Drupal o'z Commerce Core komponentidagi "yuqori darajada kritik" xavfsizlik kamchiligini tahdid aktorlari ekspluatatsiya qilayotganini ogohlantirdi.
CVE-2026-118539 (CVSS balli: N/A) sifatida kuzatilayotgan zaiflik, Commerce Core 0.0.0 dan 2.41 gacha va 3.0.0 dan 3.3.13 gacha bo'lgan versiyalariga ta'sir qiladigan avtorizatsiya yetishmasligi holatidir.
"Ushbu modul sizga mijozlarga tovarlar va xizmatlarni kiritilgan savat va to'lov shakli orqali yoki API'lar orqali ajratilgan ilovalar yordamida sotish imkonini beradi," deb aytdi Drupal maslahatida.
"Modul ma'lum marshrutlar va obyekt maydonlarini yetarlicha himoya qilmaydi, bu esa sotuvchiga moliyaviy ta'sir ko'rsatishi mumkin bo'lgan kirish aylanishiga olib keladi."
Ochiq manbali kontent-boshqaruv tizimi zaiflik "tabiatda faol ekspluatatsiya qilinayotganini" tan oldi, lekin faoliyatning tabiati yoki kampaniyaning ko'lami haqida hech qanday tafsilot bermadi.
Foydalanuvchilarga eng so'nggi versiyaga yangilash tavsiya etiladi -
- 3.x versiyasi - Commerce Core 3.3.13 ga yangilang
- Oldingi versiyalar - Commerce Core 8.x-2.41 ga yangilang
Drupal kamchilikni xabar qilgan tadqiqotchilar Dan Puccetti (dpuccetti), Marcus Johansson (marcus_johansson) va Robert Snyder (rsnyd) ga minnatdorchilik bildirdi.
Bu rivojlanish PHP'dagi CVE-2026-109618 va CVE-2026-109619 (CVSS ballari: 9.2) sifatida kuzatilayotgan va birgalikda PHP2Shell deb ataladigan ikkita kritik zaiflik tabiatda faol ekspluatatsiya urinishlarini ko'rayotgani bilan bir vaqtda sodir bo'lmoqda.
25-oktabr holatiga ko'ra, PHP2Shell'dan sezilarli darajada ta'sirlangan tashkilotlar foizi Google'ga tegishli Wiz ma'lumotlariga ko'ra 52,1% gacha pasaygan.
Bulut xavfsizlik kompaniyasi hozirgacha ikki turdagi faoliyatni kuzatganini aytdi, jumladan, ommaviy isbot-konsepsiya (PoC) ekspluatatsiyalariga mos keladigan PHP2Shell ekspluatatsiya mexanizmidan foydalanadigan urinishlar.
Boshqa toifa "zaifliklar bilan bog'liq bo'lmagan, aksincha sessiya zaharlanishi va ilovadagi alohida mahalliy fayl kiritish (LFI) zaifligiga tayanadigan PHP2Shell-brendli vositalar"ga tegishli, deb aytdilar Wiz tadqiqotchilari Yaara Shriki, Shahar Dorfman, Alma Blachsan va Yaron Samuel.
"Bizning kuzatishlarimiz shuni ko'rsatadiki, faqat xotira tugashini ishga tushirish ekspluatatsiya zanjirini yakunlash uchun yetarli emas. PHP tuzilishlari, xotira cheklovlari va ishchi xatti-harakatlaridagi farqlar keyingi bosqichlarning ishlashiga to'sqinlik qilishi mumkin. Tasodifiy hujumchilar uchun qiyinchilik hozirda mavjud bo'lgan ommaviy PoC'larni xuddi shunday ishonchli operatsion vositalarga aylantirish yoki ularni o'zlari ishlab chiqishdir."
Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component.
The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.
"This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs," Drupal said in an advisory.
"The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor."
The open-source content-management framework acknowledged that the vulnerability is being "actively exploited in the wild," but provided no specifics about the nature of the activity or the extent of the campaign.
Users are being recommended to update to the latest version -
- Version 3.x - Upgrade to Commerce Core 3.3.13
- Earlier versions - Upgrade to Commerce Core 8.x-2.41
Drupal has credited researchers Dan Puccetti (dpuccetti), Marcus Johansson (marcus_johansson), and Robert Snyder (rsnyd) with reporting the flaw.
The development comes as two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), and collectively referred to as PHP2Shell, are witnessing active exploitation attempts in the wild.
As of October 25, the percentage of organizations significantly affected by PHP2Shell has declined to 52.1%, according to data from Google-owned Wiz.
The cloud security company said it has so far observed two types of activities, including attempts using the PHP2Shell exploit mechanism that match public proof-of-concept (PoC) exploits.
The other category refers to "PHP2Shell-branded tools unrelated to the vulnerabilities that instead relied on session poisoning and a separate local file inclusion (LFI) vulnerability in the application," Wiz researchers Yaara Shriki, Shahar Dorfman, Alma Blachsan, and Yaron Samuel said.
"Our observations show that triggering memory exhaustion alone is not enough to complete the exploit chain. Differences in PHP builds, memory limits and worker behavior can prevent subsequent stages from working. The challenge for opportunistic attackers is turning currently available public PoCs into similarly reliable operational tooling or developing it on their own."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.