CVE-2026-72898 is an unauthenticated SQL injection in Metabase's password-reset endpoint, fixed in August but flagged as actively exploited by Singapore's CSA on 4 November. Here's what's affected, the workaround, and the cleanup steps most people skip.
A Critical advisory for the REST & JSON API Authentication module shows how an enabled gate with no API key configured can let unauthenticated requests through. Here is what SA-CONTRIB-2026-298 says and the one negative test I'd add to every deploy.
PSA-2026-11-02 shortens security coverage for each Drupal core minor release to 8 months starting in 2027. I walked through the exact end dates and what it means for how often I need to update.
SA-CONTRIB-2026-254 (CVE-2026-118539) is an access-bypass flaw in Drupal Commerce that the Security Team says is already being exploited in the wild. The same October 28 advisory batch included an unauthenticated-adjacent deserialization RCE in Single Content Sync — here's what each one actually does and who needs to patch today.
Craft's September patch closed one way to smuggle raw SQL into Element::findOne(). A newly disclosed advisory shows a second, unauthenticated-reachable path into the exact same sink survived that fix for another month, through endpoints as mundane as deleting a saved address.
Two GitHub advisories published November 2 describe two ways to defeat Craft's guard against attacker-chosen classes — one via isset()'s blind spot on null, one via an incomplete DOMDocument blocklist that forgot ZipArchive and XMLWriter. Both were quietly fixed in 5.11.4, weeks before anyone outside Craft knew they existed.
A captured passkey login request could be replayed indefinitely against Craft, because the server never saved the updated signature counter after a successful login. It's a good excuse to actually explain what a WebAuthn signature counter is for, hung on a real, named bug.
One unsanitized attribute parameter, combined with PDO's emulated prepares, let an unauthenticated request run stacked SQL statements against Craft's database — and the demonstrated impact was flipping user ID 1 to admin. It's a clean case study in why Drupal's entity-query discipline over raw SQL exists.
Two moderate-severity advisories, patched together in Craft 5.11.2, show how a schema's Sites scope could be read around entirely: once through an element field missing its site argument, once by chaining prev/next across entries. Neither needed a login, a token, or any non-default configuration.
PHP pre-announced an emergency release on 20 Oct, then shipped 8.5.12/8.4.27/8.3.36/8.2.35 fixing two critical RCEs the next day. My Dockerfile already pointed at the right base image tag — and that still wasn't good enough. Here's why, and the one-line fix.
