Skip to main navigation Skip to main content Skip to page footer

Security Alert: WordPress Security Update - October 2026 | Remote Code Execution Vulnerabilities in Node.js

Data Protection Office
Contact us Report an incident
Data Protection Office
Contact us Report an incident

Security Alert: Drupal Security Updates – October 2026

Drupal has released security updates, including fixes for two critical remote code execution (RCE) vulnerabilities, CVE-2026-108097 and CVE-2026-108099. These flaws could allow remote attackers to execute malicious code on affected web servers. 

  

Affected Systems 

  

The following system versions are affected but not limited to: 

  • Drupal Core (Field UI module): versions prior to 10.6.19, 11.3.19, 11.4.10, and 12.0.0-beta2 

  • Drupal Contributed Module (Entity List): Versions prior to 3.0.10. 

  

Security Risks 

  

Successful exploitation could allow attackers to execute arbitrary code on affected servers, potentially resulting in unauthorized access, website compromise, or service disruption. 

 

 

For complete details on all advisories published by Drupal, refer to the Drupal Security Advisories. 

  

Recommended Actions 

  

The National Cyber Security Authority (NCSA) recommends users and system administrators to: 

  

  1. Upgrade to the latest supported version of the installed software as soon as possible to ensure continued access to technical support and security patches. 
     
    The recommended software versions to upgrade to are as follows,but not limited to: 

  

  

  

2. Before performing any update tasks, ensure that you have a backup of your data. 

 

For further information and support, please contact the National Cyber Security Authority (NCSA) by emailto rwcsirt@ncsa.gov.rw or call us on 9009. 

 

 

References