Drupal patches critical RCE flaws, warns exploits may emerge soon

{"heading_1":"Background on Drupal and the Vulnerabilities","paragraph_1":"The Drupal Security Team warned at the beginning of the week that ","paragraph_2":"The team recommended updating to the latest supported patch (bugfix) release for your site's version of Drupal before October 14, so that you can address any other upgrade issues before the security window.","paragraph_3":"The vulnerabilities impact Drupal 12 pre-releases before beta2, but these are not meant to be used in production environments. The final stable 12.0 version will include fixes for both flaws.","heading_2":"Impact and Recommendations","heading_3":"Security Team's Warning and Timeline","the Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days,":".","paragraph_4":"Once attackers have valid credentials, only 37% of their actions are blocked. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.","paragraph_5":"The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report."}