Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw Ravie LakshmananOct 30, 2026Vulnerability / Web Security Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. "This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs," Drupal said in an advisory. "The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor." The open-source content-management framework acknowledged that the vulnerability is being "actively exploited in the wild," but provided no specifics about the nature of the activity or the extent of the campaign. Users are being recommended to update to the latest version - Version 3.x - Upgrade to Commerce Core 3.3.13 Earlier versions - Upgrade to Commerce Core 8.x-2.41 Drupal has credited researchers Dan Puccetti (dpuccetti), Marcus Johansson (marcus_johansson), and Robert Snyder (rsnyd) with reporting the flaw. The development comes as two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), and collectively referred to as PHP2Shell, are witnessing active exploitation attempts in the wild. As of October 25, the percentage of organizations significantly affected by PHP2Shell has declined to 52.1%, according to data from Google-owned Wiz. The cloud security company said it has so far observed two types of activities, including attempts using the PHP2Shell exploit mechanism that match public proof-of-concept (PoC) exploits. The other category refers to "PHP2Shell-branded tools unrelated to the vulnerabilities that instead relied on session poisoning and a separate local file inclusion (LFI) vulnerability in the application," Wiz researchers Yaara Shriki, Shahar Dorfman, Alma Blachsan, and Yaron Samuel said. "Our observations show that triggering memory exhaustion alone is not enough to complete the exploit chain. Differences in PHP builds, memory limits and worker behavior can prevent subsequent stages from working. The challenge for opportunistic attackers is turning currently available public PoCs into similarly reliable operational tooling or developing it on their own." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Cyber Attack, Drupal, Vulnerability, Web Security Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web Get the Five-Stage Identity Maturity Roadmap for Governing AI Agents Benchmark Your AI Risk Priorities Against 1,600 CISOs—Download the 2026 Report No Exploit Yet? Preview the Summit Demo on Validating CVE Exposure Download the 2026 Agent Security Report for a Five-Step Risk Reduction Framework Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Watch Free Now Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. FBI Cyber Division's Brett Leatherman Keynotes SANS CDI 2026, Dec 15 Join SANS CEO James Lyne and the FBI on ransomware disruption and intel sharing, during SANS training in D.C. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Accelerate Incident Response: 95% Faster Containment Cut containment time from 48 hours to 3. Read the Orchid IR case study. Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security Your Backup Isn't Ransomware-Proof Just Because It Exists The Least Trusted Author Sets the AI Agent's Privilege Security Rests on Hard Math Problems. Quantum and AI Are Both Coming for Them