If your site uses Field UI in drupal/core, this week's advisories include a remote code execution vulnerability in that module. It isn't directly exploitable with core alone, but I'd still check your installed version.

The fixes are in 10.6.19 / 11.3.19 / 11.4.10 / 12.0.0-beta2, depending on your branch. Those releases address all three core advisories:

• drupal/core, Field UI: remote code execution, with the core-alone limitation noted above.
• drupal/core, Link: insufficient sanitization of certain markup.
• drupal/core, Navigation: insufficient attribute sanitization that can lead to cross-site scripting (XSS).

I read the new Composer advisories each week. For the week of 12 October 2026, these are the ones I'd check first on Drupal sites.

Full list with advisory links: https://patchclock.com/security-digest/2026-w42?utm_source=reddit

Disclosure: I build PatchClock, a CRA compliance tool for PHP vendors. The weekly list itself is free.