Know what changed.
Trace why it matters.

Drupal core's Field UI module has a critical flaw that could let an attacker run code on the site's server. Drupal shipped fixes on October 14 in versions 11.4.10, 11.3.19, and 10.6.19.

The flaw is not reachable through Drupal core alone, according to the Drupal Security Team's advisory. Triage should retain the advisory’s reachability boundary rather than assume Drupal core alone is sufficient.

Burger King Japan disclosed unauthorized access to its customer-membership system between October 2 and October 7, 2026, exposing approximately 11.18 million official-app members’ personal information. The exposed data includes membership IDs, email addresses, names, phone numbers, dates of birth, gender, prefecture of residence, registration type, mobile-ordering history, and email-verification status.

The report says the data could support convincing phishing, impersonation, and social-engineering messages using customers’ real identities and relationship with Burger King.

CenterPoint Energy, a regulated utility serving infrastructure and grids in several U.S. states, disclosed a breach affecting 1,062,060 Texas residents. The exposed information included customers’ names, addresses, Social Security information, and driver’s-license numbers.

A threat actor claimed to have extracted roughly 7.49 million customer records and offered a 2.5 GB archive for download; these claims were attributed to the actor rather than confirmed by CenterPoint. The confirmed resident notification should be assessed separately from the actor’s larger, unconfirmed extraction claim.