Drupal has released patches for two critical vulnerabilities affecting all supported versions of its content management system. The flaws exist in the Field UI module within Drupal core and the Entity List contributed module, both of which could enable remote code execution on affected websites. The Drupal Security Team warned that attackers may develop working exploits within hours or days of the vulnerabilities becoming public, urging administrators to apply updates immediately.
Site administrators are advised to update Drupal core to versions 10.6.19, 11.3.19, or 11.4.10 depending on their release branch, and to update the Entity List module to version 3.0.10. For those unable to upgrade immediately, Drupal recommends uninstalling the Field UI module as a temporary protective measure. The vulnerabilities affect over one million websites that use Drupal, a popular open-source platform especially among government agencies, universities, and non-profit organizations.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
