Drupal has patched CVE-2026-118539, an exploited Commerce Core access bypass that may financially impact online store owners.

Drupal warns of active exploitation of CVE-2026-118539 in Commerce Core, an authorization bypass flaw that may financially ...

Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system.

Drupal says CVE-2026-118539 is being exploited against 42,000-plus sites, pushing Commerce Core users to patch and review ...

Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are ...

Attackers are exploiting flaws in outdated operating systems and zero-day vulnerabilities in Drupal, Ivanti Connect Secure ...

Explore the latest news, real-world incidents, expert analysis, and trends in Drupal — only on The Hacker News, the leading ...

Everyone planning and building Web solutions with Drupal benefits from understanding what a "hook" is—and why Drupal is not a CMS. One of the greatest challenges that Drupal adopters face, whether ...

For the Georgia Technology Authority (GTA), the decision to dump its aging content management system (CMS) was easy. Running 65 state government websites on two different versions of proprietary ...

Drupal issued a security advisory of four critical vulnerabilities rated from moderately critical to critical. The vulnerabilities affect Drupal versions 9.3 and 9.4. The security advisory warned that ...