Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules

Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server. Fixes shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. The Drupal Security Team said the flaw is not reachable through core alone, but several exploit paths exist via contributed modules, including at least one requiring no login.