GoKawiilDrupal patches two critical RCE bugs in Field UI and Entity List modules
Drupal has released fixes for two critical remote-code-execution vulnerabilities, CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module, affecting all currently supported versions of the CMS. The project's security team urged administrators to update before October 14, warning that attackers could build exploits within hours or days of disclosure. Exploitation of either flaw generally requires interaction with contributed modules or custom code rather than core alone.