WEBVTT

1
00:00:03.200 --> 00:00:09.040
This is Decrypted. Monday, the nineteenth of October, twenty twenty-six.

2
00:00:09.040 --> 00:00:11.600
This is the morning edition.

3
00:00:11.600 --> 00:00:19.205
Drupal's critical code execution flaws: patch first, then count your modules.

4
00:00:19.205 --> 00:00:27.437
Drupal, the website platform, has patched two critical flaws that let an attacker run their own code on a

5
00:00:27.437 --> 00:00:35.928
server. That's remote code execution, or R C E, which means running your own code on someone else's machine.

6
00:00:35.928 --> 00:00:42.248
The project warns that working exploits could appear "within hours or days".

7
00:00:42.248 --> 00:00:50.488
N H S England Digital has already published its own alert, so this is on the UK radar.

8
00:00:50.488 --> 00:00:55.368
If you run Drupal, treat it as a patch-today story.

9
00:00:55.368 --> 00:00:59.448
So, what's actually broken?

10
00:00:59.448 --> 00:01:09.224
The main flaw is C V E twenty twenty-six, one zero eight zero nine seven, the public reference number for th

11
00:01:09.224 --> 00:01:18.312
is vulnerability. It sits in Field U I, the core module behind the admin screens where site builders define wh

12
00:01:18.312 --> 00:01:25.608
at a page contains. Drupal rates it critical, 19 out of 25 on its own scale.

13
00:01:25.608 --> 00:01:36.214
A second flaw, C V E twenty twenty-six, one zero eight zero nine nine, affects the contributed Entity List mo

14
00:01:36.214 --> 00:01:39.608
dule. It's fixed in version 3.

15
00:01:39.608 --> 00:01:43.448
0.10. The detail matters.

16
00:01:43.448 --> 00:01:47.448
Drupal says core alone can't be exploited.

17
00:01:47.448 --> 00:01:55.581
Other add-on modules and custom code can expose the vulnerable function, and at least one known route needs n

18
00:01:55.581 --> 00:02:01.048
o login at all. Think of a building where the cleaners' cupboard has a weak lock.

19
00:02:01.048 --> 00:02:06.888
The cupboard is harmless until someone builds a corridor that opens onto it from the street.

20
00:02:06.888 --> 00:02:12.568
Whether your site has that corridor depends on which modules you installed years ago.

21
00:02:12.568 --> 00:02:15.688
Many teams couldn't list them from memory.

22
00:02:15.688 --> 00:02:20.808
So, what should you do, and in what order?

23
00:02:20.808 --> 00:02:23.928
The fixed releases are 10.

24
00:02:23.928 --> 00:02:31.688
6.19, 11.3.19 and 11.4.10, depending on your branch.

25
00:02:31.688 --> 00:02:35.128
Older branches, including 11.

26
00:02:35.128 --> 00:02:40.328
2.x and 10.5.x, get no fix.

27
00:02:40.328 --> 00:02:47.608
If you can't update straight away, Drupal says uninstalling the Field U I module protects you in the meantime

28
00:02:47.608 --> 00:02:55.688
. Its Drupal Steward service offers partial cover, but Drupal is explicit that updating is still necessary.

29
00:02:55.688 --> 00:03:01.928
For the defender, the awkward part is that there's no single signature to hunt for.

30
00:03:01.928 --> 00:03:07.848
Because the route in varies by site, you can't rely on one rule at the firewall.

31
00:03:07.848 --> 00:03:14.888
Review web logs for unexpected requests to admin and field paths since 14 October.

32
00:03:14.888 --> 00:03:17.848
Check for new files or accounts you didn't create.

33
00:03:17.848 --> 00:03:25.057
Nothing I've read reports confirmed exploitation, which is a window, not a reassurance.

34
00:03:25.057 --> 00:03:29.777
Now, what's the Secure by Design lesson here?

35
00:03:29.777 --> 00:03:37.377
Secure by Design asks the supplier to remove a class of risk, not leave it to every customer to defend.

36
00:03:37.377 --> 00:03:43.137
Here the dangerous function ships in core and waits for a module to expose it.

37
00:03:43.137 --> 00:03:50.561
A safer design would make that function refuse to run unless explicitly asked, so a careless add-on couldn't

38
00:03:50.561 --> 00:03:55.777
open the door. That's a supplier decision, and customers can't make it for them.

39
00:03:55.777 --> 00:04:00.817
What customers can control is how much surprise lives in their estate.

40
00:04:00.817 --> 00:04:03.217
The cost is modest and dull.

41
00:04:03.217 --> 00:04:11.066
A maintained list of every module on every site, a named owner for each site, and a rule that unsupported ver

42
00:04:11.066 --> 00:04:13.937
sions get retired rather than tolerated.

43
00:04:13.937 --> 00:04:17.737
If the honest answer to "who owns that site?

44
00:04:17.737 --> 00:04:21.697
" is "nobody", this week is when that gap costs money.

45
00:04:21.697 --> 00:04:25.377
Start with the sites nobody has touched in years.

46
00:04:25.377 --> 00:04:29.297
As always, this is opinion, not advice.

47
00:04:29.297 --> 00:04:36.940
That was Decrypted. The written version and every source are linked in the show notes.

48
00:04:36.940 --> 00:04:38.100
Thanks for listening.