#CMS Security
Critical Drupal Field UI Flaw Opens Unauthenticated Takeover Paths
Drupal has patched CVE-2026-108097, a critical Field UI vulnerability that can enable remote code execution when certain contributed modules or custom code are present. At least one confirmed...
New WordPress Flaw Turns a Failed Login Attempt Into Full Server Takeover
A newly disclosed WordPress vulnerability, dubbed XSS2Shell and tracked as CVE-2026-64638, chains a decade-old parsing quirk in the login page into full remote code execution, putting an estimated...