Drupal - GoKawiil

Drupal patches two critical RCE bugs in Field UI and Entity List modules

Drupal has released fixes for two critical remote-code-execution vulnerabilities, CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module, affecting all currently supported versions of the CMS. The project's security team urged administrators to update before October 14, warning that attackers could build exploits within hours or days of disclosure. Exploitation of either flaw generally requires interaction with contributed modules or custom code rather than core alone.

bleepingcomputer.com · 2026-10-17

Germany commits €108M to PHP-based Government Site Builder for federal websites

Germany has budgeted €108 million over four years to fund the eleventh version of its Government Site Builder, a PHP-based content management system already used by more than 80 federal agencies to run over 250 websites. The spending splits into €26.88 million for development, €73.2 million for migration and relaunch, and €8 million for operations. The author contrasts this with the roughly $730,000 the PHP Foundation received in total contributions in 2025.

thephp.foundation · 2026-09-02