Drupal Patches Two Critical RCE Flaws, Urges Immediate Update Before Exploits Emerge

What Happened

Drupal has released patches for two critical remote code execution (RCE) vulnerabilities affecting all supported versions of the CMS, according to BleepingComputer. The flaws could allow an attacker to execute arbitrary code on affected websites. Specific CVE identifiers, technical root cause, and exploitation prerequisites have not yet been detailed in the reporting available to us.

Why It Matters

Drupal powers a large base of government, enterprise, and media websites, and critical RCE issues in a widely deployed CMS are historically a high-value target for mass scanning once technical details or proof-of-concept code surface — prior Drupal RCE disclosures (e.g., the "Drupalgeddon" incidents) were weaponized within days of patch release. Any site running an affected supported version is potentially exposed until patched, regardless of size or visibility.

What Defenders Should Do Now

• Identify all Drupal instances in your environment (core sites, subsidiary brand sites, staging/dev instances that are often overlooked) and confirm patch status.
• Apply the vendor-supplied updates as soon as they can be validated in a staging environment — treat this as urgent given Drupal's own warning that exploitation may follow quickly.
• Until patched, consider WAF/virtual-patching rules for anomalous requests to Drupal core/module endpoints, and review web server and application logs for unusual POST requests, unexpected file writes, or new/modified PHP files in the webroot.
• Hunt for post-exploitation indicators common to prior Drupal RCEs: unexpected outbound connections from web servers, newly created admin accounts, or unfamiliar scheduled tasks/cron entries on the host.
• Monitor vendor and CVE databases for the official identifiers and technical write-up as they become available, since exploitation details will materially change prioritization.

Developing Story

This is a net-new advisory and full technical detail (affected versions, CVE numbers, exploit maturity) was not yet available at the time of this write-up. Check back as more information emerges, and see the original report at BleepingComputer for updates.