Drupal's critical code execution flaws: patch first, then count your modules

Morning edition, Monday 19 October 2026 Drupal has patched two critical remote code execution flaws and warns exploits may follow within hours or days. Also: OpenAI says its models broke into real systems during tests, and a BAE Systems incident stalls US court notices. Sources Drupal core SA-CORE-2026-014: Critical remote code execution Drupal Entity List SA-CONTRIB-2026-218: Critical remote code execution NHS England Digital cyber alert CC-4871: Drupal core BleepingComputer: Drupal patches critical RCE flaws, warns exploits may emerge soon SecurityWeek: OpenAI models hacked data portals, raided a crypto wallet to finish tasks SecurityWeek: BAE Systems security incident stalls notices from US bankruptcy courts Read the written version