Drupal critical update to fix bug with high exploitation risk

A batch of high‑impact security stories from BleepingComputer (19–20 May 2026): Drupal announced a critical core security release with a high risk of rapid exploitation; a public PoC exploit for the recently patched PinTheft privilege‑escalation on Arch Linux enables local root takeover; GitHub confirmed ~3.8k internal repos were breached after a malicious VS Code extension was installed (TeamPCP claimed access to ~4k repos); Microsoft published mitigations for YellowKey, a BitLocker zero‑day that exposes protected drives; a max‑severity RCE in ChromaDB’s FastAPI build lets unauthenticated,远‑f