Drupal patched critical CVE-2026-108097, a Field UI flaw enabling unauthenticated remote code execution and website takeover.