Project
Open-source PHP content management system and framework with a dedicated Security Team and a large ecosystem of contributed modules.
Drupal shipped fixes on October 14 for CVE-2026-108097, a critical Field UI remote code execution flaw, in 11.4.10, 11.3.19 and 10.6.19. The Security Team says core alone is not reachable, but contributed modules open several paths and at least one needs no login.
Reality
CERT-BUND has rated 36 CVEs in 16 contributed Drupal projects high risk, and Drupal core is not listed as affected. Each site team has to check the modules it has installed against 19 fixed releases and confirm that the code serving requests actually changed.
Reality
A dev.to comparison scores MCP tool design at 13 website builders and content systems against eight criteria. The two designs it walks through in full both take deletion out of the flat tool list and put it behind its own gate.
Reality
An SC Media Perspectives column reports the run took 51 minutes with one human assist, against a couple of days by hand, and the team had Drupal's pre-announcement to prepare before the clock started.
Reality
Rapid7 describes eleven of the sixteen additions, and eight of those are scanners rather than exploits. The unauthenticated file reads and SQL injections carry the real pressure this quarter, well ahead of the two Tenable modules.
Reality