Drupal has released fixes for two critical vulnerabilities that could allow remote code execution on sites running any supported version. One affects the core Field UI module and the other the contributed Entity List module, and both have at least one exploitation path that requires no authentication via contributed modules or custom code. The security team had warned that exploits might appear within hours or days. Administrators should update core to 10.6.19, 11.3.19 or 11.4.10 and Entity List to 3.0.10.

What it means: Drupal is widely used by government bodies, universities and non-profits, so in Greece too there are many sites that need checking right away. The security team announced the patch window in advance and spoke of exploits within hours, which signals that the threat is taken seriously. The flaws cannot be exploited with core alone, but most real sites run contributed modules and custom code, so nobody should feel safe by default. Teams that cannot update immediately can uninstall Field UI as a stopgap, since it is rarely needed in production. They should also check whether they run versions that are no longer supported, because those will not get a fix. Organisations that outsource maintenance should ask their contractor for written confirmation that the update was applied and when. For entities covered by NIS2, timely patching is now part of their risk management duties. The broader good practice is to keep an up-to-date list of every content management system you run and its version.

Read the original on BleepingComputer

Related service: Custom software

Related stories