Security

Security

Security

Drupal Commerce Access Bypass Actively Exploited as Drupal Issues 39 Advisories

Share

× SHARE

Patching the vulnerability may not be enough for affected Drupal Commerce stores. The Security Team has also instructed operators to check their orders for inconsistencies. ...more

Read Full Content
Security

CISA Adds PHP2Shell Flaws to KEV Catalogue, Lists 29 October Deadline

Share

× SHARE

A new CISA deadline raises the urgency of the PHP2Shell response. Specbee's account of emergency Drupal patching shows why deploying fixes and establishing what happened before them are separate challenges. ...more

Read Full Content
Security

Drupal Association Audits Drupal.org After PHP2Shell Fixes

Share

× SHARE

A patched server may still hold evidence of an earlier intrusion. Amazon's earliest reported PHP2Shell attack attempt occurred four days before public disclosure, raising questions about activity that preceded emergency updates. ...more

Read Full Content
Security

Drupal Issues 34 Contrib Security Advisories, Including Highly Critical RCE

Share

× SHARE

A vulnerable module does not always mean an immediately exploitable site. Upload permissions, token usage and configuration settings can determine the actual exposure. ...more

Read Full Content
Security

Drupal Fixes Two Critical Remote Code Execution Flaws and Three XSS Vulnerabilities

Share

× SHARE

Updating Drupal core is only part of the response. Two contributed projects also require separate security fixes. ...more

Read Full Content
Security

DruBOM Beta2 Adds Dependency Mapping to Drupal Security Inventory

Share

× SHARE

A vulnerable package may be easy to spot but harder to trace. DruBOM beta2 adds a way to examine where a dependency came from. ...more

Read Full Content
Security

Drupal Security Team Sets Critical Core Release for 14 October

Share

× SHARE

The vulnerability remains undisclosed ahead of Wednesday’s fix. A previous core release showed how quickly working exploits can follow. ...more

Read Full Content
Security

Six Banks Fund OSERA's Shared Open-Source Security Fixes

Share

× SHARE

Banks often commission fixes for the same open-source libraries. OSERA is testing a shared way to fund and verify that work. ...more

Read Full Content
Security

CVE-2026-59944 Affects Composer Versions Still Compatible With Drupal 11

Share

× SHARE

A Composer symlink flaw affects versions that still satisfy Drupal 11's minimum requirement. The fix is available in Composer 2.10.3 and 2.2.30. ...more

Read Full Content
Security

Joomla Fixes 16 Security Issues as 5.4.9 Breaks API PATCH Requests

Share

× SHARE

Sites relying on Joomla's Web Services API have an extra check to make after applying the latest security update. ...more

Read Full Content
Security

PHP 8.2–8.5 Security Releases Fix 11 CVEs Across Drupal-Compatible Runtimes

Share

× SHARE

PHP branches used by supported Drupal 10 and 11 environments received security fixes, but determining exposure requires more than checking a version number. ...more

Read Full Content
Security

Drupal Security Team Publishes 36 Contributed-Project Advisories, Including Critical Webform RCE

Share

× SHARE

The September disclosure turns a pre-announced security release into a broader maintenance task across 16 projects. Exposure varies sharply by configuration, so operators need more than the Critical labels to set priorities. ...more

Read Full Content

Latest

How to Use AI Coding Agents on Drupal Projects with AGENTS.md, Tests and MCP

29 October 2026
X to Drupal: QED42 Migrates 646 Pages From Webflow to Drupal 11

29 October 2026
Drupal Commerce Access Bypass Actively Exploited as Drupal Issues 39 Advisories

29 October 2026

Follow @thedroptimes