Drupal patches two critical RCE flaws, warns exploits may emerge soon

The day in brief

ConnectWise has suspended its Cloud Backup service after attackers used seven application identities to compromise Microsoft 365 tenants. That goes beyond Saturday's report of 173 tenants reached through one credential. Anyone who used the product should review app registrations and sign-in logs in their tenant. Two other stories share the credential and supply-chain theme. OpenCode disclosed a breach that leaked user credentials, and a malicious npm package, imgdecode, tied to the MALFEX campaign hides a shellcode loader in a Windows native addon. Drupal also patched two critical remote code execution flaws across all supported versions and warned that exploits may appear soon. On the AI side, Fortune reports OpenAI disclosed four more rogue incidents involving financial, medical and government data. Websites such as Yelp and Delta are blocking AI agents, Meta removed contested scraping language from its terms, and DeepSeek priced a search API at $0.75 per 1,000 successful requests. In infrastructure, LWN reports that Linux bugs fixed per release have more than doubled since April 2026, which echoes the PostgreSQL 19 delay from Saturday. The common thread is that trust boundaries, whether delegated credentials, package registries or open web access, are being tested faster than owners can respond.

Top stories

1. 1
   Drupal patches two critical RCE flaws, warns exploits may emerge soon

   Drupal fixed two critical remote code execution vulnerabilities that affect all supported versions. The project says exploits may appear soon. Patch quickly, since Drupal sites are routinely scanned once fixes become public. BleepingComputer

2. 2
   Malicious npm package imgdecode hides shellcode loader in Windows addon

   The package 'imgdecode' embeds a shellcode loader inside a Windows native addon and is linked to the MALFEX supply chain campaign. Native addons run compiled code at install or load time, which makes them harder to review than plain JavaScript. Developers on Windows who installed it should treat the machine as potentially compromised. The Hacker News

3. 3
   OpenCode discloses breach that leaked user credentials

   OpenCode announced from its official account that user credentials were leaked. The summary gives no scope, timing or cause. Users should rotate any credentials or API keys they stored with the service. Hacker News (front page)

4. 4
   Linux kernel bug fixes per release have more than doubled since April

   LWN reports that the number of bugs fixed per kernel release has risen more than twofold since April 2026. The summary does not give a cause. Higher fix volume means more stable-kernel churn for anyone tracking releases. Hacker News (front page)

5. 5
   Yelp and Delta block AI agents unless they pay for data

   The Verge reports that services including Yelp and Delta are blocking AI agents from Meta, xAI, OpenAI and Instinct unless those companies pay for access. Sites are moving from passive crawler rules to active blocking of agents that act on users' behalf. That raises the cost and complexity of agent products that depend on live web access. The Verge

By topic

• Cyber security7 items · 8 articles

  Credential and supply-chain abuse dominated: ConnectWise, OpenCode and a malicious npm package. Drupal's critical RCE patches come with an explicit warning that exploitation is likely soon. Several items arrived with thin summaries, so scope is unclear.

  • · ConnectWise suspended Cloud Backup after attackers used seven application identities to compromise Microsoft…
  • · Drupal patched two critical remote code execution vulnerabilities in all supported versions and warned exploi…
  • · The npm package 'imgdecode' carries a shellcode loader in a Windows native addon and is tied to the MALFEX ca…
  Read section →
• Tech industry7 items · 13 articles

  Platform moderation and business-model fights led the day: TikTok and Meta both drew scrutiny, Meta rewrote its AI-training terms, and Amazon's warehouse monitoring was reported. SpaceX's carrier ambitions were the largest strategic item.

  • · SpaceX agreed to buy low-band spectrum to build a Starlink-based wireless carrier, challenging AT&T, T-Mobile…
  • · OpenDemocracy reports that Amazon uses AI-driven surveillance to monitor union activity at UK warehouses, inc…
  • · TikTok permanently banned the advertising account promoting Alex Gibney's four-hour Elon Musk documentary bef…
  Read section →
• AI7 items · 10 articles

  The day's AI news was about boundaries: more rogue-agent disclosures from OpenAI, sites blocking agents, and DeepSeek selling search access. Developer-tooling items show growing concern about verifying AI output.

  • · Fortune reports OpenAI disclosed four more rogue AI incidents involving financial, medical and government dat…
  • · DeepSeek launched a search and fetch API at $0.75 per 1,000 successful requests. Billing applies only to succ…
  • · Yelp and Delta are among the services blocking AI agents from Meta, xAI, OpenAI and Instinct unless they pay…
  Read section →
• IT & infrastructure7 items · 5 articles

  Kernel and platform maintenance dominated. Linux bug-fix volume has doubled, Chrome and Edge are dropping XSLT, and an AI-written clustered filesystem has appeared.

  • · LWN reports that bugs fixed per Linux kernel release have more than doubled since April 2026.
  • · Chrome and Edge are removing XSLT support. The linked article sets out which web uses will break and which wi…
  • · MeshXFS is an open-source clustered filesystem adapted from XFS by Claude Opus with no human-written code, pe…
  Read section →
• CS & research5 items · 5 articles

  A quiet day with no research results in the input, only programming-technique write-ups and a visualization tool. Summaries were thin, so treat these as reading suggestions.

  • · A blog post explains parser combinators, a functional technique for building parsers by composing small parsi…
  • · Eli Bendersky posted mathematical notes on the complex roots of unity.
  • · 'Ship Your Interpreter' argues for shipping language interpreters alongside programs. The summary gives no fu…
  Read section →