← Tuesday 20 Octobernote 9 of 13
CybersecurityTue 20 Oct 2026 · 9 of 13

Drupal issues patches for critical RCE flaws in Entity List and Field UI modules

Verified · 6/6 supported1 cited · 1 min read

securityweek.com reports that Drupal has released patches for five vulnerabilities, including two critical remote code execution bugs . securityweek.com reports that the first critical RCE bug (CVE-2026-108099) resides in the Entity List module and can be exploited via other contributed modules, with at least one unauthenticated exploit path . securityweek.com reports that the second critical RCE bug (CVE-2026-108097) affects the core Field UI module, also requiring contributed modules for exploitation, and that uninstalling the core Field UI module is a mitigation . securityweek.com reports that users should update to Entity List version 3.0.10 and to Drupal versions 11.4.10, 11.3.19, or 10.6.19, noting that older releases have reached end‑of‑life and no longer receive security updates . securityweek.com reports that the updates also fix cross‑site scripting issues in the core Link module (CVE-2026-108515) and the Navigation module (CVE-2026-108514) .

Why it matters. securityweek.com reports that applying the patches is essential to prevent unauthenticated exploitation of the RCE flaws, protecting Drupal sites that rely on the affected modules .

Earlier on Cybersecurity

Sun 18 Oct 2026Israeli ad firm Discover-Tech used to deliver Candiru spyware in "AdFection" campaignsecurityweek.com reports that Israeli advertising company Discover-Tech was used to deliver Candiru zero‑click spyware through targeted advertisements. securityweek.com reports that the operation delivering the spyware was dubbed “AdFection”. securityweek.com reports that Candiru spyware infected devices at Al Jazeera via these zero‑click ad attacks, according to Citizen Lab. securityweek.com reports that Discover-Tech’s ads allowed threat actors to fingerprint, de‑anonymize, and track millions of devices, with its Controlium platform enabling large‑scale de‑anonymization. securityweek.com reports that the company is likely a front for a broader espionage campaign linking ad vendors with spyware providers.Sat 17 Oct 2026Cyber Incident Cripples Federal Bankruptcy Noticing Center for a Weeksecurityweek.com reports that a cybersecurity incident affecting BAE Systems infrastructure caused an outage of the Bankruptcy Noticing Center (BNC). securityweek.com reports that the BNC, which is operated by BAE Systems as a contractor for the federal judiciary, was unable to generate or send notices for about a week. securityweek.com reports that the Administrative Office of the US Courts said all access to BNC systems and websites was unavailable. securityweek.com reports that the National Creditor Registration Service was offline, preventing users of the courts’ electronic filing system from generating creditor mailing lists. securityweek.com reports that BAE first notified the Administrative Office about the problem late on October 9, and several bankruptcy courts posted notices on October 13 describing the issue as a service disruption.Sat 17 Oct 2026UBC researchers detail "ICS‑Sniper" attack on cloud‑hosted SCADA systemssecurityweek.com reports that University of British Columbia researchers detailed a proof‑of‑concept attack called "ICS‑Sniper" targeting industrial facilities that rely on cloud‑hosted SCADA systems. securityweek.com reports that the attack exploits a compromised router to analyze VPN‑encrypted packet size, direction and timing to predict when critical commands or data will be exchanged and then drop payload‑carrying packets. securityweek.com reports that the researchers tested the attack on an emulated version of the SWaT water‑treatment testbed.
Next · CybersecuritySiemens Software Center Vulnerability Exploited in ClickFix Malware Campaign →