Drupal just issued an urgent warning that threat actors are actively exploiting a highly critical security flaw in its Commerce Core component, and if you run an online store on Drupal, this is a direct financial threat that you cannot ignore.
The vulnerability is tracked as CVE-2026-118539, it is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13, and it allows an access bypass that may financially impact your vendor operations.
What the Drupal Commerce Flaw Actually Does
Quick Security Checklist
- Scan your system or website
- Update all dependencies
- Change passwords
- Enable 2FA
The Commerce Core module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs, which means it sits directly on top of your revenue stream.
Drupal's advisory is blunt about the problem, stating that the module does not sufficiently protect certain routes and entity fields, which leads to an access bypass.
That bypass could let an unauthorized user reach functionality or data they should never see, and for an e-commerce platform, that translates to real money and customer trust on the line. Drupal confirmed the flaw is being actively exploited in the wild but provided no specifics about the nature of the activity or the extent of the campaign.
The Patch Matrix
The fix is straightforward, but you have to match the version to your release branch.
|
Release Branch |
Fixed Version |
|
Commerce Core 3.x |
3.3.13 |
|
Earlier versions (8.x) |
8.x-2.41 |
Drupal credited researchers Dan Puccetti (dpuccetti), Marcus Johansson (marcus_johansson), and Robert Snyder (rsnyd) with reporting the flaw.
The PHP2Shell Exploitation Update
This Drupal disclosure lands alongside new data on the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2), which have been witnessing active exploitation attempts in the wild.
As of October 25, the percentage of organizations significantly affected by PHP2Shell has declined to 52.1%, according to data from Google-owned Wiz. That is still a staggering number, but it shows that patching efforts are making a dent.
Wiz researchers Yaara Shriki, Shahar Dorfman, Alma Blachsan, and Yaron Samuel noted that they have observed two distinct types of activity.
- Public PoC matches: Attempts using the PHP2Shell exploit mechanism that match public proof-of-concept exploits.
- PHP2Shell-branded tools: Tools unrelated to the actual vulnerabilities that instead relied on session poisoning and a separate local file inclusion (LFI) vulnerability in the application.
Why Reliable Exploitation Is Harder Than It Looks
Wiz made a critical observation that offers some comfort to defenders: triggering memory exhaustion alone is not enough to complete the exploit chain.
Differences in PHP builds, memory limits, and worker behavior can prevent subsequent stages from working, which means opportunistic attackers are struggling to turn currently available public PoCs into similarly reliable operational tooling or to develop it on their own.
That is the gap that separates a proof of concept from a real-world attack, and it is buying defenders time to patch.
What Defenders Should Do Right Now
- Patch Drupal Commerce immediately: Upgrade to Commerce Core 3.3.13 or 8.x-2.41, depending on your branch.
- Perform store front audit: Look for any weird access pattern, API call, or any change in orders and customers' data.
- Patch PHP2Shell: Make sure PHP is upgraded to 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
- Session Poisoning Warning: Be alert to any unusual information in sessions or attempts at including files that use the PHP2Shell-named set of tools Wiz mentioned.
FAQ
What is CVE-2026-118539?
It is a missing authorization flaw in Drupal Commerce Core. It affects versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13, and it allows an access bypass that can financially impact the vendor.
Has this been exploited in the wild?
Yes. Drupal confirmed the vulnerability is being actively exploited, but it did not disclose the nature of the activity or the extent of the campaign.
How do I fix the Drupal Commerce flaw?
Upgrade to Commerce Core 3.3.13 if you are on the 3.x branch, or 8.x-2.41 if you are on an earlier version.
What is the current status of PHP2Shell exploitation?
As of October 25, Wiz data shows that 52.1% of organizations are still significantly affected. Exploitation attempts are ongoing, but memory exhaustion alone is often not enough to complete the exploit chain.
What are the PHP2Shell-branded tools?
They are tools that masquerade as PHP2Shell exploits but actually rely on session poisoning and a separate local file inclusion (LFI) vulnerability in the application, rather than the PHP2Shell flaws themselves.
