Hardcoded Credentials and Drupal RCE: Two Critical Patches You Need Today
Hardcoded Credentials and Drupal RCE: Two Critical Patches You Need Today
Two critical vulnerabilities disclosed in the last 48 hours demand immediate attention from UK small businesses. CVE-2026-111998 affects Vanus event infrastructure with a severity score of 9.8, exploiting a hardcoded Bearer token that grants cluster-admin access to unauthenticated attackers. No password guessing or phishing required: the credential was baked into the software from deployment. Separately, Drupal’s security team has warned of two remote code execution vulnerabilities affecting all supported versions, with…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.