Drupal patches critical code execution flaws and warns exploits may come soon

[Always_Brett36]

Drupal has released fixes for two critical remote code execution flaws and is warning site owners to patch quickly. BleepingComputer's Bill Toulas reports that one bug is in the core Field UI module and the other in the contributed Entity List module. Drupal runs on more than a million websites

Both flaws need certain contributed modules or custom code to be exploitable, but at least one known attack path requires no authentication at all. Drupal's advance warning said all supported core versions were affected and that exploits might be developed within hours or days of the fix

The patched versions are core 10.6.19, 11.3.19 and 11.4.10, along with Entity List 3.0.10. Pre-release versions of Drupal 12 before beta 2 are also affected. Sites that cannot upgrade straight away can uninstall the Field UI module as a temporary measure

Drupal's paid Steward service blocks only some of the attack routes, so it is not a substitute for patching. Drupal deserves credit for giving advance notice, which let administrators plan the update rather than scramble

Content management systems are always popular targets because so many sites run them. A remote code execution bug without authentication is about as serious as it gets. With the Magento and Collabora flaws we discussed this week, it has been a busy time for web admins

How quickly do you patch content management systems? And are advance security warnings like this helpful?

Drupal patches critical RCE flaws, warns exploits may emerge soonwww.bleepingcomputer.com

[Sharon_77]

It has been a rough week for web software. Magento, Collabora and now Drupal. Attackers clearly have plenty of options