Most modules hope for a five-star rating. Block AJAX just got a 20 out of 25 from the Drupal Security Team, and on that scale a high score means trouble. If your site uses Layout Builder, now is a good time to put the coffee down and check your composer.json.
One Module, One Very Bad Deserialization
On October 7, 2026, the Drupal Security Team published SA-CONTRIB-2026-192 (CVE-2026-107249) for the contributed Block AJAX module and rated it "Highly critical." The module doesn't properly validate user-supplied data that it uses to build a block. That opens the door to PHP object injection and, potentially, remote code execution.
The risk profile is about as uncomfortable as they get: low access complexity, no authentication required, and the possibility that all non-public data could be read, changed, or deleted. Sites with Layout Builder enabled, or another block plugin that handles the supplied data unsafely, are affected. The fix is Block AJAX 3.0.2. The release notes warn of potentially breaking changes, so read them before you push to production.
Patch Wednesday Came With Friends
Block AJAX didn't arrive alone. The same October 7 release included more than two dozen contributed-project advisories, among them a critical access bypass in Restrict route by IP, information disclosure in Permissions by Term and Freelinking, and a CSRF flaw in Advanced Filesystem. Just two weeks earlier, Webform, one of the most widely installed modules in the ecosystem, got its own remote code execution advisory. Busy month for anyone tending a Drupal site.
Here's the part that's easy to miss. Exploitation is currently listed as "theoretical," and that label tends to sell people a false sense of calm. Attackers have gotten very quick at turning published advisories into working exploits. An object injection flaw that needs no login is the kind of bug that doesn't stay theoretical for long.
The practical playbook is boring but effective. Run composer outdated, subscribe to the security advisory feed, and know which contributed modules your site actually depends on, including the ones a former developer installed "temporarily" in 2021. Patch on a staging copy first, check that Layout Builder pages still render, then ship. A quick update now costs far less than incident response later.
Drupal core gets the headlines, but contributed modules are where much of your real attack surface lives. Treat them like the third-party dependencies they are.
If this advisory has you wondering what else is hiding in your module list, our free developer's security checklist for defending against supply-chain attacks is a solid place to start your audit.