS increased from 9.2 to 9.8 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. The PHP security team stated that the risk is highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs. Researchers at Wiz, Calif, and OpenAI discovered and reported the PHP2Shell flaws, which affect nearly every PHP version back to PHP 5.4. At least one European government has taken its website offline as a precaution. The exploit attempt originated from an IP address associated with a commercial anonymization network. This detail remains specific to the available reporting: Fixed ea-php packages for versions ea-php52 through ea-php85 have been released to the stable repository. This detail remains specific to the available reporting: The offer follows the php2shell vulnerabilities that forced public websites offline across Europe earlier this week. This detail remains specific to the available reporting: The Suricata signature with SID 9900620 detects a PHP upload progress field with a NUL-framed system payload. Review the affected control or detection surface described in this claim. Confirm the affected product or control state against the available evidence.

Vulnerabilities

  • CVE-2024-4577 — CVSS 9.8 (Critical) · CISA KEV · CWE-78 · PHP Group PHP. In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use “Best-Fit” behavior to replace…
  • CVE-2026-109618 — CVSS 9.8 (Critical) · CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419 · PHP Group PHP. PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request.
  • CVE-2026-109619 — CVSS 9.8 (Critical) · CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419 · PHP Group PHP. PHP has various global state that temporarily points into request memory.
  • CVE-2026-64638 — CVSS 8.9 (High) · CWE-79 · WordPress WordPress. WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
  • CVE-2026-87902 — CVSS 8.1 (High) · CISA KEV · CWE-98 · WordPress WordPress. An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories.
  • CVE-2012-1823 — CVSS 7.5 (High) · CISA KEV · CWE-77 · n/a n/a. sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote…

Techniques

  • AML.T0010.004 Container Registry (Initial Access)
  • AML.T0011.000 Unsafe AI Artifacts (Execution)
  • AML.T0016.002 Generative AI (Resource Development)
  • AML.T0049 Exploit Public-Facing Application (Initial Access)
  • AML.T0050 Command and Scripting Interpreter (Execution)
  • AML.T0054 LLM Jailbreak (Defense Evasion)
  • AML.T0072 Reverse Shell (Command And Control)
  • T1003.002 Security Account Manager (Credential Access)
  • T1003.003 NTDS (Credential Access)
  • T1003.004 LSA Secrets (Credential Access)
  • and 10 more

Named actors and malware

  • Potassium (actor)
  • Cobalt Strike (malware)

Indicators

  • 25 indicators on file

Coverage

Event first seen in a show

What changed

The BRONZE SANDCASTLE group stole Active Directory databases from victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea between August 2025 and August 2026. They used a tool called COFFLoader to hijack legitimate Windows applications like Java, Krita, NVDA, and LINE to execute encrypted payloads. Check Point identified VoidLink, a cloud-native Linux malware framework written in Zig that supports command-and-control channels over HTTP, HTTPS, ICMP, and DNS. The group also deployed BlackLotus, a UEFI firmware rootkit that reportedly was listed for sale on the cybercrime scene for $5,000 earlier this month.

How it works

VoidLink achieves persistence through rootkit-style capabilities including LD_PRELOAD, LKM, and eBPF, allowing the implant to hook into dynamic linkers and kernel modules. BlackLotus bypasses secure boot features to backdoor Windows machines, while the term_pty_v3.o plugin provides an interactive backdoor for remote command execution and file operations. The attack chain leverages container CLI and API abuse to execute malicious commands in containerized environments, facilitating the exfiltration of sensitive data.

