Software security reports highlight Microsoft Office issues and Drupal vulnerabilities

Recent cybersecurity reports highlight significant vulnerability trends across major software platforms. Microsoft's September 2026 Patch Tuesday addressed a record 973 CVEs, though only two were identified as known exploited vulnerabilities. Concerns have also emerged regarding Office 2016 and Office 2019; despite being past their official end-of-support dates, Microsoft has continued releasing monthly security updates. However, a recent update (KB5002907) caused widespread issues by deactivating or removing these older Office versions, prompting Microsoft to pause the update.

Separately, a high-risk vulnerability, CVE-2026-96358, has been identified in several Drupal contributed modules. The flaws, detailed in a CERT-BUND advisory, could allow attackers to execute arbitrary code, gain elevated privileges, or bypass security measures. The vulnerability affects 16 different projects, including Webform and Project Browser, across various platforms such as Linux, UNIX, and Windows. While search engines like ZoomEye identified over 436,000 Drupal instances, the specific number of vulnerable sites remains unconfirmed as the CVE is recent.