A high-severity issue in Drupal’s shared core code shows how quickly a single web-layer flaw can become a serious platform risk if defenders delay updates.