What to do

VoidLink uses a Zig-based architecture to target Kubernetes and Docker by abusing container CLI and API calls, enabling T1059.013 execution within isolated environments. This shifts exposure from host-level file systems to cluster orchestration layers, where standard endpoint controls often miss activity. Responders should audit kubectl and dockerd API interactions for unauthorized pod creation or image pulls, specifically looking for anomalous SDK calls that bypass traditional binary execution logs. The framework’s financial theft objective, mapped to T1657, suggests attackers prioritize credential harvesting from cloud providers and Git systems over immediate data destruction. This behavior implies a longer dwell time focused on account compromise rather than rapid encryption. Investigators should prioritize telemetry on credential access patterns in cloud identity providers and version control repositories, treating unusual API token usage as a higher priority signal than generic malware alerts, while acknowledging the uncertainty in specific actor attribution. Implement application control policies to block unauthorized execution of container orchestration commands such as docker exec or kubectl exec from non-standard user contexts. Enforce privileged account management controls to restrict and audit the use of Docker and Kubernetes APIs for executing commands within running containers.

Limits and watch

The specific operational scope of VoidLink’s cloud-native capabilities remains uncertain, as it is a cloud-first implant written in Zig designed to operate in modern infrastructure.

Techniques

  • T1055 Process Injection (Stealth)
  • T1057 Process Discovery (Discovery)
  • T1059.013 Container CLI/API (Execution)
  • T1087.001 Local Account (Discovery)
  • T1136.001 Local Account (Persistence)
  • T1212 Exploitation for Credential Access (Credential Access)
  • T1218.002 Control Panel (Stealth)
  • T1543.002 Systemd Service (Persistence)
  • T1552.003 Shell History (Credential Access)
  • T1552.004 Private Keys (Credential Access)
  • and 3 more

Named actors and malware

  • Cobalt Strike (malware)

Indicators

  • 13 indicators on file

Coverage

3. Cisco patches critical Expressway RCE flaw (CVE-2026-76466) enabling root command execution (Segment)

Event first seen in a show

What changed

Cisco published an advisory on October 21, 2026, addressing a critical vulnerability in the database service feature of Cisco Expressway Series devices. It was reported by Stefan Aleksic of Jane Street and carries a CVSS score of 9.8. The core issue is improper validation of client certificates and persistent cookies when TLS Verify Mode is enabled. The update, which has no available workarounds, fixes the flaw in Expressway-C and Expressway-E devices running vulnerable releases configured in a cluster, with X15.5.20 being the first fixed release for versions prior to X15.5.3. Cisco just patched a critical flaw in Expressway devices that lets attackers run root commands without logging in. The vulnerability stems from issues with persistent cookies, allowing unauthenticated attackers to execute root commands via the database service. Cisco classifies this under CWE-798 and assigns it a CVSS v3.1 base score of 9.8.

How it works

Cisco Expressway X8.11.2 allows unauthenticated remote attackers to execute arbitrary operating system commands as root. The exploit leverages persistent cookies and missing client certificate validation to invoke specific RPC commands. Specifically, the attacker connects to the database service feature to trigger these root-level executions. This bypasses access controls on both virtual and appliance versions.

What to do

A CVSS score of 9.8 means this vulnerability grants full system compromise without requiring prior credentials or user interaction. Cisco has released software updates to address the vulnerability, and there are no workarounds available. Rotate credentials and verify TLS settings on these devices now to close the hard-coded credential gap.

Limits and watch

Cisco attributes the vulnerability to issues with persistent cookies in the database service, classifying it under CWE-798.

Vulnerabilities

  • CVE-2026-76466 — CVSS 9.8 (Critical) · CWE-798 · Cisco Cisco TelePresence Video Communication Server (VCS) Expressway. A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands…

Techniques

  • T1078 Valid Accounts (Stealth)
  • T1210 Exploitation of Remote Services (Lateral Movement)

Indicators

  • 1 indicator on file

Coverage

4. Imperva Demonstrates Node2Shell RCE in Node[.]js Brotli Decoder (Segment)

Event first seen in a show

Imperva Red Team proved you can execute arbitrary code on Node[.]js servers by feeding them specific compressed data. They dubbed this remote code execution flaw Node2Shell, tracked as CVE-2026-111497. Their proof of concept ran malicious code on Node[.]js 24.22.0 for Linux arm64 by pushing crafted data through Express 5 and body-parser middleware. The Node[.]js project disclosed CVE-2026-111497 and released fixes in versions 22.23.4, 24.22.1, and 26.12.1 on October 21, 2026. Vercel and Imperva have already deployed WAF rules to block these inbound attempts. Node[.]js disclosed a high-severity buffer overflow in its bundled Brotli decoder on October 21, 2026, affecting versions 1.0.3 through 1.2.0. Security researchers at Imperva demonstrated that malicious Brotli data can make an application on an official build of Node[.]js run attacker-supplied code. This matters because the flaw affects any application decoding untrusted Brotli data, including the built-in fetch function when processing responses from other servers. If you are running Node[.]js 20.x, you are on end-of-life software and will not receive a fix.

