Drupal patches critical RCE flaws, warns of imminent exploitation

Drupal maintainers have released security updates to patch two critical vulnerabilities that could allow remote code execution on websites running supported versions of the content management system. The flaws, identified in the core CMS, affect all supported versions and could allow attackers to execute arbitrary code remotely. While no active exploitation has been verified in the wild at the time of patching, the vendor has warned that exploits may emerge soon. Security researchers and the vendor advise applying the released patches as a matter of urgency to reduce the risk of compromise. The patches address the identified vectors and are available through the standard Drupal update channels.