Drupal has released patches for two critical remote code execution (RCE) vulnerabilities affecting all supported versions of its content management system. One flaw is in the Field UI module, allowing unauthenticated RCE through certain contributed modules. The Drupal Security Team warns that exploit paths exist, with at least one not requiring authentication, and advises immediate patching due to the high likelihood of exploits emerging soon.