Imperva Red Team labeled this flaw Node2Shell, noting that unauthenticated attackers can corrupt memory or execute code via crafted compressed streams. A remote unauthenticated attacker can exploit an out-of-bounds write to corrupt adjacent memory, potentially executing arbitrary code via a crafted stream. The flaw is an out-of-bounds write in the bundled Brotli decoder that allows untrusted data in HTTP requests or responses to execute arbitrary code within applications. Imperva’s Node2Shell analysis confirms this high-severity flaw affects versions 1.0.3 through 1.2.0, enabling denial of service or arbitrary code execution via crafted compressed streams.

Vercel added rules on October 21 that block the attack in inbound requests, indicating that the exposure window for unpatched Node[.]js instances is currently open. Update Node[.]js 22.x, 24.x, and 26.x lines immediately. Update Google Brotli libraries from versions 1.0.3 through 1.2.0 to 1.0.10, 1.1.1, or 1.2.1 immediately.

No exploitation of the flaw in the wild has been reported as of October 22, so the current risk is based on the demonstrated proof of concept rather than observed active attacks. Check automated static analysis tools for new warnings about out-of-bounds writes in the Brotli decoder, as these tools use data flow analysis to detect the specific weakness class linked to CVE-2026-111497.

Vulnerabilities

  • CVE-2026-111497 — CVSS 9.2 (Critical) · CWE-787, CWE-252 · Google Brotli. A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory…

Coverage

5. eMudhra Revokes Eight CA Certificates After Weak Key Flaw Discovered (Segment)

Event first seen in a show

What changed

On October 17, a researcher reported that eMudhra compromised eight intermediate CA private keys due to a key generation flaw that reduced cryptographic entropy from 384 bits to single or double digits. Mozilla, Google, Apple, and Microsoft moved to block these certificates within hours of the report. Mozilla used its OneCRL system to protect users immediately, while Go released urgent security updates, versions 1.27.3 and 1.26.10, to reject chains containing the compromised keys. Verify that your infrastructure is not relying on the emSign ECC Root CA - G3, which was dropped from Python certifi and Rust webpki-roots bundles. Reportedly, Mozilla and Google confirmed on October 20 that the private keys for eight eMudhra intermediate certificate authority certificates are compromised. Reportedly, eMudhra told Mozilla the breach resulted from an error in a script used to generate those certificates in April 2025.

How it works

Firefox 158.0.1, ESR 153.5.1, and ESR 115.43.1 fix a weakness allowing remote code execution with low access control requirements, resulting in a CVSS 5.4 impact. Go 1.27.3 and 1.26.10 patch CVE-2026-111943 by rejecting certificate chains containing eight specific keys that previously slipped through the system trust store. This misconfiguration allows an attacker holding the private key of any compromised intermediate CA to impersonate any website or service. This fix closes a narrow window where Go’s crypto/x509 library failed to deny requests from intermediate certificates no longer considered trustworthy on older versions.

