U.S. CISA adds a flaw in Drupal Core to its Known Exploited Vulnerabilities catalog

Multiple Security Affairs reports highlight a high-impact Drupal Core SQL injection (CVE-2026-9082) that affects sites using PostgreSQL: Drupal released a critical patch on May 20 and exploit activity was observed within 48 hours; CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. The feed also notes other KEV additions (e.g., Trend Micro Apex One CVE-2025-34291 and additional Microsoft/Adobe/ConnectWise entries), a resurgence of the Ghostwriter APT using a Ukrainian learning platform for Cobalt Strike/phishing, the arrest of a suspected Kimwolf botnet operator, a global