CVE-2026-96363 Affects Webform Submodule, Not Drupal Core, Experts Clarify

·21 views

A Drupal security advisory (SA-CONTRIB-2026-161), published on 23 September 2026, identifies CVE-2026-96363 as a vulnerability in Webform Entity Print, a submodule bundled within the contributed Webform project, not in Drupal core itself. The submodule is disabled by default, meaning sites can run an affected Webform version without exposing the vulnerable code path unless the submodule is explicitly enabled. Only sites running Webform Entity Print on an affected Webform branch with specific authoring permissions assigned to user roles are considered at risk. Administrators are advised to update Webform to version 6.2.12 or 6.3.1, or disable the submodule entirely if it is not in use. A ZoomEye scan on 27 September 2026 found no indexed assets flagged under this CVE, though that result reflects a point-in-time index query and does not confirm that all sites are safe.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Check Whether a Page's Content Appears in Its Raw HTML for AI Crawlers

A page may look complete in a browser yet deliver little content in its initial HTML, which matters when a crawler does not execute JavaScript the way a browser does. The author advises checking whether the response itself contains the desired content rather than assuming a specific AI system's rendering behavior. Suggested methods include fetching the page with a crawler-style user agent via curl, grepping for known phrases, roughly counting words after stripping tags, and disabling JavaScript in developer tools to compare results. Common patterns that hide content from the first response include client-side fetching, scroll-triggered loading, client-side routing, and JavaScript-injected structured data. The author stresses that these checks are rough diagnostics, that passing them does not guarantee citations or rankings, and that the deployed URL should be re-checked after changes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Find and Fix the HTTP File Causing WordPress Mixed Content Warnings

WordPress sites served over HTTPS can still lose their padlock or break features when an image, script, or stylesheet loads over plain HTTP, a problem known as mixed content. The guide recommends starting by locating the exact http:// URL in a private browser window, using the developer tools Console and Security panel while checking key pages such as checkout and contact forms. The source of each URL typically falls into one of three groups: the site's own uploads folder, a theme or plugin that builds the address, or a third-party domain pasted into header, footer, or widget code. Owners should confirm that WordPress Address and Site Address both use https:// and can use Site Health to help detect HTTPS support. Built-in link rewriting handles only links to the site's own domain, so third-party resources must be corrected manually at their source.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Emulation and Reverse Engineering May Be Eroding Gaming's Proprietary Business Model

A DEV Community author argues that barriers protecting proprietary gaming platforms are weakening as emulation improves and reverse engineering becomes cheaper through AI tools. The piece points to the September 2026 Relapse jailbreak, which opens many PlayStation 5 consoles running firmware up to 13.60 to kernel access and custom code. It also cites rapid PS5 emulation progress, with Demon's Souls Remake moving from one or two frames per second to builds exceeding 60 FPS within weeks. The author contends that the traditional model built on expensive hardware, exclusive software, and DRM is nearing a breaking point, though gaming itself will continue. The argument extends an earlier thesis that AI is making much software effectively open source.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Debugging a Stale noindex Verdict in Google Search Console

A site migration can leave Google Search Console reporting a noindex tag even after the page loads normally. The article advises checking when Google last fetched the URL and comparing that with the response the public server returns today. A noindex directive may appear in either the HTML or the HTTP headers, and an old indexing report can reflect an outdated response. To make the comparison, it provides a Python script, check_noindex.py, which sends a single GET request, stops at redirects, and prints the status, relevant headers, canonical links, and robots meta tags. The author recommends testing the exact URL readers will use, including scheme, host, and trailing slash, and notes that compressed responses must be decoded before the HTML can be inspected.

0 comments Read more at DEV Community