Some bugs arrive with a bang. Others sit quietly in your codebase since roughly the era of sourdough starters and Zoom happy hours, waiting patiently for their moment. Drupal's latest critical advisory is very much the second kind, and its moment is right now.

A Six-Year-Old Callback Gets Called Out

On October 14, the Drupal Security Team shipped fixes for CVE-2026-108097, a remote code execution flaw in core's Field UI module rated 19 out of 25, which Drupal classifies as critical. The culprit: Field UI's table element passed each row's #region_callback through call_user_func_array without checking what it was actually calling, a pattern present since at least Drupal 8.9.0 back in 2020.

Core alone doesn't expose the flaw, but contributed modules do, and at least one known exploit path requires no login at all. Fixed releases are 11.4.10, 11.3.19 and 10.6.19. A companion critical fix landed for the contributed Entity List module (CVE-2026-108099, version 3.0.10), which updating core will not patch for you. Two moderately critical XSS bugs in the Link and Navigation modules rounded out the batch.

151,000 Sites Stuck Outside the Lifeboat

Here's the uncomfortable number: per The Hacker News, in the week starting October 4, 151,442 of 531,499 reporting sites (about 28.5%) were running branches that get no fix at all, including Drupal 11.2.x and below, 10.5.x and below, and Drupal 8 and 9. For those sites, "just run composer update" isn't a one-liner. It's a migration project with a deadline nobody put on the calendar. And 11.3.x and 10.6.x lose security coverage in December 2026, so the lifeboat is getting smaller.

No public exploit had surfaced as of October 15, but the Security Team warned exploits "might be developed within hours or days," and Drupal's May SQL injection advisory saw attempts within two days. If you can't update immediately, uninstalling field_ui is an official stopgap (you'll lose the Manage Fields and Manage Display pages until you're patched), and Drupal Steward blocks some known vectors. One gotcha: custom code that sets #region_callback on field_ui_table rows will stop running after the update, so test those admin screens before declaring victory.

Patch now, check your contrib modules separately, and if you're on an unsupported branch, treat this as the universe sending a very strongly worded calendar invite.

If your Drupal site is one of the 151,000 stranded on an unsupported branch, our team can get you patched fast and onto a supported release before the next advisory drops.

Source: The Hacker News