Some security bugs are flashy zero-days with logos and theme songs. This one has been quietly sitting in a table-rendering callback since roughly 2020, waiting for someone to notice it could run code it really, really shouldn't. Drupal's Security Team noticed first, and now it's your turn to hit "update."
A Six-Year-Old Callback Finally Gets Grounded
On October 14, Drupal shipped fixes for SA-CORE-2026-014 (CVE-2026-108097), a remote code execution flaw in core's Field UI module that the project rated 19 out of 25 — firmly "critical." Patched releases are Drupal 11.4.10, 11.3.19 and 10.6.19, with 12.0.0-beta2 also fixed for the brave souls testing the next major. According to The Hacker News, core alone can't reach the bug, but several contributed-module paths can, and at least one of them needs no login at all.
The root cause: Field UI's table element passed each row's #region_callback straight into call_user_func_array without validation. The fix stops trusting that callback and reads the region from the row's own value instead. The contributed Entity List module had the same problem and gets its own critical fix in 3.0.10 — and no, updating core does not update that module for you.
28.5% of Sites Are Still on Expired Branches
Here's the uncomfortable number: in the week starting October 4, about 151,000 of roughly 531,000 reporting Drupal sites — 28.5% — were running branches that won't receive this fix at all. That includes Drupal 11.2.x and below, 10.5.x and below, and the Drupal 8 and 9 holdouts who've been "planning to upgrade next quarter" for several quarters now. As of October 15, no public exploit or attacks had been reported, but the Security Team's own pre-announcement warned exploits "might be developed within hours or days." In May, a core SQL injection flaw saw exploit attempts within two days of its advisory, so history isn't on the side of procrastinators.
The angle people miss: this is a contrib-module story wearing a core-module costume. Your exposure depends on which modules and custom code you run, so "we're on core, we're fine" isn't an audit. If you can't patch immediately, uninstalling field_ui is a valid stopgap (you'll lose the Manage Fields and Manage Display screens meanwhile), and hosts running Drupal Steward WAF rules block some vectors. Also, if your custom code set #region_callback on field_ui_table rows, that callback stops running after the update, so test those admin screens. Two moderately critical XSS fixes landed alongside it too, for the Link and Navigation modules.
Patch core, patch Entity List if you use it, and finally retire that 10.5 site you swore was "temporary." Future you is already grateful.
This is exactly why we treat every contributed module as part of the supply chain, not a free add-on — grab our free developer security checklist for defending against supply-chain attacks and audit what your Drupal site actually depends on.
Source: The Hacker News