Kubernetes and Drupal face new security vulnerabilities

Recent cybersecurity updates have identified several vulnerabilities across major software platforms.

In the Kubernetes ecosystem, two medium-rated security advisories were published on September 24. CVE-2026-2270 involves a confused deputy attack in the StatefulSet controller that could allow cross-namespace pod creation. CVE-2026-76654 involves an NTLM coercion vulnerability on Windows nodes. Both issues have been addressed in recent patch releases, including versions v1.34.12, v1.35.9, v1.36.5, and v1.37.1.

Separately, a high-risk vulnerability, CVE-2026-96361, has been identified within the Drupal ecosystem. Part of a larger CERT-BUND advisory, this vulnerability affects 16 contributed Drupal projects, including Webform, Project Browser, and Commerce Decoupled Checkout. The advisory notes that if an affected module is present and reachable, it could lead to arbitrary code execution, privilege escalation, and data exposure. The vulnerability has been patched in various module releases.