Drupal patches multiple security flaws in core engine