Drupal Security

A critical issue involves reflected cross-site scripting (XSS) attacks, particularly those that affect Drupal 7 installations with the overlay module enabled. This flaw stems from improper input validation, enabling attackers to inject harmful code into a victim's browser. ...more

A range of advanced vulnerability scanners now offers proactive solutions to address security challenges. Tools like 'Pentest-Tools', 'SUCURI', 'Astra', 'Detectify', 'Snyk', and 'HTTPCS' provide comprehensive audits to detect and address vulnerabilities. ...more

Drupal 10.3 introduces Policy Based Access Checking, allowing dynamic permission control based on real-time conditions like user timezone or email domain. This guide from QED42 explains how the new system improves upon traditional role-based access and offers more flexibility for complex scenarios. ...more

Learn how the 2018 "Drupalgeddon 2" vulnerability led to widespread botnet attacks on unpatched Drupal sites. Acquia’s detailed analysis reveals the importance of timely security updates to prevent remote code execution and crypto-mining malware. ...more

PTI WebTech outlines a clear process for adding Google reCaptcha to Drupal sites. The guide walks through module installation, configuration, and activation on webforms to enhance protection against bots and spam. ...more

Explore the expected changes in Drupal 11, from improved content modelling and performance to enhanced security and easier upgrades. This comparison with Drupal 10 highlights what's new for developers and site maintainers. ...more

Discover the top reasons why Drupal CMS stands out for website development. Explore its flexibility, robust security, and scalability, making it a preferred choice for businesses of all sizes. ...more

With Drupal 7 reaching end-of-life in January 2025, Tag1 Consulting offers an extended support service to keep your site secure and maintained. Learn how this service can protect your Drupal 7 investment and provide more time for future planning. ...more

Drupal 7's end-of-life date is January 5, 2025. Discover essential FAQs, key dates, and action steps to ensure your Drupal website remains secure and compliant. ...more

Max Pogonowski from Sitback highlights a recent vulnerability in Drupal sites linked to polyfill.io, where malware was injected into scripts by the new owners. He advises updating Drupal modules or using Cloudflare for protection. The post also introduces the Frontend Bundler Initiative to reduce reliance on third-party CDNs. ...more

The Drupal Security Team has issued a PSA highlighting the need for site owners to actively manage third-party library security. Recent concerns include malicious content from polyfill.io, prompting updates and new security measures. Learn more about the recommended tools and actions to ensure compliance. ...more

Discover how the Drush Firewall module fortifies Drupal websites against unintended alterations caused by specific commands. Explore its role in bolstering security and stability while enabling administrators to fine-tune command execution based on environmental conditions. ...more