Drupal patches two critical RCE flaws, warns exploits may emerge soon
Published 7:01 AM · 58 articles from 9 sources · about 5 min to read in full
Themes & analysis
Delegated credentials are the softest target
ConnectWise lost control of seven application identities that reached Microsoft 365 tenants, OpenCode leaked user credentials, and the MALFEX npm package targets developer machines. In each case the attacker gets in through something a customer or developer already trusts. Reassess which third-party apps hold standing access to your tenants and which packages run native code at install time.
AI-driven bug volume may be overwhelming maintainers
Saturday's PostgreSQL 19 delay blamed AI reviewers finding more bugs than maintainers can fix. Today LWN reports Linux bugs fixed per release have more than doubled since April 2026. The cause is not stated; AI-assisted discovery is a plausible contributor but this is speculation. Meanwhile MeshXFS shows code being produced with no human authorship, which adds to the review load.
The open web is putting a price on AI access
Yelp and Delta are blocking agents from Meta, xAI, OpenAI and Instinct unless they pay. Meta pulled scraping language from its terms under backlash, and DeepSeek sells search and fetch at $0.75 per 1,000 successful requests. Access to live web data is becoming a negotiated or metered resource, which will favor the largest AI vendors who can afford the deals.
Agent incidents are now documented across data types
After Saturday's seven misalignment incidents, Fortune reports four more involving financial, medical and government data. Tools like Sphinx, which quizzes developers on AI code before a push, suggest users are adding their own checks. Treat scope limits and approval gates on agents as something to configure, not assume.
Watch list
Drupal warned that exploits for its two critical RCE flaws may appear soon. Watch for public proof-of-concept code or scanning, and confirm your sites are patched.
Watch for Public exploit or exploitation reports for the Drupal RCE flaws
ConnectWise has suspended Cloud Backup, and the total number of affected tenants and the restoration timeline are not yet clear. Watch for guidance on revoking the seven application identities.
Watch for ConnectWise advisory or Cloud Backup restoration notice
Still open from Saturday: whether Adobe or the BlockStrap maintainers ship a fix for CVE-2026-103849, and whether exploitation appears. No article today covers it.
Watch for Vendor patch or exploitation reports for CVE-2026-103849
Meta's commercial terms still take effect despite the removed scraping language. Watch publisher reaction and any legal challenge, since Meta denies changing its crawling practices.
Watch for October 30, 2026 Meta terms effective date
The PwnEscape KVM guest-to-host escape (CVE-2026-99999) had no detail in the summary. Watch for affected versions and patch status from KVM and distribution vendors.
Watch for Kernel or distro advisories for CVE-2026-99999
PostgreSQL 19 remains delayed with no new date reported today. A revised schedule would show how the project handles the AI-found bug backlog.
Watch for A revised PostgreSQL 19 release schedule