What to do

On October 17, 2026, Mozilla blocked compromised eMudhra certificates via OneCRL after distributing the update through RemoteSettings, a change that ensures client-side blocking even if RemoteSettings is disabled. Adversaries may search for private key certificate files in common directories like ~/.ssh or C:\Users(username).ssh to steal credentials for authentication or decrypt files, a behavior that is now amplified by the availability of these compromised eMudhra keys. Since the private keys were compromised due to a generation flaw rather than a breach of a specific system, the most useful observation is whether your code signing or TLS chains still contain the emSign ECC Root CA - G3, as this condition allows attackers to forge authentication certificates for legitimate websites. The remaining uncertainty is whether your organization has already updated its trust stores to reject the eight revoked certificates, so the specific watch item is to audit your certificate inventory for any lingering references to the emSign ECC Root CA - G3 before the next security cycle. Go’s decision to release urgent security updates on its URGENT track signals that the vendor views this as a threat to the ecosystem’s integrity or a flaw potentially being exploited in the wild. Verify Firefox versions against the affected list and confirm OneCRL updates are applied regardless of RemoteSettings availability to close the gap. Ensure Go applications are updated to versions 1.27.3 or 1.26.10 to reject certificate chains containing the compromised keys, as these releases were issued on the urgent track. Verify the Go runtime matches version 1.27.3 or 1.26.10 to ensure the denylist logic is active against these eight compromised keys.

Limits and watch

The scope of potential misuse is limited because no malicious certificate chaining was logged to Certificate Transparency prior to the blocks, but the compromise of the private keys themselves is attributed to the vendor’s response. Watch for suspicious access to private key files with extensions like .key, .pem, or .p12 in user profile paths or system certificate stores, as adversaries may search for these to impersonate services. Watch for execution of binaries signed with unusual or recently issued code signing certificates, as adversaries may use stolen code signing materials to bypass security policies.

Vulnerabilities

  • CVE-2026-113470 — CVSS 5.4 (Medium) · Mozilla Firefox. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day.
  • CVE-2026-111943 — CVSS 0 (Low) · Go standard library crypto/x509. On most platforms, Go uses the given system root certificates.

Techniques

  • T1552.004 Private Keys (Credential Access)
  • T1553.002 Code Signing (Defense Impairment)
  • T1649 Steal or Forge Authentication Certificates (Credential Access)

Indicators

  • 8 indicators on file

Coverage

6. Horizon3[.]ai Releases Public PoC for Critical Unauthenticated RCE in Fortinet FortiSIEM (Segment)

No material change since last show

Horizon3[.]ai released a public proof-of-concept exploit for CVE-2026-106173, a critical unauthenticated remote code execution vulnerability in Fortinet FortiSIEM. Fortinet issued advisory FG-IR-26-180 on October 13, 2026, recommending upgrades to version 7.5.1 or later to address the flaw. If you are on 7.5.0 or earlier, patch now. The phQueryMaster service is bound to TCP port 27918 and stands up the gRPC server that processes the exploit. The FortiSIEM gRPC QueryResultReq handler processes untrusted metadata without proper path validation, confirming the attack vector. Watch for unexpected modifications to the redishb[.]sh file or anomalous outbound traffic from the gRPC service.

An unauthenticated attacker abuses a gRPC service to write arbitrary files, bypassing directory restrictions through path traversal. This abuse enables unauthorized code execution via crafted packets. The attack turns these file writes into remote code execution by overwriting the Redis service health check script. Execution is blind, taking up to sixty seconds for the cron job to trigger the overwritten script. Fortinet confirmed FortiSIEM 7.6 is unaffected, limiting the flaw to versions 7.0.0 through 7.5.0. This network-accessible path traversal issue carries a CVSS score of 9.4, requiring no user interaction or prior authentication. Attackers can craft dot-dot-slash requests to bypass gRPC input validation, overwriting critical binaries and executable scripts without credentials. The vulnerability poses a severe risk to system integrity by allowing remote attackers to overwrite critical system files. The issue affects the gRPC communication service, enabling unauthorized code execution. Attackers need only network access to exploit this weakness. Fortinet stated that FortiSIEM 7.6 is not affected. This flaw enables full compromise of the SIEM infrastructure. This path traversal issue affects FortiSIEM versions 7.0.0 through 7.5.0.

