Attackers exploit critical authorization flaw in Drupal Commerce Core

Drupal has warned that threat actors are exploiting a vulnerability in its Commerce Core component, which has been rated "highly critical." The flaw is tracked as CVE-2026-118539, and no CVSS score has been given.

The issue is a case of missing authorization. It affects Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. Drupal's advisory explains that the module lets merchants sell goods and services through a built-in shopping cart and checkout form, or through decoupled applications via APIs. According to the developers, the module does not adequately protect certain routes and entity fields. This allows access controls to be bypassed and may cause the vendor financial harm.

Drupal confirmed the flaw is being "actively exploited in the wild" but disclosed neither the nature of the attacks nor their scale. Users are advised to update to the latest version of the 3.x branch, and those on earlier releases to Commerce Core 8.x-2.41. The flaw was reported by researchers Dan Puccetti, Marcus Johansson, and Robert Snyder.

PHP2Shell: attacks continue

Meanwhile, attackers are still trying to exploit two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both scored 9.2 on the CVSS scale. Together they are known as PHP2Shell. According to Google-owned Wiz, the share of organizations significantly affected by PHP2Shell had fallen to 52.1% as of October 25.

Wiz has identified two types of activity. The first consists of attempts to use the PHP2Shell exploit mechanism that match public proofs of concept. The second involves tools that merely carry the PHP2Shell name and have nothing to do with the vulnerabilities themselves. They rely on session poisoning and a separate local file inclusion (LFI) flaw in the application.

Wiz researchers note that triggering memory exhaustion alone is not enough to complete the exploit chain. Differences in PHP builds, memory limits, and worker behavior can stop later stages from working. Opportunistic attackers therefore still have to turn the public PoCs into equally reliable operational tools or build such tools themselves.

Source: The Hacker News