Drupal calls on users to patch critical remote code execution vulnerabilities