Drupal Patches Critical Unauthenticated RCE Vulnerability in Field UI Module
The Drupal security team has issued patches addressing a critical remote code execution vulnerability in the Field UI module. The flaw, identified as CVE-2026-108097, can be triggered under specific combinations of components and allows attackers to execute arbitrary code on affected sites.
While the vulnerability does not affect the Drupal core in isolation, at least one documented attack scenario requires no authentication whatsoever. In such cases, an attacker does not need an administrator password to compromise the system. Exploitation conditions and available fixes are detailed in the official Drupal security bulletin.
The dangerous attack paths emerge primarily when the module is used alongside third-party extensions. Custom site code can also inadvertently expose the vulnerable functionality to remote attackers. The patches are available in Drupal 11.4.10, Drupal 11.3.19, and Drupal 10.6.19.
As a temporary mitigation, developers recommend removing the Field UI module until updates can be applied. The Drupal Steward service blocks some known attack variants but does not address all possible exploitation methods.
Separately, another remote code execution vulnerability tracked as CVE-2026-108099 has been resolved in the Entity List contributed module. The fix requires version 3.0.10, and unauthenticated attack scenarios are also known when combined with other modules.
Before the patches were released, the Drupal team warned that working exploits could appear within hours or days. No reports of ongoing attacks have been included in the security bulletins.
Related articles
Roundcube Webmail Issues Security Updates to Address Multiple Vulnerabilities
The Roundcube Webmail development team released versions 1.7.5 and 1.6.20 on October 19, 2026, to resolve approximately 20 security issues affecting email viewing, authentication, and external content handling. The updates address command injection flaws in IMAP actions that could be triggered via newline characters, as well as header injection vulnerabilities involving sender display names and parameters such as References, In-Reply-To, Message-ID, and From. Additional fixes cover subject lines and data URIs in forwarded attachments, media types in inline images, and bypasses in server-side request forgery filters. The patches also mitigate cross-site request forgery evasion in spam reporting and cross-site scripting issues stemming from password driver error responses. Administrators are urged to apply the updates promptly to prevent exploitation of these weaknesses.
Cybercriminals Exploit Command Injection Vulnerability in SiteGuard WAF Server Edition
EG Secure Solutions has confirmed active exploitation of CVE-2026-106931, a command injection flaw in the statistics processing function of SiteGuard Server Edition. The vulnerability, classified as CWE-78, allows local attackers with low privileges to execute arbitrary system commands as root on Unix systems or SYSTEM on Windows without user interaction. CVSS scores rate the issue at 8.5 under version 4.0 and 7.8 under version 3.0, affecting installations from version 2.20 onward when statistics are enabled by default. Specific version ranges for Apache, Nginx, and IIS editions on FreeBSD and other platforms determine the exact impact, with some IIS versions remaining unaffected. The vendor notified direct support customers on September 29, followed by public advisories from JVN on October 14 and JPCERT/CC. Organizations unable to update can apply a targeted patch or disable the statistics feature, though the patch erases attack traces, requiring prior diagnostic data collection.
Check Point Discloses Two High-Impact Vulnerabilities in LiteLLM AI Gateway Allowing Low-Privilege Users to Steal API Keys
Check Point Research has disclosed two vulnerabilities, CVE-2026-35029 and CVE-2026-59823, in the LiteLLM AI gateway that affect all versions prior to 1.83.9. The flaws enable low-privilege authenticated users to modify gateway configurations, read server files, redirect traffic, and perform SSRF attacks to access internal resources. LiteLLM serves as a unified proxy for over 140 AI providers including OpenAI, Anthropic, and Azure OpenAI, managing API keys, routing, and usage monitoring for enterprises worldwide. The configuration update endpoint lacks role-based access controls, allowing any authenticated user to alter settings and potentially achieve remote code execution. Combined with the SSRF vulnerability, attackers can pivot from low-privilege accounts to compromise internal networks and exfiltrate stored credentials. The project has exceeded 61,000 GitHub stars and recorded over 90 million monthly downloads, making the issues particularly widespread due to its embedding in numerous internal AI platforms. Organizations are advised to upgrade immediately, audit access to management endpoints, rotate all API keys, and scan for hidden LiteLLM instances in requirements files and dependencies.
Gezine Demonstrates Debug Settings Access on PlayStation 5 Firmware 14.10
Security researcher Gezine has published a video showing access to the hidden Debug Settings menu on a retail PlayStation 5 running firmware version 14.10. Sony shipped the 14.00 update on October 1, which closed the previous kernel vulnerability used on 13.xx firmware, yet a new method was demonstrated only 18 days later. The technique is unrelated to the earlier Relapse exploit chain that worked up to version 13.60. Full system control is not achieved, and the previous method for extracting game executables no longer functions on 14.xx builds, likely requiring a separate hypervisor bypass. Gezine has stated that the new exploit details will not be released immediately and that any future disclosure decision will be made later.