Drupal's Field UI will run any PHP callable it is handed - and contrib modules can hand it one unauthenticated. https://intel.threadlinqs.com/threat/TL-2026-3616 #ThreatIntel #CVE_2026_108097 #CVE_2026_108099 #PHP