Fortinet confirmed that version 7.6 is not affected, narrowing the exposure to systems running 7.5.0 or earlier. Upgrade FortiSIEM instances to version 7.5.1 or later to close the path traversal vulnerability in the gRPC service. Operators must immediately validate all gRPC path inputs against a strict allowlist to neutralize the high-severity remote code execution risk. Reject any request containing dot-dot-slash sequences or suspicious URL encoding. Run automated static analysis on the FortiSIEM codebase to identify other path traversal weaknesses, tuning results to filter out administrator-only valid behaviors. Reject non-conforming paths immediately, as static analysis alone may miss administrator-only exploitable issues.

The exploit execution is blind, so the attacker gets no immediate feedback, and a cron job delay of up to 60 seconds complicates real-time detection. Monitor for suspicious URLs in traffic filtering logs where invalid or denylisted characters remain after the first decoding process, indicating a potential bypass attempt. Watch for the gRPC service on port 27918 spawning shell processes or loading non-standard binaries following abnormal request patterns to the public endpoint.

Vulnerabilities

  • CVE-2026-106173 — CVSS 9.4 (Critical) · CWE-22 · Fortinet FortiSIEM. A improper limitation of a pathname to a restricted directory (‘path traversal’) vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.

Techniques

  • T1053.005 Scheduled Task (Execution)
  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1203 Exploitation for Client Execution (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)

Indicators

  • 7 indicators on file

Coverage

7. Exposed AI Panels Breach Major Brands While Critical Magento Flaw Remains Unpatched (Segment)

No material change since last show

What changed

Snorre Fagerland at NorForge identified unprotected interfaces that allowed automated agents to compromise more than one hundred organizations, including Deere, SharkNinja, and Cummins. Meanwhile, Sansec and BleepingComputer are warning about BlockStrap, a critical remote code execution flaw in Magento and Adobe Commerce. Adobe published security advisory APSB26-153 on October 13 to address the BlockStrap vulnerability, which Sansec reproduced through four distinct attack routes within 24 hours of the patch release. Sansec reports that a plain Composer install is insufficient to mitigate the risk, requiring administrators to apply the 2026-oct release or Adobe’s isolated patch. Adobe Commerce and Magento Open Source face a maximum-severity flaw allowing arbitrary PHP code execution without user interaction. Adobe’s October 13 bulletin confirms the flaw as an improper neutralization of special elements in the template engine that leads to arbitrary code execution. Adobe Commerce and Magento Open Source also face a stored XSS flaw, rated 9.3, affecting versions through 2.4.10-alpha1.

How it works

A worker directory now holds a proof-of-concept for StyleSmuggler, CVE-2026-75650, a critical Magento flaw. The BlockStrap flaw lets unauthenticated attackers run arbitrary PHP code by injecting malicious directives into the email template engine. Attackers inject scripts into form fields that execute in victims’ browsers to steal session control. Sansec notes that while no live exploitation has occurred, the low complexity allows AI agents to rapidly develop exploits. The vulnerability affects September versions of Adobe Commerce and Magento Open Source through 2.4.9, Adobe Commerce B2B through 1.5.3, and Mage-OS versions up to 3.5.0. With a CVSS score of ten, this Improper Neutralization weakness compromises the entire server, granting full control over victim accounts and sessions. Mage-OS version 3.6.0 contains the fix for this critical exposure.

What to do

This severity-10 weakness lets an attacker execute unauthorized PHP commands directly, bypassing standard authentication controls to seize full account or session control. This specific flaw allows unauthenticated remote access, distinguishing it from the other two CVEs in this event. Because the attack requires no user interaction and changes scope, it threatens full control over victim accounts and sessions across affected versions. With a CVSS score of ten and no privilege requirements, this distinct threat vector exposes store servers to full compromise, differing from the other two CVEs in this event set. Mage-OS versions up to 3.5.0 remain exposed to this template engine flaw, creating a critical window for exploitation before administrators apply the specific 3.6.0 fix or Adobe’s isolated patch. Apply the architecture and design mitigation by enabling the template engine’s sandbox mode immediately. Recompile affected codebases using the template engine’s sandbox mode to restrict function calls and prevent unauthorized code execution. Ensure the September VULN-39341 hotfix remains in place alongside the BlockStrap fix, since Sansec cautions that these are separate vulnerabilities requiring distinct remediation steps.

