Drupal Patches Two Critical Remote Code Execution Flaws
BleepingComputer reports that Drupal has fixed two critical vulnerabilities affecting supported versions. The flaws could allow remote code execution; the available account does not establish active attacks.
The Short Version
Drupal has patched two critical security vulnerabilities, according to BleepingComputer. The report says the flaws could let attackers run code remotely on websites using any supported version of the content management system.
Why It Matters
For someone responsible for a Drupal website, the reported risk concerns code running on the site. The account describes a potential capability for attackers, rather than confirming that a particular website has been compromised.
The Bigger Picture
The supported-version scope makes this broader than a report limited to an obsolete release. However, the brief description does not explain which conditions an attacker would need to meet. It should not be read as proof that every Drupal installation can be attacked in the same way.
What to Watch
The available account supplies no vulnerability identifiers or patched release numbers and does not establish active exploitation. Those details are needed to connect this warning to a specific installation and its update status.
How do you keep track of security updates for the software behind your website?
Connie Brew