Drupal Issues Urgent Advisory Over Critical Core RCE Vulnerability Threatening Rapid Exploitation

Drupal's security team has issued an urgent advisory warning that a critical remote‑code‑execution (RCE) flaw in the platform's core could be weaponised by attackers within days, prompting immediate action from site operators.

The defect resides in two core modules—Entity List and Field UI—that handle content‑type definitions and field configuration. Exploiting these modules enables malicious actors to run arbitrary code on any site that runs the vulnerable version of Drupal.

Security researchers have demonstrated that the core weakness can be combined with several widely used contributed modules, effectively widening the attack surface. The advisory notes that functional exploit paths have already been observed in test environments, indicating that real‑world attacks are plausible.

Drupal has released patches for the affected core components and is urging administrators to apply them without delay. Because the window for exploitation appears narrow, any site that remains unpatched continues to face a high likelihood of compromise.

Drupal powers millions of websites, ranging from personal blogs to large government portals. Historical incidents—most notably the 2018 “Drupalgeddon” RCE—show how quickly a core vulnerability can cascade into a broad‑scale security crisis. The current warning arrives as many organisations are still migrating to newer Drupal releases, increasing the number of potentially vulnerable installations.

Experts advise a systematic review of all installed contributed modules, especially those that interact with Entity List or Field UI. Administrators should disable or update any such extensions until they are confirmed safe, and maintain vigilance by monitoring official security mailing lists and applying updates promptly.

The advisory was first reported by SecurityWeek, which highlighted the rapid‑exploitation risk. As patches disseminate, the Drupal community is expected to issue further guidance, and site owners are encouraged to follow the official security release notes to safeguard their sites.