Topic
Security of web content management systems, where file upload handling and third-party plugin code are common routes to server access.
Drupal shipped fixes on October 14 for CVE-2026-108097, a critical Field UI remote code execution flaw, in 11.4.10, 11.3.19 and 10.6.19. The Security Team says core alone is not reachable, but contributed modules open several paths and at least one needs no login.
Reality
WordPress released 7.1.2 on 22 September 2026 to fix remote file inclusion flaw CVE-2026-87902, and the first exploit attempt was recorded the same day. The fix was back-ported to every maintained branch down to 4.7, so an exposed site has hours before scanners find it.
Reality
Paulos Yibelo of pwn.ai reported the Core flaw on August 22 and WordPress fixed it in 7.1.1 last week. The full proof-of-concept is now public, and the chain needs no attacker account, only an administrator who opens a link.
Reality
ShinyHunters told BleepingComputer it took Cl0p's source code, the contents of /var/log and the private keys to the gang's Tor address, and gave Cl0p 72 hours to pay. That last item decides who can host the same onion URL.
Reality
BleepingComputer confirmed a defaced page and an uploaded file on Cl0p's infrastructure. Everything past that is a criminal crew's own inventory, and the route it describes runs through the content layer.
Reality