Highly Critical Drupal Core Flaw Exposes PostgreSQL Sites to RCE Attacks

A highly critical vulnerability has been reported in Drupal Core that could allow remote code execution (RCE) on sites using PostgreSQL as the database backend. The information originates from a Reddit cybersecurity discussion referencing an external news source. No specific affected versions or technical details have been provided, and there is no confirmation of known exploits in the wild. Patch availability and remediation status are not confirmed from the available data.

• thehackernews.com/2026/05/highly-critical-drupal-core-flaw.html (opens in a new tab)
• reddit.com/r/cybersecurity/comments/1tjbsjw/highly_critical_drupal_core_flaw_exposes/ (opens in a new tab)

• php2shell one week later: Why one exploit doesn’t work everywhereHighVulnerability2026-10-30
• ZDI-26-839: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• ZDI-26-843: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• ZDI-26-845: MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• Open-source tool for unpacking stripped Android native (.so) malware: static RegisterNatives recovery, ARM64 OLLVM (BR X8) deobfuscation, and Dobby anti-Frida tracingTool2026-10-28