Weekly Cybersecurity Summary: 13 October to 19 October 2026

Drupal’s security team published SA-CORE-2026-014 on 14 October 2026. It describes a remote code execution flaw in the Field UI module in Drupal core. Drupal rates it Critical (19 out of 25). Core on its own does not offer a one-click exploit, but the advisory says there are serious exploit paths through contributed modules, at least one of which needs no authentication, and custom code may also expose it. Drupal marks the exploit status as Theoretical, so no public exploit code is documented. Two lower-rated cross-site scripting issues were published alongside it (CVE-2026-108515 in the Link module and CVE-2026-108514 in the Navigation module).

If you run a Drupal site on shared hosting, you control the Drupal version, so you need to update it yourself. Sites on end-of-life branches will not receive a patch and should be upgraded.

On a VPS or dedicated server you are responsible for every Drupal install on the machine. Update each one, or uninstall the Field UI module (field_ui) as an interim step until you can.

Update Drupal core to a fixed version as soon as you can. If you cannot update straight away, uninstall the core Field UI module and move any end-of-life site to a supported branch.

Researcher Paulos Yibelo of PWNAI Research reported this flaw privately on 4 September 2026. The upstream Linux fix was merged on 14 October and vendors began publishing details on 16 October. The flaw sits in the host kernel’s IPv4 networking code. A virtual machine can send checksum-offload information through a virtio network device and the host kernel trusts it without checking it against the packet header, which lets the checksum code overwrite memory it should not touch. The researcher showed, in a lab, a guest leaking host memory, crashing the host and reaching root on the host. No attacks in the wild have been reported and full details are being held back for a follow-up. The flawed code dates back to 2008, so very old kernels are likely to be affected too.

Shared hosting accounts are not directly exposed, but the servers they live on may sit on hypervisors. The fix is applied by us at host level, so there is nothing to change in your account.

If you run your own virtualisation, for example KVM on a dedicated server, you need to patch the host and reboot it, which interrupts all guests. Updating the kernel inside an ordinary VPS does not fix the underlying host, and a VPS tenant cannot patch it. Nobody should run untrusted guests on an unpatched host.

If you manage a KVM or other virtualisation host, install the patched kernel as soon as it is available for your distribution, drain or migrate guests first, and reboot. There is no published workaround.

Three MariaDB vulnerabilities rated 9.9 out of 10 were published on 16 and 17 October 2026. CVE-2026-85748 is a use-after-free in the SYS_REFCURSOR handling, CVE-2026-85746 is an out-of-bounds write when nested geometry collections are passed to ST_AsText, and CVE-2026-92262 is a filesystem name-encoding bypass using the #mysql50# prefix. All three need a low-privileged database account rather than an administrator. A public proof of concept for CVE-2026-85746 appeared on 18 October and demonstrates a server crash. We could only confirm these dates from a single source, and the fixes appear to be the same releases that shipped in MariaDB’s batch on 13 October.

On shared hosting we manage the database server, and the fix is applied at host level. Your own database users cannot be used to attack other accounts once the server is patched.

On a VPS or dedicated server you manage MariaDB yourself. Check your version and update it. Pay particular attention if you give other people SQL access to your databases.

Update MariaDB to one of the fixed releases and review which accounts have direct SQL access to the server.

LearnPress, a popular WordPress learning management plugin, has an unauthenticated PHP object injection flaw affecting versions up to and including 4.4.10. The CVE was published on 17 October 2026. The problem is that the plugin deserialises data supplied by an unauthenticated visitor, which can lead to remote code execution if the site has a suitable gadget chain in another plugin or theme. A public proof-of-concept repository has been listed for it, although we have not been able to verify its contents. We could not confirm the patched version number, so please check the plugin’s changelog and the Wordfence or Patchstack advisory.

Check any WordPress site you run that offers courses. You can update the plugin from the WordPress dashboard, and it is worth turning on automatic updates for plugins.

Update LearnPress on every WordPress site on the server. If a site cannot be updated yet, deactivate the plugin or put a web application firewall rule in front of it.

Update LearnPress to the latest release, then review the site for new administrator accounts and unexpected files.

MailOptin, a WordPress email popup and newsletter plugin, has an unauthenticated privilege escalation flaw in its subscribe-to-email-list endpoint that affects every version up to and including 1.2.78.6. The CVE was published on 16 October 2026. An entry for it also appears in VulnCheck’s exploited-vulnerability list, but we found no other source confirming attacks, so please treat that as unconfirmed. The risk is that an anonymous visitor could create or elevate an account to administrator and take over the site. The patched version was not stated in the sources we found.

If your site uses MailOptin, update it from the WordPress dashboard now and check your list of administrator users for any you do not recognise.

Update MailOptin across all sites on the server. Where you cannot update, deactivate the plugin until you can.

Update LearnPress to the latest release, then review the site for new administrator accounts and unexpected files.

Some of this week’s issues, such as the Drupal and WordPress plugin flaws, could leave visible signs if a site was attacked before it was updated. These checks are a sensible starting point:

If you need help with any of the steps above, raise a support ticket from the Customer Area at heartinternet.uk, or use live chat Monday to Friday, 09:30 to 16:00. Our knowledge base at heartinternet.uk/support also has guides on updating WordPress and managing your hosting.

We will continue to publish a weekly summary of the issues that matter most to people hosting websites with us.