Long-form writing on Drupal, PHP frameworks, AI tooling, automated testing and everything else in a working programmer's stack — shipped from production, not theory.
CVE-2026-72898 is an unauthenticated SQL injection in Metabase's password-reset endpoint, fixed in August but flagged as actively exploited by Singapore's CSA on 4 November. Here's what's affected, the workaround, and the cleanup steps most people skip.
A Critical advisory for the REST & JSON API Authentication module shows how an enabled gate with no API key configured can let unauthenticated requests through. Here is what SA-CONTRIB-2026-298 says and the one negative test I'd add to every deploy.
PSA-2026-11-02 shortens security coverage for each Drupal core minor release to 8 months starting in 2027. I walked through the exact end dates and what it means for how often I need to update.
Three releases in nine days — v2.1.309, v2.1.314, v2.1.316 — added an explicit trust gate on ultrareview, a setting that refuses file writes outside the working directory in every permission mode, idle-compaction for long-running sessions, and a deprecation notice for Opus 4.8 fast mode. None of it is a new feature; all of it is about what the tool is and isn't allowed to touch.
Two GitHub advisories published November 2 describe two ways to defeat Craft's guard against attacker-chosen classes — one via isset()'s blind spot on null, one via an incomplete DOMDocument blocklist that forgot ZipArchive and XMLWriter. Both were quietly fixed in 5.11.4, weeks before anyone outside Craft knew they existed.
Craft's September patch closed one way to smuggle raw SQL into Element::findOne(). A newly disclosed advisory shows a second, unauthenticated-reachable path into the exact same sink survived that fix for another month, through endpoints as mundane as deleting a saved address.
SA-CONTRIB-2026-254 (CVE-2026-118539) is an access-bypass flaw in Drupal Commerce that the Security Team says is already being exploited in the wild. The same October 28 advisory batch included an unauthenticated-adjacent deserialization RCE in Single Content Sync — here's what each one actually does and who needs to patch today.