The Drupal Security Team released SA-CORE-2026-014 on Oct 14 for CVE-2026-108097, a critical remote code execution bug in the core Field UI module (risk 19/25). Core alone is not directly exploitable, but multiple serious paths exist through contributed modules, and at least one known path needs no authentication; custom code can also expose it. Affected: Drupal 8.9+ before 10.6.19, 11.x before 11.3.19 / 11.4.10, and 12.0.0-alpha1 through beta1. Fixed releases: 10.6.19, 11.3.19, 11.4.10 (and Drupal 12 betas per the advisory). Until you update, uninstall the field_ui module. Drupal Steward covers some known vectors but not all. The advisory rates exploitation Theoretical; not on CISA KEV as of catalogVersion 2026.10.14. Same day, SA-CONTRIB-2026-218 (CVE-2026-108099, also critical 19/25) fixed the same kind of RCE in the contributed Entity List module, with at least one unauthenticated path. Updating core doesn't fix it; upgrade Entity List to 3.0.10. Update Oct 19: Fortbridge published a lab proof of concept on Oct 18 (GitHub fortbridge/cve-2026-108097-research). It rebuilds the full chain on Drupal 11.4.9 versus 11.4.10: the Field UI sink runs any PHP callable named in a row's #region_callback, which leads to settings.php disclosure and then code execution by replacing files/.htaccess. It uses a synthetic lab module in place of the still-unnamed contrib module that exposes the path, so it isn't a working exploit against real sites. It does mean the core half of the exploit is now public, so patch or uninstall field_ui if you haven't. Still not on CISA KEV.