SA-CORE-2026-014 (Oct 14) is a critical RCE in core's Field UI module that, per the advisory, isn't exploitable by core alone — contrib or custom code completes the path, and at least one needs no auth. Why 'am I patched?' beats 'is core vulnerable?', and the one-command mitigation.
The Craft 6 alpha ships built-in Model Context Protocol servers that let an AI inspect and edit content, the content model and project config. The interesting part isn't the AI — it's the permissions design: OAuth 2.1, an explicit 'Use Craft MCP' permission, public access off by default, and writes that land as drafts.
An eager-loaded Matrix relation with orderBy and limit:1 returned the wrong row and said nothing. The fix adds an allowlist of 'safe' sort forms — the fingerprint of a security fix, because the same criteria-cleansing path produced two High-severity advisories this autumn.
Craft ships a security fix with only a severity and a GHSA ID, then publishes the full write-up about a month later in batches. I counted 128 advisory IDs in ten months and measured the real release-to-advisory gaps. A field guide to treating the changelog line as the alarm.
Coolify holds every key on my VPS, so when it shipped seven releases in three days (one feature reverted 37 minutes after it landed), I wrote an update policy instead of clicking Update. Patch for security on its own clock; adopt features a beat late, after the hotfix storm settles.
Drupal is at ~219 contrib advisories in 2026 against ~126 for all of 2025. Both the Drupal Association and Anthropic's new OSS Scanner say the same thing from opposite ends: AI made finding bugs nearly free, and verifying and fixing them is still a human's afternoon. What that means for your security inbox.
Five security-bearing Traefik patch releases between 31 Jul and 6 Oct 2026, all sharing one bug class: the proxy and the backend parse the same request differently. Why that's an argument for app-level authorization.
PHP 8.6 turns on strict mode, httponly and SameSite=Lax by default. For a Drupal box that's a non-event for web traffic — Drupal forces all three. The real exposure is CLI scripts and SSO flows. Test, don't assume.
Between 23 Sep and 7 Oct 2026, four Drupal contrib modules got advisories for the same bug class — user strings evaluated as Twig. Plus the 14 Oct core release window, and the fifteen-minute audit I ran on my own VPS.
Craft added an opt-in Twig sandbox in 5.9, and all through 2026 it has kept producing authenticated-RCE advisories. A Drupal dev's notes on why letting editors run Twig is a privilege-escalation feature wherever you do it.
