Security

The Drupal Association has released critical security updates for Drupal 7, addressing vulnerabilities in the Overlay module and potential object injection risks. With Drupal 7's end-of-life set for January 2025, Tag1 will provide ongoing support through the Drupal 7 Extended Support (D7ES) program. ...more

Drupal expert Michael Anello explains how to resolve the oEmbed security warning in the Media module by implementing a secure subdomain for iframe embedding. The guide covers setting up a subdomain, updating DNS records, modifying response headers, and configuring Drupal settings to enhance security and streamline site maintenance. ...more

Drupal unveiled three updates on November 20, 2024: Drupal 11.0.8, which includes new features and long-term compatibility; Drupal 10.3.9, which focuses on security and bug fixes; and Drupal 7.102, which is part of its final maintenance phase. Administrators are urged to update promptly to ensure security and compatibility. ...more

A critical issue involves reflected cross-site scripting (XSS) attacks, particularly those that affect Drupal 7 installations with the overlay module enabled. This flaw stems from improper input validation, enabling attackers to inject harmful code into a victim's browser. ...more

A range of advanced vulnerability scanners now offers proactive solutions to address security challenges. Tools like 'Pentest-Tools', 'SUCURI', 'Astra', 'Detectify', 'Snyk', and 'HTTPCS' provide comprehensive audits to detect and address vulnerabilities. ...more

Nadiia Nykolaichuk from ImageX explores food-themed Drupal modules like Coffee, Crazy Egg, and Honeypot that boost site functionality. These modules streamline navigation, enhance security, support GDPR compliance, and offer advanced analytics for a stronger digital experience. ...more

Drupal developer Harshal Pradhan warns that directly modifying the 'composer.lock' file in Drupal 10 can create serious stability, security, and deployment issues. While there are rare exceptions, developers are advised to rely on Composer commands to manage dependencies. ...more

A security flaw in Drupal core’s CKEditor 5 module can disrupt site operations under specific configurations. Users are urged to update to version 10.2.10 to mitigate potential risks. ...more

Morpht's nightly CI job identified a high-severity vulnerability in Drupal core's twig package, prompting quick action and community response to resolve the issue. ...more

Learn how the 2018 "Drupalgeddon 2" vulnerability led to widespread botnet attacks on unpatched Drupal sites. Acquia’s detailed analysis reveals the importance of timely security updates to prevent remote code execution and crypto-mining malware. ...more

The Views Slideshow module, used by 70,000 Drupal 7 sites, recently lost official security support, leaving many sites vulnerable. D7Security has taken over maintenance, but site owners must act to ensure continued protection. ...more

Discover effective strategies for preventing spam on your Drupal website using modules like http:BL and Spambot. Learn how these tools can reduce unwanted content and protect against fake accounts without disrupting user experience. ...more