Limits and watch

Attacks leveraging BlockStrap have not yet been observed, but threat actors are expected to find a way to exploit it, leaving the specific data exfiltration impact unknown. The average success rate for observed AI-driven intrusion campaigns is hovering around ten percent, which may not reflect the urgency of this specific manual exploitation vector. Run automated static analysis on template engine code to identify data flow patterns that connect input sources to sinks, a method that can detect improper neutralization weaknesses without execution.

Vulnerabilities

  • CVE-2026-103849 — CVSS 10 (Critical) · CWE-1336 · Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source. Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining…
  • CVE-2026-75650 — CVSS 10 (Critical) · CISA KEV · CWE-1336 · Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source. Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user.
  • CVE-2026-91013 — CVSS 9.3 (Critical) · CWE-79 · Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source. Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields.

Techniques

  • AML.T0112 Machine Compromise (Impact)
  • T1203 Exploitation for Client Execution (Execution)
  • T1218.002 Control Panel (Stealth)
  • T1505.003 Web Shell (Persistence)
  • T1593.002 Search Engines (Reconnaissance)
  • T1657 Financial Theft (Impact)

Indicators

  • 3 indicators on file

Coverage

8. Drupal patches critical unauthenticated RCE flaws in Field UI and Entity List modules (Segment)

No material change since last show

What changed

Drupal released security updates for versions 10.6.19, 11.3.19, and 11.4.10 to fix a critical remote code execution flaw in the Field UI module. The advisory also covers a backported fix for Drupal 7 LTS, addressing a flaw that lets unauthenticated attackers compromise sites when specific contributed modules are present. Reports confirm the affected versions include Drupal 8.9.0 to before 10.6.19, 11.0.0 to before 11.3.19, and 11.4.0 to before 11.4.10. The mechanism involves Field UI overview tables no longer calling the region callback function set on a table row. The fix changes how Field UI overview tables assign rows to regions. Drupal core alone is not directly exploitable, but the security team confirmed that several serious attack paths exist when contributed modules are present.

How it works

Possibly, today, the Field UI module in affected systems was compromised by CVE-2026-108097, a critical remote code execution flaw that allows attackers to execute arbitrary code without prior authentication. CVE-2026-108099 is a flaw in Entity List, a contributed module for creating entity lists without Views, that could enable remote code execution, affecting sites that use this specific module. The vulnerability stems from a missing input validation in the Field UI component, enabling an attacker to inject malicious payloads directly into the user interface. Possibly, The flaw resides in the contributed module for creating entity lists without Views, allowing an unauthenticated remote actor to inject and execute arbitrary code. The Drupal Security Team warned that exploits might be developed within hours or days of the vulnerabilities’ disclosure, listing the exploit status as theoretical in its risk assessment.

What to do

Possibly, Attackers exploited CVE-2026-108099 in the Entity List module to achieve remote code execution without prior authentication. Sites running Drupal 8.9.0 through 11.4.0 remain exposed to remote code execution via contributed modules, even though Drupal core alone does not provide a direct exploitation path. The theoretical exploit status in Drupal’s risk assessment does not eliminate the need for immediate patching, as several serious attack paths exist when contributed modules are present. Update Drupal core to 10.6.19, 11.3.19, or 11.4.10 and Entity List to 3.0.10 to close remote code execution flaws. If immediate patching is not possible, uninstall the core Field UI module to mitigate the vulnerability while you prepare for the update.

Limits and watch

The exploit status for CVE-2026-108099 remains theoretical, meaning no confirmed attacks have been observed yet. Monitor for browser or office application crashes followed by unexpected child processes like powershell or curl opening network connections, which indicates potential exploitation for client execution. Watch for inbound network access to remote service ports correlating with service instability and suspicious child process creation, signaling potential lateral movement via exploitation of remote services.

Vulnerabilities

  • CVE-2026-108097 — CVSS 0 (Low)
  • CVE-2026-108099 — CVSS 0 (Low)

Techniques

  • T1203 Exploitation for Client Execution (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)

Coverage